From MAILER-DAEMON Tue Jun 23 06:18:39 2009 Date: 23 Jun 2009 06:18:39 -0700 From: Mail System Internal Data Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA X-IMAP: 1245763119 0000000395 Status: RO This text is part of the internal format of your mail folder, and is not a real message. It is created automatically by the mail system software. If deleted, important folder data will be lost, and it will be re-created with the data reset to initial values. From usmanabu04@eircom.net Fri Jan 2 04:44:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************************** X-Spam-Status: Yes, score=30.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,DNS_FROM_RFC_ABUSE, J_CHICKENPOX_32,J_CHICKENPOX_33,J_CHICKENPOX_42,J_CHICKENPOX_43, J_CHICKENPOX_56,J_CHICKENPOX_74,MILLIONS_01,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,NA_DOLLARS,PHISH_05,SPAMMY_WEBMAIL,STOX_30,SUBJ_ALL_CAPS, UPPERCASE_75_100,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from mail25.svc.cra.dublin.eircom.net (mail25.svc.cra.dublin.eircom.net [159.134.118.54]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n02Ci7oY006877 for ; Fri, 2 Jan 2009 04:44:11 -0800 Message-Id: <200901021244.n02Ci7oY006877@ga.impsec.org> Received: (qmail 48208 messnum 16330411 invoked from network[86.43.60.103/webmail03.webmail.cra.eircom.net]); 2 Jan 2009 12:17:27 -0000 Received: from webmail03.webmail.cra.eircom.net (HELO webmailclassic.eircom.net) (86.43.60.103) by mail25.svc.cra.dublin.eircom.net (qp 48208) with SMTP; 2 Jan 2009 12:17:27 -0000 From: "usman abu" Reply-To: To: a_j_ack02@yahoo.com Subject: [SPAM] READ AND GET BACK TO ME Date: Fri, 2 Jan 2009 12:16:27 +0000 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit X-Originating-IP: 66.198.41.11 X-Mailer: Eircom Net CRC Webmail (http://www.eircom.net/) Organization: Eircom Net (http://www.eircom.net/) X-Greylist: Delayed for 00:26:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 02 Jan 2009 04:44:11 -0800 (PST) X-Spam-Prev-Subject: READ AND GET BACK TO ME Status: R X-Status: X-Keywords: X-UID: 1 Content-Length: 2487 DEAR FRIEND, I AM MR.USMAN ABU,THE BILL AND EXCHANGE MANAGER. I WORK IN THE AUDITING/ACCOUNTING SECTION OF THE BANK OF AFRICA(BOA),OUAGADOUGOU, BURKINA FASO. I HAVE A BUSINESS DEAL WHICH WILL BE BENEFICIAL TO THE BOTH OF US. THE AMOUNT OF MONEY INVOLVED IS EIGHTEEN MILLION,FIVE HUNDRED THOUSAND USA DOLLARS ($18.5 MILLION US DOLLARS) ,WHICH I WANT TO TRANSFER OUT OF THE COUNTRY TO YOUR BANK ACCOUNT, ALL TO MY FINANCIAL BENEFIT AND YOURS TOO. AND ALSO TO TAKE MY WIFE TO USA FOR TREATMENT OF LIVER DAMAGE. THIS MONEY WAS OWNED BY ONE OF THE CUSTOMERS IN OUR BANK.THE MAN'S NAME IS CALLED ANDREAS SCHRANNER FROM MUNICH,GERMANY.HE WAS INTO PROPERTIES AS HIS BUSINESS IN GERMANYAND BUSINESS COMMERCIALIST IN WEST-AFRICAN REGIONS. HE HAS BEEN DEAD SINCE NINE YEARS AGO ON 25TH JULY,2000 CONCORDE PLANE CRASH[Flight AF4590 ] WITH THE WHOLE PASSENGERS ABOARD . N.B.IN OTHER FOR YOU TO BELIEVE ME HONESTLY GO THROUGH THIS (website) BEFORE YOU START WITH ME. BELOW IS THE WEBSITE: ( http://news.bbc.co.uk/1/hi /world/europe/859479.stm) AND SINCE THEN,NO CLAIM HAS BEEN PLACED IN HIS BANK ACCOUNT BALANCE. I WANT TO TRANSFER THIS MONEY OUT OF THE COUNTRY BUT SUCH FUND CAN NOT BE TRANSFERRED WITHOUT A NEXT OF KIN ATTACHED TO THE FUND. THE FUND COULD BE TRANSFERRED IN THESE WAY;YOU SHALL PRESENT YOURSELF AS BUSINESS ASSOCIATES TO THE DECEASED PERSON[ANDREAS SCHRANNER] OR AS THE ONLY SURVIVING NEXT OF KIN,AS DETAILS SHALL BE THAT YOU ARE THE CARE-TAKER BUSINESS ASSOCIATES TO MR.ANDREAS SCHRANNER AND HIS PROPERTIES. I SHALL MAKE AVAILABLE TO YOU MATERIALS AND INFORMATIONS WITH WHICH A SUCCESSFUL CLAIM SHALL BE PLACED ON THE FUND. I SHALL BE YOUR GUIDIANCE AND INSTRUCTOR THROUGHOUT THE DURATION OF THIS TRANSACTION SO AS TO ENSURE A SWIFT AND SURE TRANSFER OF THE FUND TO YOUR BANK ACCOUNT. AS TO YOUR BENEFITS, YOU SHALL BE ENTITLED TO 40% OF THIS FUND FOR YOUR CO-OPERATION IN THIS TRANSACTION WHILE 5% WILL BE SET ASIDE FOR EXPENCES BOTH OF US MIGHT INCURE DURING THE COURSE OF THIS TRANSACTION. SO IF YOU ARE INTERESTED, SEND A REPLY TO ME IMMEDIATELY AND IN YOUR REPLY PLEASE INCLUDE YOUR [PRIVATE PHONE AND YOUR FAX NUMBERS] URGENCY HAS TO BE IMPLIED AND THIS BUSINESS MUST STRICTLY BE A DEAL BETWEEN BOTH OF US. BEST REGARDS, MR.USMAN ABU. Bill & Exchange Manager(BOA) ----------------------------------------------------------------- Find the home of your dreams with eircom net property Sign up for email alerts now http://www.eircom.net/propertyalerts From johnsongrandt01@inMail24.com Sat Jan 3 01:56:22 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************************** X-Spam-Status: Yes, score=41.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_95,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML, FORGED_OUTLOOK_TAGS,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_10_20,HTML_MESSAGE, HTML_TITLE_EMPTY,JM_SOUGHT_FRAUD_1,L_SOME_STD_PROBS,MIME_HTML_ONLY, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,PHISH_05,PLING_PLING,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FREE_WEBM_MailD,SARE_SUB_NEED_REPLY, TO_CC_NONE,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 1.5 SARE_FREE_WEBM_MailD Sender used free email account - may be spammer * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.4 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9574] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 0.3 PLING_PLING Subject has lots of exclamation marks * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from telkomsa.net (desdemona.telkomsa.net [196.25.211.7]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n039uEw5006048 for ; Sat, 3 Jan 2009 01:56:18 -0800 Message-Id: <200901030956.n039uEw5006048@ga.impsec.org> Received: (qmail 32346 invoked from network); 3 Jan 2009 09:27:55 -0000 Received: from unknown (HELO User) (telkomsa269021@telkomsa.net@[193.220.50.10]) (envelope-sender ) by O (qmail-ldap-1.03) with SMTP for ; 3 Jan 2009 09:27:50 -0000 Reply-To: From: "Mr.Johnson Grandt" Subject: [SPAM] Your Urgent Assistance Needed!!! Date: Sat, 3 Jan 2009 10:35:17 +0100 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:27:54 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 03 Jan 2009 01:56:20 -0800 (PST) X-Spam-Prev-Subject: Your Urgent Assistance Needed!!! Status: R X-Status: X-Keywords: X-UID: 2 Content-Length: 4042
Reply
 
Compliment Of Season,
 
 
First of all, let me start by introducing myself. My name is Mr. Johnson Grandt, the Auditor General of European Union Investment Private Bank London. I have an urgent and very confidential business proposition for you. I am the accounting officer of Mr. Ken Lay, Enron founder, who died on July, 5th 2006, at the age of 64 and his friend and partner Mr. Jeffrey Skilling, Ex-Enron CEO who was recently convicted 24 years for his involvement on the collapse of Enron, the energy trading giant in America.
It will interest you to know that on Wednesday, 7th February 2001, Mr. Ken Lay deposited a total sum of 15M pounds and on Tuesday, 24th April 2001, Mr. Jeffrey Skilling deposited 10.5M Pounds in our Bank. These funds were deposited into a non-existing company's account which I opened in our bank (EUROPEAN UNION INVESTMENT PRIVATE BANK) under their instructions, to avoid raising an eyebrow but unfortunately for them and fortunately for me, the 2 men are gone. You can read more about the 2 men by visiting the below websites:
http://www.chron.com/newas/specials/enron/
http://www.accountancyage.com/accountancyage/news/2171002/enron-ceo-sentence-slashed
So right now, we have the sum of 25.5M Pounds lying in the 2 accounts without any proof of ownership as it was opened with non-existing companies name and the bank is not aware of the real beneficiaries as the accounts did not bear any name. As their accounting officer and financial adviser in charge of these accounts, I can comfortable present you to the Bank as the real beneficiary of the funds and the Bank have no right to deny the application.
 
Consequently, my proposal is that I want to seek your consent as a foreigner to present you as the next of kin of the two deceased accounts, since it has no trace or beneficiary which makes it easier and fine to transfer to your designated bank account as the beneficiary. The nature of my work as a staff of the Bank will not allow me lay claim on the funds, hence this proposal to you and be informed that as long as you are ready to cooperate and be truthful to me, I can assure you that the sky will be our limit.
All documents and proves to enable you get any of the money will be carefully worked out and more so, I assure you that the business is risk free, as everything will be handled in accordance with the International Monetary Guidelines. I am offering you 40% for your cooperation in achieving this aim. Please, if you are interested in working with me, I will like you to send the below informations to enable me procure the necessary documents that will back up the transfer to your account:
1. YOUR FULL NAMES AND ADDRESS.
2. AGE, SEX AND MARITAL STATUS.
3. OCCUPATION.
4. NATIONALITY.
5. TELEPHONE AND FAX NUMBERS FOR EASY COMMUNICATIONS.
As soon as I receive your acceptance mail by forwarding the above informations, I will prepare the paper works in your name for onward remittance of the funds into your designated account. Lastly, I want you to understand that this transaction requires trust, honest and above all, utmost confidentiality, to avoid escalating. I guarantee you that this transaction will be executed under a legitimate arrangement that will protect our both family from any breach of the law.
 
Regards.
Mr. Johnson Grandt
The Auditor General,
EUROPEAN UNION INVESTMENT PRIVATE BANK.
 
 
 
 
 From diouf_mouka02@yahoo.ca Sat Jan 3 05:25:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,FREEMAIL_FROM, FREEMAIL_REPLYTO,FROM_HAS_ULINE_NUMS,HTML_10_20,HTML_MESSAGE, JM_SOUGHT_FRAUD_1,J_CHICKENPOX_32,J_CHICKENPOX_33,J_CHICKENPOX_42, J_CHICKENPOX_43,J_CHICKENPOX_53,J_CHICKENPOX_56,J_CHICKENPOX_73, J_CHICKENPOX_74,MILLIONS_01,NA_DOLLARS,PHISH_05,STOX_30,SUBJ_ALL_CAPS, UPPERCASE_75_100,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.3 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n61a.bullet.mail.sp1.yahoo.com (n61a.bullet.mail.sp1.yahoo.com [98.136.45.8]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n03DP3h7011755 for ; Sat, 3 Jan 2009 05:25:06 -0800 Received: from [69.147.84.144] by n61.bullet.mail.sp1.yahoo.com with NNFMP; 03 Jan 2009 12:57:58 -0000 Received: from [67.195.9.82] by t6.bullet.mail.sp1.yahoo.com with NNFMP; 03 Jan 2009 12:57:57 -0000 Received: from [67.195.9.104] by t2.bullet.mail.gq1.yahoo.com with NNFMP; 03 Jan 2009 12:57:57 -0000 Received: from [127.0.0.1] by omp108.mail.gq1.yahoo.com with NNFMP; 03 Jan 2009 12:57:57 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 826772.27281.bm@omp108.mail.gq1.yahoo.com Received: (qmail 13397 invoked by uid 60001); 3 Jan 2009 12:57:57 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.ca; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=f2HrAghfQMTlcZGYAw2qVpvtRoGQebRJJzXy9rIAKDbiXGix9lnsP8X6/2Y02BotcWICk2yf4vtERYndWpbhFo49dVC5XFRBeXIAbgyUAX4C4e47/5VgNnXNhQZO7KFKe+MdnJUBNiWkfU+IntvaNhHFWpxYsDKGHR4M1kfPeZ0=; Received: from [41.203.232.101] by web111011.mail.gq1.yahoo.com via HTTP; Sat, 03 Jan 2009 04:57:57 PST Date: Sat, 3 Jan 2009 04:57:57 -0800 (PST) From: Diouf Mouka Reply-To: diouf_mouka100@yahoo.com Subject: [SPAM] READ AND GET BACK TO ME To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1303797544-1230987477=:11427" Content-Transfer-Encoding: 8bit Message-ID: <648998.11427.qm@web111011.mail.gq1.yahoo.com> X-Greylist: Delayed for 00:27:03 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 03 Jan 2009 05:25:06 -0800 (PST) X-Spam-Prev-Subject: READ AND GET BACK TO ME Status: R X-Status: X-Keywords: X-UID: 3 Content-Length: 5402 --0-1303797544-1230987477=:11427 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: diouf_mouka02@yahoo.ca - DEAR FRIEND, I AM MR.DIOUF MOUKA,THE BILL AND EXCHANGE MANAGER. I WORK IN THE AUDITING/ACCOUNTING SECTION OF THE BANK OF AFRICA (BOA),OUAGADOUGOU, BURKINA FASO. I HAVE A BUSINESS DEAL WHICH WILL BE BENEFICIAL TO THE BOTH OF US. THE AMOUNT OF MONEY INVOLVED IS EIGHTEEN MILLION,FIVE HUNDRED THOUSAND USA DOLLARS ($18.5 MILLION US DOLLARS) ,WHICH I WANT TO TRANSFER OUT OF THE COUNTRY TO YOUR BANK ACCOUNT, ALL TO MY FINANCIAL BENEFIT AND YOURS TOO. AND ALSO TO TAKE MY WIFE TO USA FOR TREATMENT OF LIVER DAMAGE. THIS MONEY WAS OWNED BY ONE OF THE CUSTOMERS IN OUR BANK.THE MAN'S NAME IS CALLED ANDREAS SCHRANNER FROM MUNICH,GERMANY.HE WAS INTO PROPERTIES AS HIS BUSINESS IN GERMANYAND BUSINESS COMMERCIALIST IN WEST-AFRICAN REGIONS. HE HAS BEEN DEAD SINCE EIGHT YEARS AGO ON 25TH JULY,2000 CONCORDE PLANE CRASH[Flight AF4590 ] WITH THE WHOLE PASSENGERS ABOARD . N.B.IN OTHER FOR YOU TO BELIEVE ME HONESTLY GO THROUGH THIS (website) BEFORE YOU START WITH ME. BELOW IS THE WEBSITE: ( http://news.bbc.co.uk/1/hi /world/europe/859479.stm) AND SINCE THEN,NO CLAIM HAS BEEN PLACED IN HIS BANK ACCOUNT BALANCE. I WANT TO TRANSFER THIS MONEY OUT OF THE COUNTRY BUT SUCH FUND CAN NOT BE TRANSFERRED WITHOUT A NEXT OF KIN ATTACHED TO THE FUND. THE FUND COULD BE TRANSFERRED IN THESE WAY;YOU SHALL PRESENT YOURSELF AS BUSINESS ASSOCIATES TO THE DECEASED PERSON[ANDREAS SCHRANNER] OR AS THE ONLY SURVIVING NEXT OF KIN,AS DETAILS SHALL BE THAT YOU ARE THE CARE-TAKER BUSINESS ASSOCIATES TO MR.ANDREAS SCHRANNER AND HIS PROPERTIES. I SHALL MAKE AVAILABLE TO YOU MATERIALS AND INFORMATIONS WITH WHICH A SUCCESSFUL CLAIM SHALL BE PLACED ON THE FUND. I SHALL BE YOUR GUIDIANCE AND INSTRUCTOR THROUGHOUT THE DURATION OF THIS TRANSACTION SO AS TO ENSURE A SWIFT AND SURE TRANSFER OF THE FUND TO YOUR BANK ACCOUNT. AS TO YOUR BENEFITS, YOU SHALL BE ENTITLED TO 40% OF THIS FUND FOR YOUR CO-OPERATION IN THIS TRANSACTION WHILE 5% WILL BE SET ASIDE FOR EXPENCES BOTH OF US MIGHT INCURE DURING THE COURSE OF THIS TRANSACTION. SO IF YOU ARE INTERESTED, SEND A REPLY TO M E IMMEDIATELY AND IN YOUR REPLY PLEASE INCLUDE YOUR [PRIVATE PHONE AND YOUR FAX NUMBERS] URGENCY HAS TO BE IMPLIED AND THIS BUSINESS MUST STRICTLY BE A DEAL BETWEEN BOTH OF US. BEST REGARDS, Bill & Exchange Manager(BOA). --0-1303797544-1230987477=:11427 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: diouf_mouka02@yahoo.ca



- DEAR FRIEND, I AM MR.DIOUF MOUKA,THE BILL AND EXCHANGE MANAGER. I WORK IN THE AUDITING/ACCOUNTING SECTION OF THE BANK OF AFRICA (BOA),OUAGADOUGOU, BURKINA FASO. I HAVE A BUSINESS DEAL WHICH WILL BE BENEFICIAL TO THE BOTH OF US. THE AMOUNT OF MONEY INVOLVED IS EIGHTEEN MILLION,FIVE HUNDRED THOUSAND USA DOLLARS ($18.5 MILLION US DOLLARS) ,WHICH I WANT TO TRANSFER OUT OF THE COUNTRY TO YOUR BANK ACCOUNT, ALL TO MY FINANCIAL BENEFIT AND YOURS TOO. AND ALSO TO TAKE MY WIFE TO USA FOR TREATMENT OF LIVER DAMAGE. THIS MONEY WAS OWNED BY ONE OF THE CUSTOMERS IN OUR BANK.THE MAN'S NAME IS CALLED ANDREAS SCHRANNER FROM MUNICH,GERMANY.HE WAS INTO PROPERTIES AS HIS BUSINESS IN GERMANYAND BUSINESS COMMERCIALIST IN WEST-AFRICAN REGIONS. HE HAS BEEN DEAD SINCE EIGHT YEARS AGO ON 25TH JULY,2000 CONCORDE PLANE CRASH[Flight AF4590 ] WITH THE WHOLE PASSENGERS ABOARD . N.B.IN OTHER FOR YOU TO BELIEVE ME HONESTLY GO THROUGH THIS (website) BEFORE YOU START WITH ME. BELOW IS THE WEBSITE: ( http://news.bbc.co.uk/1/hi /world/europe/859479.stm) AND SINCE THEN,NO CLAIM HAS BEEN PLACED IN HIS BANK ACCOUNT BALANCE. I WANT TO TRANSFER THIS MONEY OUT OF THE COUNTRY BUT SUCH FUND CAN NOT BE TRANSFERRED WITHOUT A NEXT OF KIN ATTACHED TO THE FUND. THE FUND COULD BE TRANSFERRED IN THESE WAY;YOU SHALL PRESENT YOURSELF AS BUSINESS ASSOCIATES TO THE DECEASED PERSON[ANDREAS SCHRANNER] OR AS THE ONLY SURVIVING NEXT OF KIN,AS DETAILS SHALL BE THAT YOU ARE THE CARE-TAKER BUSINESS ASSOCIATES TO MR.ANDREAS SCHRANNER AND HIS PROPERTIES. I SHALL MAKE AVAILA BLE TO YOU MATERIALS AND INFORMATIONS WITH WHICH A SUCCESSFUL CLAIM SHALL BE PLACED ON THE FUND. I SHALL BE YOUR GUIDIANCE AND INSTRUCTOR THROUGHOUT THE DURATION OF THIS TRANSACTION SO AS TO ENSURE A SWIFT AND SURE TRANSFER OF THE FUND TO YOUR BANK ACCOUNT. AS TO YOUR BENEFITS, YOU SHALL BE ENTITLED TO 40% OF THIS FUND FOR YOUR CO-OPERATION IN THIS TRANSACTION WHILE 5% WILL BE SET ASIDE FOR EXPENCES BOTH OF US MIGHT INCURE DURING THE COURSE OF THIS TRANSACTION. SO IF YOU ARE INTERESTED, SEND A REPLY TO ME IMMEDIATELY AND IN YOUR REPLY PLEASE INCLUDE YOUR [PRIVATE PHONE AND YOUR FAX NUMBERS] URGENCY HAS TO BE IMPLIED AND THIS BUSINESS MUST STRICTLY BE A DEAL BETWEEN BOTH OF US. BEST REGARDS, Bill & Exchange Manager(BOA).
--0-1303797544-1230987477=:11427-- From diouf_mouka24@yahoo.ca Sat Jan 3 06:20:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,FREEMAIL_FROM, FREEMAIL_REPLYTO,FROM_HAS_ULINE_NUMS,HTML_10_20,HTML_MESSAGE, JM_SOUGHT_FRAUD_1,J_CHICKENPOX_32,J_CHICKENPOX_33,J_CHICKENPOX_42, J_CHICKENPOX_43,J_CHICKENPOX_53,J_CHICKENPOX_56,J_CHICKENPOX_73, J_CHICKENPOX_74,MILLIONS_01,NA_DOLLARS,PHISH_05,STOX_30,SUBJ_ALL_CAPS, UPPERCASE_75_100,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.3 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n73a.bullet.mail.sp1.yahoo.com (n73a.bullet.mail.sp1.yahoo.com [98.136.45.20]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n03EKYJ4013253 for ; Sat, 3 Jan 2009 06:20:37 -0800 Received: from [216.252.122.219] by n73.bullet.mail.sp1.yahoo.com with NNFMP; 03 Jan 2009 13:54:16 -0000 Received: from [67.195.9.81] by t4.bullet.sp1.yahoo.com with NNFMP; 03 Jan 2009 13:54:16 -0000 Received: from [67.195.9.110] by t1.bullet.mail.gq1.yahoo.com with NNFMP; 03 Jan 2009 13:54:15 -0000 Received: from [127.0.0.1] by omp114.mail.gq1.yahoo.com with NNFMP; 03 Jan 2009 13:54:15 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 979777.5634.bm@omp114.mail.gq1.yahoo.com Received: (qmail 62587 invoked by uid 60001); 3 Jan 2009 13:54:15 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.ca; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=kNAnbu/yLLJhtLFvKecXE8Hoyv8qLVPE0pIYsJ0H6OpBnFj+x2MGFASl/2dvzuVXUoe3Zq7r0FxifrOHHNd4eUmz772fVTixPN7efJqodokPiOZj6DLh5f+w9s7VYJTppKbgbv4Us22Nxd4+Ep0D/dHh/PHCu6CvW7dMYFc49/A=; Received: from [41.203.232.101] by web112213.mail.gq1.yahoo.com via HTTP; Sat, 03 Jan 2009 05:54:15 PST Date: Sat, 3 Jan 2009 05:54:15 -0800 (PST) From: Diouf Mouka Reply-To: diouf_mouka100@yahoo.com Subject: [SPAM] READ AND GET BACK TO ME To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-324584439-1230990855=:62058" Content-Transfer-Encoding: 8bit Message-ID: <790589.62058.qm@web112213.mail.gq1.yahoo.com> X-Greylist: Delayed for 00:26:16 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 03 Jan 2009 06:20:38 -0800 (PST) X-Spam-Prev-Subject: READ AND GET BACK TO ME Status: R X-Status: X-Keywords: X-UID: 4 Content-Length: 5399 --0-324584439-1230990855=:62058 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: diouf_mouka24@yahoo.ca - DEAR FRIEND, I AM MR.DIOUF MOUKA,THE BILL AND EXCHANGE MANAGER. I WORK IN THE AUDITING/ACCOUNTING SECTION OF THE BANK OF AFRICA (BOA),OUAGADOUGOU, BURKINA FASO. I HAVE A BUSINESS DEAL WHICH WILL BE BENEFICIAL TO THE BOTH OF US. THE AMOUNT OF MONEY INVOLVED IS EIGHTEEN MILLION,FIVE HUNDRED THOUSAND USA DOLLARS ($18.5 MILLION US DOLLARS) ,WHICH I WANT TO TRANSFER OUT OF THE COUNTRY TO YOUR BANK ACCOUNT, ALL TO MY FINANCIAL BENEFIT AND YOURS TOO. AND ALSO TO TAKE MY WIFE TO USA FOR TREATMENT OF LIVER DAMAGE. THIS MONEY WAS OWNED BY ONE OF THE CUSTOMERS IN OUR BANK.THE MAN'S NAME IS CALLED ANDREAS SCHRANNER FROM MUNICH,GERMANY.HE WAS INTO PROPERTIES AS HIS BUSINESS IN GERMANYAND BUSINESS COMMERCIALIST IN WEST-AFRICAN REGIONS. HE HAS BEEN DEAD SINCE EIGHT YEARS AGO ON 25TH JULY,2000 CONCORDE PLANE CRASH[Flight AF4590 ] WITH THE WHOLE PASSENGERS ABOARD . N.B.IN OTHER FOR YOU TO BELIEVE ME HONESTLY GO THROUGH THIS (website) BEFORE YOU START WITH ME. BELOW IS THE WEBSITE: ( http://news.bbc.co.uk/1/hi /world/europe/859479.stm) AND SINCE THEN,NO CLAIM HAS BEEN PLACED IN HIS BANK ACCOUNT BALANCE. I WANT TO TRANSFER THIS MONEY OUT OF THE COUNTRY BUT SUCH FUND CAN NOT BE TRANSFERRED WITHOUT A NEXT OF KIN ATTACHED TO THE FUND. THE FUND COULD BE TRANSFERRED IN THESE WAY;YOU SHALL PRESENT YOURSELF AS BUSINESS ASSOCIATES TO THE DECEASED PERSON[ANDREAS SCHRANNER] OR AS THE ONLY SURVIVING NEXT OF KIN,AS DETAILS SHALL BE THAT YOU ARE THE CARE-TAKER BUSINESS ASSOCIATES TO MR.ANDREAS SCHRANNER AND HIS PROPERTIES. I SHALL MAKE AVAILABLE TO YOU MATERIALS AND INFORMATIONS WITH WHICH A SUCCESSFUL CLAIM SHALL BE PLACED ON THE FUND. I SHALL BE YOUR GUIDIANCE AND INSTRUCTOR THROUGHOUT THE DURATION OF THIS TRANSACTION SO AS TO ENSURE A SWIFT AND SURE TRANSFER OF THE FUND TO YOUR BANK ACCOUNT. AS TO YOUR BENEFITS, YOU SHALL BE ENTITLED TO 40% OF THIS FUND FOR YOUR CO-OPERATION IN THIS TRANSACTION WHILE 5% WILL BE SET ASIDE FOR EXPENCES BOTH OF US MIGHT INCURE DURING THE COURSE OF THIS TRANSACTION. SO IF YOU ARE INTERESTED, SEND A REPLY TO M E IMMEDIATELY AND IN YOUR REPLY PLEASE INCLUDE YOUR [PRIVATE PHONE AND YOUR FAX NUMBERS] URGENCY HAS TO BE IMPLIED AND THIS BUSINESS MUST STRICTLY BE A DEAL BETWEEN BOTH OF US. BEST REGARDS, Bill & Exchange Manager(BOA). --0-324584439-1230990855=:62058 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: diouf_mouka24@yahoo.ca



- DEAR FRIEND, I AM MR.DIOUF MOUKA,THE BILL AND EXCHANGE MANAGER. I WORK IN THE AUDITING/ACCOUNTING SECTION OF THE BANK OF AFRICA (BOA),OUAGADOUGOU, BURKINA FASO. I HAVE A BUSINESS DEAL WHICH WILL BE BENEFICIAL TO THE BOTH OF US. THE AMOUNT OF MONEY INVOLVED IS EIGHTEEN MILLION,FIVE HUNDRED THOUSAND USA DOLLARS ($18.5 MILLION US DOLLARS) ,WHICH I WANT TO TRANSFER OUT OF THE COUNTRY TO YOUR BANK ACCOUNT, ALL TO MY FINANCIAL BENEFIT AND YOURS TOO. AND ALSO TO TAKE MY WIFE TO USA FOR TREATMENT OF LIVER DAMAGE. THIS MONEY WAS OWNED BY ONE OF THE CUSTOMERS IN OUR BANK.THE MAN'S NAME IS CALLED ANDREAS SCHRANNER FROM MUNICH,GERMANY.HE WAS INTO PROPERTIES AS HIS BUSINESS IN GERMANYAND BUSINESS COMMERCIALIST IN WEST-AFRICAN REGIONS. HE HAS BEEN DEAD SINCE EIGHT YEARS AGO ON 25TH JULY,2000 CONCORDE PLANE CRASH[Flight AF4590 ] WITH THE WHOLE PASSENGERS ABOARD . N.B.IN OTHER FOR YOU TO BELIEVE ME HONESTLY GO THROUGH THIS (website) BEFORE YOU START WITH ME. BELOW IS THE WEBSITE: ( http://news.bbc.co.uk/1/hi /world/europe/859479.stm) AND SINCE THEN,NO CLAIM HAS BEEN PLACED IN HIS BANK ACCOUNT BALANCE. I WANT TO TRANSFER THIS MONEY OUT OF THE COUNTRY BUT SUCH FUND CAN NOT BE TRANSFERRED WITHOUT A NEXT OF KIN ATTACHED TO THE FUND. THE FUND COULD BE TRANSFERRED IN THESE WAY;YOU SHALL PRESENT YOURSELF AS BUSINESS ASSOCIATES TO THE DECEASED PERSON[ANDREAS SCHRANNER] OR AS THE ONLY SURVIVING NEXT OF KIN,AS DETAILS SHALL BE THAT YOU ARE THE CARE-TAKER BUSINESS ASSOCIATES TO MR.ANDREAS SCHRANNER AND HIS PROPERTIES. I SHALL MAKE AVAILA BLE TO YOU MATERIALS AND INFORMATIONS WITH WHICH A SUCCESSFUL CLAIM SHALL BE PLACED ON THE FUND. I SHALL BE YOUR GUIDIANCE AND INSTRUCTOR THROUGHOUT THE DURATION OF THIS TRANSACTION SO AS TO ENSURE A SWIFT AND SURE TRANSFER OF THE FUND TO YOUR BANK ACCOUNT. AS TO YOUR BENEFITS, YOU SHALL BE ENTITLED TO 40% OF THIS FUND FOR YOUR CO-OPERATION IN THIS TRANSACTION WHILE 5% WILL BE SET ASIDE FOR EXPENCES BOTH OF US MIGHT INCURE DURING THE COURSE OF THIS TRANSACTION. SO IF YOU ARE INTERESTED, SEND A REPLY TO ME IMMEDIATELY AND IN YOUR REPLY PLEASE INCLUDE YOUR [PRIVATE PHONE AND YOUR FAX NUMBERS] URGENCY HAS TO BE IMPLIED AND THIS BUSINESS MUST STRICTLY BE A DEAL BETWEEN BOTH OF US. BEST REGARDS, Bill & Exchange Manager(BOA).
--0-324584439-1230990855=:62058-- From trillany6@gmail.com Sat Jan 3 07:54:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************* X-Spam-Status: Yes, score=13.5 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_BR_1,DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO, L_SOME_STD_PROBS,RCVD_IN_BRBL,SPF_NEUTRAL,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=trillany6%40gmail.com&ip=201.16.49.10&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9988] * 0.1 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [201.16.49.10 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.clicnet.net (clicnet.net [201.16.49.10]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n03Fs7d8015214 for ; Sat, 3 Jan 2009 07:54:10 -0800 Received: by mail.clicnet.net (Postfix, from userid 33) id 479212B2ADD3; Sat, 3 Jan 2009 10:40:09 -0200 (BRST) Received: from 41.207.21.119 ([41.207.21.119]) by www.clicnet.net (IMP) with HTTP for ; Sat, 03 Jan 2009 10:40:08 -0200 Message-ID: <1230986408.495f5ca87acc7@www.clicnet.net> Date: Sat, 03 Jan 2009 10:40:08 -0200 From: "Ma. Arlene .Trillanes" Reply-To: trillanes5@gmail.com Subject: [SPAM] Dear Partner, MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: Internet Messaging Program (IMP) 3.2.6 X-Originating-IP: 41.207.21.119 To: undisclosed-recipients:; X-Greylist: Delayed for 00:27:53 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 03 Jan 2009 07:54:11 -0800 (PST) X-Spam-Prev-Subject: Dear Partner, Status: R X-Status: X-Keywords: X-UID: 5 Content-Length: 1731 Dear Partner, I am Ma. Arlene .Trillanes, a native of Filipina nationality, I would like to have a long lasting and confidant relationship with you, if possible entrusting my life time fortune into your possession, As now I am broken hearted and needs someone to trust, without remembering my past and forsaken experiences from close confidants and family. I need someone, who would take me for whom I am and as a life time partner, well, from your profile, I believe in me that you ought to be a very honest person. I would like to give you a brief description of my life. I am the sister of senator Antonio Fuentes Trillanes, who was arrested and since detained by the government forces on the 29th day of November 2007.You, may wish to update you with more family & official pictures and news about my brother here: http://www.worldpress.org/Asia/3007.cfm But not quite long, I was also arrested along with my brother , now I have been released and I am under security watch by the present government of Madam Gloria Arroyo . All I wanted from you is to assist me make claims of some funds, he did deposited with a diplomatic vault abroad The Amount being deposited is much about 20.2 million euros, All I want from you is honesty and sincerity, as soon as this money is claimed by you, I will advise you on how to wire some me to me here in Philippine to enable me paid off the chief justice for his demand in getting my brother out of prison. And then fly over to meet you. Write via my private email (trillany8@gmail.com) for more details . Sincerely yours, Ma. Arlene .Trillanes ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. From missfatimaroland02@eircom.net Sat Jan 3 12:29:37 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,DNS_FROM_RFC_ABUSE, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_65,MILLION_USD,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,PHISH_05,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_FRAUD_X6,SARE_TOWRITE,SPAMMY_WEBMAIL,UPPERCASE_75_100,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 1.1 SARE_TOWRITE BODY: Contains phrasing used by spammers * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from mail25.svc.cra.dublin.eircom.net (mail25.svc.cra.dublin.eircom.net [159.134.118.54]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n03KTX3t022493 for ; Sat, 3 Jan 2009 12:29:37 -0800 Message-Id: <200901032029.n03KTX3t022493@ga.impsec.org> Received: (qmail 29768 messnum 16503759 invoked from network[86.43.60.104/webmail04.webmail.cra.eircom.net]); 3 Jan 2009 20:02:53 -0000 Received: from webmail04.webmail.cra.eircom.net (HELO webmailclassic.eircom.net) (86.43.60.104) by mail25.svc.cra.dublin.eircom.net (qp 29768) with SMTP; 3 Jan 2009 20:02:53 -0000 From: "Mrs Stella" Reply-To: To: missfatimaroland02@eircom.net Subject: [SPAM] Overseas partner for assistance Date: Sat, 3 Jan 2009 20:02:53 +0000 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit X-Originating-IP: 66.198.41.11 X-Mailer: Eircom Net CRC Webmail (http://www.eircom.net/) Organization: Eircom Net (http://www.eircom.net/) X-Greylist: Delayed for 00:26:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 03 Jan 2009 12:29:37 -0800 (PST) X-Spam-Prev-Subject: Overseas partner for assistance Status: R X-Status: X-Keywords: X-UID: 6 Content-Length: 2823 DEAR FRIEND , I AM THE MANAGER OF BILL AND EXCHANGE AT THE FOREIGN REMITTANCE DEPARTMENT OF THE BANK OF AFRICA. I SAW YOUR CONTACTS IN INTERNET SEARCH,AFTER MUCH CONSIDERATION I DECIDED TO WRITE YOU SINCE I CANNOT BE ABLE TO SEE YOU FACE TO FACE AT FIRST. I WILL LIKE YOU TO TAKE YOUR TIME TO READ THIS MAIL CAREFULLY. I DID NOT MEAN TO EMBARRASS YOU WITH MY BUSINESS PROPOSAL BUT I SERIOUSLY NEED YOUR ASSISTANCE. PLEASE THIS IS A CONFIDENTIAL MATTER AND IT REQUIRES URGENCY. IN MY DEPARTMENT WE DISCOVERED AN ABANDONED SUM OF U.S$12.5M DOLLARS (TWELVE MILLION FIVE HUNDRED THOUSAND USD) IN AN ACCOUNT THAT BELONGS TO ONE OF OUR FOREIGN CUSTOMER WHO DIED ALONG WITH HIS ENTIRE FAMILY ON MONDAY,31 JULY,2000, IN A PLANE CRASH , SINCE WE GOT INFORMATION ABOUT HIS DEATH, WE HAVE BEEN EXPECTING HIS OR HER NEXT OF KIN TO COME OVER AND CLAIM HIS MONEY BECAUSE WE CAN NOT RELEASE IT UNLESS SOME BODY APPLIES FOR IT AS NEXT OF KIN OR RELATION TO THE DECEASED AS INDICATED IN OUR BANKING GUIDELINES AND LAWS, BUT UNFORTUNATELY WE LEARNT THAT HIS SUPPOSED NEXT OF KIN DIED ALONG SIDE WITH HIM AT THE PLANE CRASH LEAVING NOBODY BEHIND FOR THE CLAIM. IT IS THEREFORE UPON THIS DISCOVERY, I NOW DECIDED TO MAKE THIS BUSINESS PROPOSAL TO YOU AND RELEASE THE MONEY TO YOU AS THE NEXT OF KIN OR RELATION TO THE DECEASED FOR SAFETY AND SUBSEQUENT DISBURSEMENT SINCE NOBODY IS COMING FOR IT AND I DON'T WANT THIS MONEY TO GO INTO THE BANK TREASURY AS UNCLAIMED BILL. THE BANKING LAW AND GUIDINE HERE STIPULATES THAT IF SUCH MONEY REMAINED UNCLAIMED AFTER EIGHT YEARS AND SIX MONTHS, THE MONEY WILL BE TRANSFERRED INTO THE BANK AS UNCLAIMED BILL I THEREFORE AGREE THAT 40% OF THIS MONEY WILL BE FOR YOU AS FOREIGNER PARTNER, IN RESPECT TO THE PROVISION OF A FOREIGN ACCOUNT, 10% WILL BE SET ASIDE FOR EXPENSES INCURRED DURING THE BUSINESS AND 50% WOULD BE FOR ME. THERE AFTER I WILL VISIT YOUR COUNTRY FOR DISBURSEMENT ACCORDING TO THE PERCENTAGES INDICATED. THEREFORE, TO ENABLE THE IMMEDIATE TRANSFER OF THIS FUND TO YOU AS ARRANGED, YOU MUST APPLY FIRST TO THE BANK AS RELATION OR NEXT OF KIN TO THE DECEASED INDICATING YOUR BANK NAME, YOUR BANK ACCOUNT NUMBER, YOUR PRIVATE TELEPHONE AND FAX NUMBER FOR EASY AND EFFECTIVE COMMUNICATION AND LOCATION WHERE IN THE MONEY WILL BE REMITTED. I WILL NOT FAIL TO BRING TO YOUR NOTICE THAT THIS TRANSACTION IS HITCH-FREE AND THAT YOU SHOULD NOT ENTERTAIN ANY ATOM OF FEAR AS ALL REQUIRED ARRANGEMENTS HAVE BEEN MADE FOR THE TRANSFER. YOU SHOULD CONTACT ME IMMEDIATELY AS SOON AS YOU RECEIVE THIS LETTER. TRUSTING TO HEAR FROM YOU IMMEDIATELY. YOURS FAITHFULLY MRS STELLA AKAH ----------------------------------------------------------------- Find the home of your dreams with eircom net property Sign up for email alerts now http://www.eircom.net/propertyalerts From westernunionresponse@westernunion.com Sat Jan 3 18:40:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n042e3WD006188 for ; Sat, 3 Jan 2009 18:40:03 -0800 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********* X-Spam-Status: Yes, score=9.2 required=5.0 tests=BAYES_99,HTML_MESSAGE, HTML_STOOPID_01,MIME_HTML_ONLY,PHISH_05,SARE_FORGED_WESTERN autolearn=disabled version=3.1.8 X-Spam-Report: * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9932] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 HTML_STOOPID_01 RAW: stupid HTML: empty FONT tag * 3.0 SARE_FORGED_WESTERN SARE_FORGED_WESTERN Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.8) for (single-drop); Sat, 03 Jan 2009 18:40:03 -0800 (PST) Received: from smtp.nmnet.dk (smtp.nmnet.dk [83.97.97.24]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n042bHji031930 for ; Sat, 3 Jan 2009 18:37:20 -0800 Received: from westernunion.com (unknown [62.182.170.25]) by smtp.nmnet.dk (Postfix) with ESMTP id 6E0BD70850 for ; Sun, 4 Jan 2009 00:42:31 +0100 (CET) Reply-To: westernunionresponse@westernunion.com From: "westernunionresponse@westernunion.com" To: jhardin@impsec.org Subject: [SPAM] Complete your enrollment/activation Date: 04 Jan 2009 02:59:07 +0100 Message-ID: <20090104025907.65D52BD5995E7180@westernunion.com> MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Greylist: Delayed for 00:32:20 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 03 Jan 2009 18:37:22 -0800 (PST) X-Spam-Prev-Subject: Complete your enrollment/activation Status: R X-Status: X-Keywords: X-UID: 7 Content-Length: 2911

Complete your W= estern Union=AE Prepaid MasterCard=AE and/or Prepaid Visa= =AE Card Activation


If your card number starts with:

    * 4913

    * 5102

    * 5112

    * 5347

    * 5779

please call us at 1-800-509-6112 to activate your card.

 

We are continually improving our Web site to= better serve you. Be sure to check back with us often as we add exciting n= ew services to meet your financial needs.

If you have questions or need assistance, ou= r <= SPAN class=3Dyshortcuts id=3Dlw_1231027153_3 style=3D"BACKGROUND: none tran= sparent scroll repeat 0% 0%; CURSOR: hand; BORDER-BOTTOM: medium none">cust= omer service team is here to help. 

To protect yourself and your account, be sur= e to keep your password confidential. Never share it with anyone, and avoid= logging in to fraudulent Websites by always visiting www.westernunion.com directly.

 

Thank you for using Western Union!

------------------------------------------------------------------------= ------------------------------------------------------
DO NOT REPLY TO = THIS EMAIL. IF YOU HAVE QUESTIONS PLEASE CONTACT US.

 From chiefsenator.davidmarkmark@yahoo.in Mon Jan 5 07:50:48 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.2 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_KR_2,BL_COUNTRY_NG_2,BL_COUNTRY_TW_2,FREEMAIL_FROM, FREEMAIL_REPLYTO,FROM_EXCESS_QP,HTML_MESSAGE,JM_SOUGHT_2,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_73,J_CHICKENPOX_75, MILLIONS_01,THOUS_EMAIL_ADDRS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 0.0 FROM_EXCESS_QP From: quoted-printable encoded unnecessarily * 4.0 JM_SOUGHT_2 Body contains frequently-spammed text patterns * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n3b.bullet.tw1.yahoo.com (n3b.bullet.tw1.yahoo.com [119.160.244.198]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n05Foixk022635 for ; Mon, 5 Jan 2009 07:50:48 -0800 Received: from [119.160.244.77] by n3.bullet.tw1.yahoo.com with NNFMP; 05 Jan 2009 15:23:53 -0000 Received: from [203.212.168.61] by t2.bullet.tw1.yahoo.com with NNFMP; 05 Jan 2009 15:23:53 -0000 Received: from [203.104.18.49] by t2.bullet.kr1.yahoo.com with NNFMP; 05 Jan 2009 15:23:53 -0000 Received: from [127.0.0.1] by omp110.mail.in2.yahoo.com with NNFMP; 05 Jan 2009 15:23:49 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 76400.14856.bm@omp110.mail.in2.yahoo.com Received: (qmail 6507 invoked by uid 60001); 5 Jan 2009 15:23:49 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.in; h=Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=3Ch6KhnrNsK1BkIZ+NvZpOJ1iF1ma52Z1Q6vuSdMaASmALGrnbqmoo6vSvzixin6XfRpxgvv6gqLiyRIxabtHwL5pGB1j91OGTJkvvg4H80twKLWNJKqNBdoIuv2Mx6qQp9HqIks0c96MTNrGCc6p8ycPaz+Vk/FdAvsCD0nZlk= ; Received: from [41.219.221.141] by web95111.mail.in2.yahoo.com via HTTP; Mon, 05 Jan 2009 20:53:48 IST Date: Mon, 5 Jan 2009 20:53:48 +0530 (IST) From: =?utf-8?q?Chief=20Senator=20David=20Mark=20David=20Mark?= Subject: [SPAM] From Chief Senator David Mark David Mark To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-626225155-1231169028=:6169" Content-Transfer-Encoding: 8bit Message-ID: <949680.6169.qm@web95111.mail.in2.yahoo.com> X-Greylist: Delayed for 00:26:49 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 05 Jan 2009 07:50:48 -0800 (PST) X-Spam-Prev-Subject: From Chief Senator David Mark David Mark Status: R X-Status: X-Keywords: X-UID: 8 Content-Length: 3630 --0-626225155-1231169028=:6169 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: chiefsenator.davidmarkmark@yahoo.in - Dear ,I'm happy to inform you about my success in getting the fund transferred to a Swiss Account with the cooperation of a new partner from Paraguay who is an international business man.Presently I'm in Paraguay for investment projects with my own share of the total sum.Meanwhile, I did not forget your past efforts and attempts to assist me in transferring those funds despite that it failed us some how. Now contact my secretary, his contact is:Name: Mr. Josep h Scott, Email: josephscott@jmail.co.za Tel: + 234 8036172590, Ask him to send you the total $450.000.00 (Four Hundred and Fifty Thousand US Dollars) which I kept for your compensation for all the past efforts and attempts to assist me in this matter. I appreciated your efforts at that time very much.So feel free and get in touched with my secretary Mr. Joseph Scott and instruct him where to send the amount to you.Please do let me know immediately you receive it so that we can share the joy after all the sufferness at that time. In the moment, I am very busy here because of the investment projects which I am having at the moment with my new partner .Finally, remember that I have forwarded instruction to my secretary on your behalf to receive the money, so feel free to get in touch with Mr. Joseph Scott and he will send the amount to you without any delay.With best regards,Chief Senator David Mark. --0-626225155-1231169028=:6169 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: chiefsenator.davidmarkmark@yahoo.in



- Dear ,I'm happy to inform you about my success in getting the fund transferred to a Swiss Account with the cooperation of a new partner from Paraguay who is an international business man.Presently I'm in Paraguay for investment projects with my own share of the total sum.Meanwhile, I did not forget your past efforts and attempts to assist me in transferring those funds despite that it failed us some how. Now contact my secretary, his contact is:Name: Mr. Josep h Scott, Email: josephscott@jmail.co.za Tel: + 234 8036172590, Ask him to send you the total $450.000.00 (Four Hundred and Fifty Thousand US Dollars) which I kept for your compensation for all the past efforts and attempts to assist me in this matter. I appreciated your efforts at that time very much.So feel free and get in touched with my secretary Mr. Joseph Scott and instruct him where to send the amount to you.Please do let me know immediately you receive it so that we can share the joy after all the sufferness at that time. In the moment, I am very busy here because of the investment projects which I am having at the moment with my new partner .Finally, remember that I have forwarded instruction to my secretary on your behalf to receive the money, so feel free to get in touch with Mr. Joseph Scott and he will send the amount to you without any delay.With best regards,Chief Senator David Mark.
--0-626225155-1231169028=:6169-- From mccmusaibrahim9@yahoo.co.jp Mon Jan 5 19:24:17 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************** X-Spam-Status: Yes, score=38.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DNS_FROM_RFC_POST, FREEMAIL_FROM,FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, RCVD_IN_BRBL,RCVD_NUMERIC_HELO,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_FRAUD_X6,SPF_SOFTFAIL,STOX_30,SUBJ_ALL_CAPS,UNDISC_RECIPS,URG_BIZ, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=mccmusaibrahim9%40yahoo.co.jp&ip=193.194.74.4&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.5 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [193.194.74.4 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.univ-oran.dz ([193.194.74.4]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n063O2W9008138 for ; Mon, 5 Jan 2009 19:24:06 -0800 Received: by mail.univ-oran.dz (Postfix, from userid 76) id 5B6E040837; Tue, 6 Jan 2009 01:49:57 +0100 (CET) Received: from 41.221.161.192 (41.221.161.192 [41.221.161.192]) by mail.univ-oran.dz (Horde MIME library) with HTTP; Tue, 06 Jan 2009 01:49:54 +0100 Message-ID: <20090106014954.iln84kei8sk0sgcg@mail.univ-oran.dz> Date: Tue, 06 Jan 2009 01:49:54 +0100 From: Barrister Musa Ibrahim Reply-to: musa4ibrahim0@yahoo.co.jp To: undisclosed-recipients:; Subject: [SPAM] THIS IS CONFIDENTIAL MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.1.4) X-Greylist: Delayed for 01:54:00 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 05 Jan 2009 19:24:17 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n063O2W9008138 X-Spam-Prev-Subject: THIS IS CONFIDENTIAL Status: R X-Status: X-Keywords: X-UID: 9 Content-Length: 2590 VERY CONFIDENTIAL AND URGENT Dear Friend, Am sorry for bumping into your privacy, let me start by introducing myself, I am BARRISTER MUSA IBRAHIM (SAN) .I got your e-mail from my private search of reputable people, I am an attorney and I have a client who is interested in investing some good money in your country. My client is a very important and prominent person who has mandated me to contact you for a very important business transaction. My client is by name Mrs. Maryam Abacha and she is the wife of a Late Military head of state in my country. Her husband Late General Sanni Abacha made a lot of money through Oil proceeds during his tenure in office. In fact it was discovered after his death that he was worth well over $4.5 billion in United State Dollars and some of this money were retrieving after he died while some was recovered from officials that served under him during his reign as Military Head of State. The truth of this case is that my client despite the problem she is going through now, she still has a lot of money in her possession, which she intends to invest outside our country. What my client need from you now is reliable account where she can transfer some money but mind you, all the money in her possessions cannot leave at once because she need to build confidence and trust. In someone who would not expose her plan to remit and possibly invest in your company, so she has agreed that I should make arrangements for the transfer of $69.5 million United States dollars and you are free to negotiate your mode of compensation even as she intends to invest the money in your country. Please, do not hesitate to indicate your view of this request by contacting me immediately you receive this e-mail so that the necessary arrangements can be made for the money to leave immediately. You are required to provide the following information below: 1. YOUR FULL NAME: 2. YOUR HOME ADDRESS: 3. YOUR CURRENT HOME TELEPHONE /MOBILE AND OFFICE TELEPHONE. NUMBERS. 4. PROOF OF IDENTIFICATION (A COPY OF YOUR PICTURE, DRIVERS LICENCE OR INTERNATIONAL PASSPORT) 5. AGE: 6. OCCUPATION: Due to the present situation of my client, I would be happy if this request can be kept secret and strictly confidential. I would also like to note that there is no risk involved at all because I would provide all the legal tenders binding it all. Awaiting your urgent reply. Thanks and Best regards, Barrister Musa Ibrahim (SAN) ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. From s1e00s@eircom.net Tue Jan 6 02:58:59 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************************** X-Spam-Status: Yes, score=41.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,FILL_THIS_FORM_01, FROM_HAS_MIXED_NUMS,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_44, J_CHICKENPOX_51,J_CHICKENPOX_52,J_CHICKENPOX_53,J_CHICKENPOX_64, J_CHICKENPOX_72,J_CHICKENPOX_83,MILLIONS_01,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,PHISH_05,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_FRAUD_X6,SARE_SUB_NEED_REPLY,SPAMMY_WEBMAIL,STOX_30,SUBJ_ALL_CAPS, URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 2.2 FROM_HAS_MIXED_NUMS From: contains numbers mixed in with letters * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_51 BODY: 5alpha-pock-1alpha * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from mail27.svc.cra.dublin.eircom.net (mail27.svc.cra.dublin.eircom.net [159.134.118.223]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n06AwtOh019178 for ; Tue, 6 Jan 2009 02:58:58 -0800 Message-Id: <200901061058.n06AwtOh019178@ga.impsec.org> Received: (qmail 39465 messnum 3208846 invoked from network[86.43.60.100/webmail00.webmail.cra.eircom.net]); 6 Jan 2009 10:32:15 -0000 Received: from webmail00.webmail.cra.eircom.net (HELO webmailclassic.eircom.net) (86.43.60.100) by mail27.svc.cra.dublin.eircom.net (qp 39465) with SMTP; 6 Jan 2009 10:32:15 -0000 From: "Louis Momo" Reply-To: To: .@ga.impsec.org Subject: [SPAM] TREAT VERY CONFIDENTIAL & URGENT RESPONSE. Date: Tue, 6 Jan 2009 10:32:39 +0000 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit X-Originating-IP: 66.198.41.11 X-Mailer: Eircom Net CRC Webmail (http://www.eircom.net/) Organization: Eircom Net (http://www.eircom.net/) X-Greylist: Delayed for 00:26:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 06 Jan 2009 02:58:59 -0800 (PST) X-Spam-Prev-Subject: TREAT VERY CONFIDENTIAL & URGENT RESPONSE. Status: R X-Status: X-Keywords: X-UID: 10 Content-Length: 4526 >From The Desk Of Louis Momo. The Head Of File Department, African Development Bank (A.D.B). Ouagadougou Burkina-Faso West Africa. ("REMITTANCE OF $15 MILLION U.S.A DOLLARS CONFIDENTIAL IS THE CASE") Compliments Of The Season, Forgive my indignation if this message comes to you as a surprise and may offend your personality for contacting you without your prior consent and writing through this channel.I got your contact from the proffesional data base found in the internet Yahoo tourist search.When i was searching for a foreign reliable partner.I assured of your capability and reliability to champion this business opportunity. After series of prayers/fasting.i was divinely directed to contact you among other names found in the data base Yahoo tourist search.I believe that God has a way of helping who is in need. I am (Louis Momo.).the Head of file Department in African development bank (ADB). In my department we discovered an abandoned sum of $15 million U.S.A dollars ( fifteen million U.S.A dollars).In an account that belongs to one of our foreign customer who died along with his entire family on (Monday 31st July 2000) in a plane crash.Since we got information about his death,we have been expecting his next of kin to come over and claim his money because we cannot release it unless somebody applies for it as next of kin or relation to the deceased as indicated in our banking guidelines,but unfortunately we learnt that all his supposed next of kin or relation died along side with him at the plane crash leaving nobody behind for the claim.It is therefore upon this discovery that I now decided to make this business proposal to you and release the money to you as the next of kin or relation to the deceased for safety and subsequent disbursement since nobody is coming for it and i dont want this money to go into the bank treasury as unclaimed bill. The Banking law and guideline here stipulates that if such money remained unclaimed after eight years,the money will be transferred into the Bank treasury as unclaimed fund.The request of foreigner as next of kin in this business is occasioned by the fact that the customer was a foreigner, and a Burkinabe cannot stand as next of kin to a foreigner. I agree that 40% of this money will be for you as foreign partner,in respect to the provision of a foreign account and 60% would be for me.That means ($6 million) six million dollars for you and ($9 million) nine million dollars for me.There after i will visit your country for disbursement according to the percentages indicated. Therefore to enable the immediate transfer of this fund to you as arranged,you must apply first to the bank as relations or next of kin of the deceased indicating your bank name,your bank account number,your private telephone and fax number for easy and effective communication and location where the money will be remitted.Upon receipt of your reply,I will send to you by fax or email the text of the application I will not fail to bring to your notice that this transaction is hitch free and that you should not entertain any atom of fear as all required arrangements have been made for the transfer. I am awaiting for your immediate response as you receive this mail.Extend my sincere greetings to your entire family.God bless you and your entire family and bye for now. Yours faithfully, Louis Momo. FROM (ADB) OUAGADOUGOU BURKINA-FASO. GOD BLESSINGS,PROTECTIONS AND GUIDANCE TO YOUR ENTIRE FAMILY. (FILL THIS FORM BELLOW PLEASE AND RESEND IT TO ME). 1) Your Full Name...................................... 2) Your Age............................................... 3) Marital Status......................................... 4) Your Cell Phone Number....................... 5) Your Fax Number................................. 6) Your Country......................................... 7) Your Occupation.................................... 8) Sex........................................................ 9) Your Religion........................................ 10) Your Private E-mail Address.................. POST SCRITUM: You have to keep everything secret as to enable the transfer to move very smoothly in to the account you will prove to the bank. ----------------------------------------------------------------- Find the home of your dreams with eircom net property Sign up for email alerts now http://www.eircom.net/propertyalerts From adamsstmichael@contractaward.int.tf Tue Jan 6 09:49:22 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=23.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,PHISH_05,RBL_POXLAY_01,RCVD_IN_BRBL, SARE_PROLOSTOCK_SYM3,TO_CC_NONE,X_PRIORITY_HIGH autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 0.2 PHISH_05 BODY: Phishing for account information * 1.6 SARE_PROLOSTOCK_SYM3 BODY: Last week's hot stock scam * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [69.90.47.153 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [69.90.47.153 listed in dnsbl.sorbs.net] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from ns48.servepower.com (ns48.servepower.com [69.90.47.153]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n06HnEtG029894 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Tue, 6 Jan 2009 09:49:21 -0800 Message-Id: <200901061749.n06HnEtG029894@ga.impsec.org> Received: (qmail 25990 invoked from network); 6 Jan 2009 02:46:30 -0800 Received: from unknown (HELO User) (195.166.239.226) by 64.34.102.240 with SMTP; 6 Jan 2009 02:46:30 -0800 Reply-To: From: "Contract Award Commitee" Subject: [SPAM] Re: transfer for investment in your country Date: Tue, 6 Jan 2009 12:24:26 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 03:44:00 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 06 Jan 2009 09:49:21 -0800 (PST) X-Spam-Prev-Subject: Re: transfer for investment in your country Status: R X-Status: X-Keywords: X-UID: 11 Hello my friend, I am Mr. Adams St.Michael, chairman contract dept NNPC-Nigeria. We Have an over invoiced USD28.6M to be transfered to your account.Shares, 30% for you and 70% for us If you are interested kindly get back to us via e-mail. Thanks, Yours Sincerly, Adams St.Michael Tel:234 706 121 6502 From debt@abbeycomputersonline.com Wed Jan 7 11:14:24 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.4 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_NG_2,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_2, J_CHICKENPOX_73,MILLIONS_01,MSGID_FROM_MTA_HEADER,SUBJ_ALL_CAPS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mo-p07-ob.rzone.de (mo-p07-ob.rzone.de [81.169.146.189]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n07JEJbM004604 for ; Wed, 7 Jan 2009 11:14:22 -0800 X-RZG-CLASS-ID: mo00 X-RZG-AUTH: :KGkGYWCpef16udy+PkuVvD1JVKcE6I40rftT6b3rBBFRk3DxeZdVtCz7/gP5+utRRnE+AVYC To: undisclosed-recipients:; Message-ID: Received: from User ([82.128.44.70]) by post.strato.de (mrclete mo20) (RZmta 18.7) with ESMTP id z0154cl07HwPsh ; Wed, 7 Jan 2009 19:29:14 +0100 (MET) Reply-To: From: "MRS SARAH THOMAS" Subject: [SPAM] 2008 SCAM VICTIMS COMPENSATIONS PAYMENTS Date: Wed, 7 Jan 2009 19:30:23 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-7" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:20:04 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 07 Jan 2009 11:14:23 -0800 (PST) X-Spam-Prev-Subject: 2008 SCAM VICTIMS COMPENSATIONS PAYMENTS Status: R X-Status: X-Keywords: X-UID: 12 Content-Length: 1049 SIR/MADAM, This is to bring to your notice that we are delegated from the UNITED NATIONS in Central Bank to pay 50 victims of scam $500,000 USD (five Hundred Thousand Dollars) each.. You are listed and approved for this payment as one of the scammed victims to be paid this amount, get back to this office as soon as possible for the immediate payment of your $500,000 USD compensation funds. My dear friend I will like you to contact the finance house for the collection of this international certificated bank draft. The name and contact address of The Person with your Cheque is Mr. Wesley Greenfield. Send a copy of your response to official email: SECURITY & FINACIAL CONTACT AGENT: Mr. Wesley Greenfield EMAIL: georgeellissrrr@googlemail.com CELL PHONE: +234-801-334-8760 You are advised to send your communication particulars, full names, telephone/fax numbers,mailing address,age and occupation to enable us have your cheque sent to your designated address. Yours Faithfully, Mrs.Sarah Thomas Secretary United Nations West Africa From zgakame@yahoo.co.in Wed Jan 7 18:19:22 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************ X-Spam-Status: Yes, score=12.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_50,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO, HTML_COMMENTS,HTML_MESSAGE,J_CHICKENPOX_57,J_CHICKENPOX_72,RBL_PSBL_01, SARE_UN7,SUB_HELLO autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 0.5 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5923] * 0.9 SARE_UN7 RAW: SARE_UN7 * 0.2 HTML_COMMENTS RAW: Has HTML comments * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [202.86.4.194 listed in psbl.surriel.com] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from n10-vm0.bullet.mail.in.yahoo.com (n10-vm0.bullet.mail.in.yahoo.com [202.86.4.194]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n082JHA6015363 for ; Wed, 7 Jan 2009 18:19:21 -0800 Received: from [202.86.4.170] by n10.bullet.mail.in.yahoo.com with NNFMP; 08 Jan 2009 01:51:57 -0000 Received: from [203.104.17.88] by t1.bullet.in.yahoo.com with NNFMP; 08 Jan 2009 01:51:57 -0000 Received: from [127.0.0.1] by omp102.mail.in2.yahoo.com with NNFMP; 08 Jan 2009 01:51:57 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 95018.24809.bm@omp102.mail.in2.yahoo.com Received: (qmail 17400 invoked by uid 60001); 8 Jan 2009 01:51:56 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.in; h=Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Message-ID; b=0sUqnn2vtbeKcU8wigRnJWSRD3Xu8k6aS+4eSLfyqSLahDrKPlqWLqSph6kg/r8YJAOa/S59lDoGB1ZoX6oHyTvWWIv0ZFL+HPAwtYgBR/cw4H0UcrqYLyGsufWNO8INmojNcThhiUX8v4/SOrrN6OWu/tMln71Mh3Sj8QWgGy0=; Received: from [41.208.164.12] by web95001.mail.in2.yahoo.com via HTTP; Thu, 08 Jan 2009 07:21:56 IST X-Mailer: YahooMailWebService/0.7.260.1 Date: Thu, 8 Jan 2009 07:21:56 +0530 (IST) From: Gakame Zaida Reply-To: zaidakagame@ubbi.com Subject: [SPAM] Hello Dear, To: zgakame@yahoo.co.in MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1286366439-1231379516=:14589" Message-ID: <905914.14589.qm@web95001.mail.in2.yahoo.com> X-Greylist: Delayed for 00:27:18 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 07 Jan 2009 18:19:22 -0800 (PST) X-Spam-Prev-Subject: Hello Dear, Status: R X-Status: X-Keywords: X-UID: 13 Content-Length: 2984 --0-1286366439-1231379516=:14589 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello Dear, I know that this letter might be a suprise to you but do consider it as an = emergency. I am Miss Zaida Kagame, from Harare,Zimbabwe, 26years old and I = presently reside here in Dakar,senegal with my only brother Kennedy due to = the political unrest in our country.I do not know to what extent you are fa= miliar with events and fragile political situation in my country Zimbabwe ,= but it has formed consistent headlines in the CNN, BBC news bulletins.I wi= ll be very glad if you can accept to lead us to the right channel by means = of your assistance to transfer and investment of our fund in a safer politi= cal economy,we are here in Dakar senegal because of the fund $3.5 million o= ur late father deposited in the finance house which we want to transfer out= from here to your country for investment.Please i will like you to contact= me through my private e-mail box for further clarification.Please we are e= rnestly anticipating your kind assistance. I do hope to hear back from you soon. Thanks and God bless. Miss.Kagame and brother Kennedy =C2=A0 =C2=A0=0A=0A=0A Get your own website and domain for just Rs.1,999/year= ..* Go to http://in.business.yahoo.com/ --0-1286366439-1231379516=:14589 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Hello Dear,
I know that this letter might be a suprise to you but d= o consider it as an emergency. I am Miss Zaida Kagame, from Harare,Zimbabwe= , 26years old and I presently reside here in Dakar,senegal with my only bro= ther Kennedy due to the political unrest in our country.I do not know to wh= at extent you are familiar with events and fragile political situation in m= y country Zimbabwe , but it has formed consistent headlines in the CNN, BBC= news bulletins.I will be very glad if you can accept to lead us to the rig= ht channel by means of your assistance to transfer and investment of our fu= nd in a safer political economy,we are here in Dakar senegal because of the= fund $3.5 million our late father deposited in the finance house which we = want to transfer out from here to your country for investment.Please i will= like you to contact me through my private e-mail box for further clarifica= tion.Please we are ernestly anticipating your kind assistance. I do hope to hear back from you soon.
Thanks and God bless.
Miss.Kagame a= nd brother Kennedy
 
 

=0A
= Get an email ID as yourname@ymail.com or yourname@rocketmail.com. Click here. --0-1286366439-1231379516=:14589-- From franklonard@live.com Thu Jan 8 01:08:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.1 required=5.0 tests=BAYES_99,BL_COUNTRY_BR_1, BL_COUNTRY_NG_2,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,FWD_RE_EMPTY,JM_SOUGHT_FRAUD_2, L_SOME_STD_PROBS,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,RAZOR2_CHECK, RCVD_IN_BRBL,SPF_SOFTFAIL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.0 FWD_RE_EMPTY Subject just Fwd: or Re: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=franklonard%40live.com&ip=200.157.205.9&receiver=ga.impsec.org] * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.1 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [200.157.205.9 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from fonseca.nitnet.com.br (200-157-205-9.nitnet.com.br [200.157.205.9]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n08982GV025749 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Thu, 8 Jan 2009 01:08:08 -0800 Message-Id: <200901080908.n08982GV025749@ga.impsec.org> Received: from [82.128.26.113] (helo=User) by fonseca.nitnet.com.br with esmtpa (Exim 4.63) (envelope-from ) id 1LKVsx-0004hk-6B; Wed, 07 Jan 2009 08:43:41 -0200 Reply-To: From: "Frank Lonard" Subject: [SPAM] Re: Date: Wed, 7 Jan 2009 02:44:35 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 081223-0, 12/23/2008), Outbound message X-Antivirus-Status: Clean X-Greylist: Delayed for 22:22:56 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 08 Jan 2009 01:08:08 -0800 (PST) X-Spam-Prev-Subject: Re: Status: R X-Status: X-Keywords: X-UID: 14 This message will be the last notification that I will send to you as my earlier letters to you through Post Office was returned undelivered. Hence I decided to reach you via email because this information needs urgent attention. I'm contacting you because you bear the same surname with our deceased client who died in 2003, and the management of my bank have issued me a notice to provide an extended next of kin of the deceased or have the account confiscated within the next 14 banking days. I am the Telex Department manager of my bank and also the personal account officer to the deceased, and I will be disappointed if the labour of my deceased client is confiscated. So kindly get back to me with your full name and adress for appraisal. Frank Lonard. Private e-mail: franklonard@hotmail.com From bamayousuf05@yahoo.com Thu Jan 8 03:24:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE,JM_SOUGHT_1,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_47,J_CHICKENPOX_61,J_CHICKENPOX_73, J_CHICKENPOX_83,PHISH_05,SARE_SUB_NEED_REPLY,SUBJ_ALL_CAPS,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 4.0 JM_SOUGHT_1 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from web111114.mail.gq1.yahoo.com (web111114.mail.gq1.yahoo.com [67.195.15.207]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n08BOCwf029521 for ; Thu, 8 Jan 2009 03:24:16 -0800 Received: (qmail 19825 invoked by uid 60001); 8 Jan 2009 10:57:32 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.com; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=Tdn4yphHIo8+bVkqXjldwEP0sitOu+1xv5WzL+0FGRu/vuVGNxCJ+iiddopSJGVtiTwxxfvKNmA77CRd8XYNhdFiVFwwzSq96J9RSwDEuKVotfmiox1OCPLUJawpT8rE+aU3cUfskEpMrU+R5cO9hIEek4OvgdsvzNrxPXSP/Oc=; Received: from [41.203.225.194] by web111114.mail.gq1.yahoo.com via HTTP; Thu, 08 Jan 2009 02:57:31 PST Date: Thu, 8 Jan 2009 02:57:31 -0800 (PST) From: bama yousuf Reply-To: bama_yousuf45@yahoo.com Subject: [SPAM] TREAT AS URGENT/REPLY IMMEDIATELY To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1188162722-1231412251=:18503" Content-Transfer-Encoding: 8bit Message-ID: <984732.18503.qm@web111114.mail.gq1.yahoo.com> X-Greylist: Delayed for 00:26:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 08 Jan 2009 03:24:16 -0800 (PST) X-Spam-Prev-Subject: TREAT AS URGENT/REPLY IMMEDIATELY Status: R X-Status: X-Keywords: X-UID: 15 Content-Length: 3710 --0-1188162722-1231412251=:18503 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: bamayousuf05@yahoo.com - Dear Friend,I know that this mail will come to you as a surprise. I am the bill and Exchange manager in African Development Bank .I Hope that you will not expose or betray this trust and confident that i am about to Repose on you for the mutual benefit of our both families.I need your urgent assistance in transferring the sum of $15 million Immediately to your account. The money has been dormant for years in our Bank here without any body coming for it.I want to release the money to yu as the nearest person to our deceased customer(the owner Of the account) who died a long with his supposed next of kin in an air Crash since July 2000.I don't want the money to go into our Bank treasury as an abandoned fund. So this is the reason why i contacted you, so that the bank can release the money to you as the nearest person to the deceased customer.Please i will like you to keep this proposal as a top secret and delete if you are not interested.Upon receipt of your reply, I will send you full details on how the business will be executed and also note that you will have 40% of the Above mentioned sum. Acknowledge receipt of this message in acceptance of my mutual business endeavour by furnishing me with the following:1. Your Full Names and Address.2. Direct telephone and Fax numbers Dr. Bama Yousuf Bill and Exchange Manager African Development Bank,Burkina Faso West Africa. Email bama_yousuf45@yahoo.com --0-1188162722-1231412251=:18503 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: bamayousuf05@yahoo.com



- Dear Friend,I know that this mail will come to you as a surprise. I am the bill and Exchange manager in African Development Bank .I Hope that you will not expose or betray this trust and confident that i am about to Repose on you for the mutual benefit of our both families.I need your urgent assistance in transferring the sum of $15 million Immediately to your account. The money has been dormant for years in our Bank here without any body coming for it.I want to release the money to yu as the nearest person to our deceased customer(the owner Of the account) who died a long with his supposed next of kin in an air Crash since July 2000.I don't want the money to go into our Bank treasury as an abandoned fund. So this is the reason why i contacted you, so that the bank can release the money to you as the nearest person to the deceased customer.Please i will like you to keep this proposal as a top secret and delete if you are not interested.Upon receipt of your reply, I will send you full details on how the business will be executed and also note that you will have 40% of the Above mentioned sum. Acknowledge receipt of this message in acceptance of my mutual business endeavour by furnishing me with the following:1. Your Full Names and Address.2. Direct telephone and Fax numbers Dr. Bama Yousuf Bill and Exchange Manager African Development Bank,Burkina Faso West Africa. Email bama_yousuf45@yahoo.com
--0-1188162722-1231412251=:18503-- From contact.info29@earthlink.net Fri Jan 9 10:36:04 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_SOMETHING,MILLIONS_01,NA_DOLLARS, PHISH_01,PHISH_08,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6, SPAMMY_WEBMAIL,THOUS_EMAIL_ADDRS,TO_CC_NONE,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 1.0 PHISH_08 BODY: Phishing * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 PHISH_01 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9998] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from elasmtp-dupuy.atl.sa.earthlink.net (elasmtp-dupuy.atl.sa.earthlink.net [209.86.89.62]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n09Ia180015254 for ; Fri, 9 Jan 2009 10:36:04 -0800 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=iZ5ZFee6VYYmkC2TYqsciAf6S+PA+R1HHrUfvlrOrEC8+S7AO1x+zvcrG51w7qXj; h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-ELNK-Trace:X-Originating-IP; Received: from [209.86.224.33] (helo=elwamui-darkeyed.atl.sa.earthlink.net) by elasmtp-dupuy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from ) id 1LLLlF-0007Q4-Pg; Fri, 09 Jan 2009 13:07:10 -0500 Received: from 41.30.144.163 by webmail.earthlink.net with HTTP; Fri, 9 Jan 2009 13:07:08 -0500 Message-ID: <16276659.1231524428981.JavaMail.root@elwamui-darkeyed.atl.sa.earthlink.net> Date: Fri, 9 Jan 2009 10:07:08 -0800 (GMT-08:00) From: "From: Mrs. Juliet Mukhenza." Reply-To: "From: Mrs. Juliet Mukhenza." Subject: [SPAM] From: Mrs. Juliet Mukhenza, (Greetings! (Urgent & Confidential). Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Mailer: EarthLink Zoo Mail 1.0 X-ELNK-Trace: 4318cb367737cd433dce40bbf4cd10d594f5150ab1c16ac060844222a69b33f401627f1b65b19aa2535d64cb7a6d164c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 209.86.224.33 X-Greylist: Delayed for 00:28:24 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 09 Jan 2009 10:36:04 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n09Ia180015254 X-Spam-Prev-Subject: From: Mrs. Juliet Mukhenza, (Greetings! (Urgent & Confidential). Status: R X-Status: X-Keywords: X-UID: 16 Content-Length: 2689 Greetings! (Urgent & Confidential) Attention: Dear Sir/Madam, You may be surprised to receive this strange letter from me. I am Mrs. Juliet Mukhenza, the wife of Mr. John Mukhenza of Zimbabwe. I got your address from an internet web site. After due consideration from your profile, I became aware and assured of your credibility to help me. My husband was among the rich white farmers in Zimbabwe who were murdered in cold blood by the agent of the ruling government of president Robert Mugabe because my husband was against the method adopted by the government on new land reform act that wholly affected the white farmers in Zimbabwe. Before the Invasion, my husband took me to South Africa as if he foresaw the looming danger in Zimbabwe and deposited US$15,400,000.00 (Fifteen Million, Four hundred thousand US dollars) with a security and finance company in South Africa as a Family Valuables. Please verify the information I have given you on this web site http://www.newzimbabwe.com/ This money was for buying farm lands in Lesotho, Swaziland, and also machinery for the farm. Heads of government from western world, especially Britain and The U.S.A, have voiced their condemnation against Mugabe's new land reform act. It is against this background that my only son Frank Numa Mukhenze has mandated me to seek foreign assistance as my late Husband indicated that the consignment is for onward shipment to his foreign partner for keeping purposes and investment. Presently, I am residing in South Africa as an asylum seeker as from the deposit certificate it is clearly indicated that the consignment is meant for onward shipment to my late husband’s foreign partner which I want to present you to the security company. Kindly send me the below information. *Your full names and address. *Your country of origin and date of birth. *Your occupation *Your private & fax phone numbers. Please note that this transaction is 100% risk free, and for your effort, I am prepared to offer you 35% of the total sum when the consignment has been shipped or the fund transferred by bank to bank transfer to you in your country. If this proposal is accepted by you, please reply urgently and get in touch with my only son Mr. Frank Numa Mukhenza by phone: +27-78-477-8057 and email: frank_n_mukhenza@hotmail.com so that he will then furnish you with more details. I will appreciate if you maintain the confidentiality of this matter because of the happenings in my country - Zimbabwe. Please consider this offer and our present condition as asylum seekers here and reply to my son urgently. Thank you. Yours sincerely, Mrs. Juliet Mukhenza. From mhafiz@turkishbank.com Sat Jan 10 15:37:45 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_60,BL_COUNTRY_TR_1,DATE_IN_FUTURE_06_12, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_42,J_CHICKENPOX_66,J_CHICKENPOX_73,L_SOME_STD_PROBS,MILLIONS_01, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FRAUD_X4,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TR_1 Mail client in Turkey * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.7 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.6 J_CHICKENPOX_66 BODY: 6alpha-pock-6alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7092] * 0.1 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [84.19.163.36 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from server11127.isdg.de (web4.uni.de [84.19.163.36]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0ANbffD029338 for ; Sat, 10 Jan 2009 15:37:45 -0800 Message-Id: <200901102337.n0ANbffD029338@ga.impsec.org> Received: from [78.135.15.152] (helo=User) by server11127.isdg.de with esmtpa (Exim 4.63) (envelope-from ) id 1LLmoA-0006cj-U7; Sat, 10 Jan 2009 23:59:59 +0100 Reply-To: From: "Mufti Hafiz" Subject: [SPAM] May I Seek Your Indulgence Date: Sun, 11 Jan 2009 00:59:28 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:37:02 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 10 Jan 2009 15:37:45 -0800 (PST) X-Spam-Prev-Subject: May I Seek Your Indulgence Status: R X-Status: X-Keywords: X-UID: 17 Content-Length: 2543 Complement of the day, Although you might be apprehensive about my email as we have not met before My name is Mufti Hafiz, Foreign operations manager of Turkish Bank Limited Turkey. I am contacting you with respect to a portfolio amounting to $6,000,000.00 USD (Six Million Dollars) in my bank branch deposited by a Reverend Father(Andrea Santaro) who died here in turkey in 2006. He was shot,in 2006 by a muslim extremist in his church for reasons unknown to anybody.During his stay here,he had a total of $6Million in his account.Unfortunately he never had any Visitor during his stay and never mentioned any next of Kin in his documents this fund has since matured and the roll-over On the funds has also expired. What bothers me most is that according to the laws of my country At the expiration of 2 years the funds will revert to the ownership Of the Turkish Government if nobody applies to claim the funds. Since I am directly in charge of the account I will like to seek For your permission as a foreigner to stand as the next of kin to Andrea Santaro. I have everything planned out so that we shall come out successful. I will prepare the necessary document that will back you up as the Next of kin to Andrea Santaro,all which is required from you at this Stage is for you to inform me of your interest in this transaction. You may not know this but people like myself who have made tidy sums Out of comparable situations run the whole private banking sector. I am not a criminal and what I do, I do not find against good Conscience, this may be hard for you to understand, but the dynamics Of my industry dictates that I make this move. Such opportunities only Come ones' way once in a lifetime. I have evaluated the risks and the only risk I have here is from You refusing to work with me and alerting my bank. I am the only One who knows of this situation. I do not want you contacting me through my official phone lines Nor do I want you contacting me through my official email account. Contact me only through my private email address (muftihafiz@yahoo.com.tr) I do not want any direct link between you and me. My official Phone lines are not secure lines as they are periodically Monitored to assess our level of customer care in line with our Total Quality Management Policy.I will give you my Private Phone line as time goes on. Please if you are interested contact me only through my private email muftihafiz@yahoo.com.tr Your earliest response to this letter will be appreciated. Kind Regards, Mufti Hafiz From edinawoodland@microsoftpromotion.eu.tc Sat Jan 10 17:32:44 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.6 required=5.0 tests=BAYES_99,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,HTML_MESSAGE, HTML_TITLE_EMPTY,LOTTO_DEPARTMENT,LOTTO_WIN_01,LOTTO_YOU_WON_02, MIME_HTML_ONLY,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,NO_REAL_NAME,PHISH_08, THOUS_EMAIL_ADDRS,TO_CC_NONE,UNCLAIMED_MONEY autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 PHISH_08 BODY: Phishing * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.2 LOTTO_DEPARTMENT BODY: Claims Department * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 2.4 UNCLAIMED_MONEY BODY: People just leave money laying around * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.ssnow.com (mail.ssnow.com [199.44.81.90]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0B1Wb0F032361 for ; Sat, 10 Jan 2009 17:32:44 -0800 Message-Id: <200901110132.n0B1Wb0F032361@ga.impsec.org> Received: from User ([92.40.251.80]) (envelope-sender ) by 199.44.81.90 with ESMTP for ; Sat, 10 Jan 2009 10:13:00 -0500 Reply-To: From: "microsoft" Subject: [SPAM] microsoft Date: Sat, 10 Jan 2009 15:10:37 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 10:18:05 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 10 Jan 2009 17:32:44 -0800 (PST) X-Spam-Prev-Subject: microsoft Status: R X-Status: X-Keywords: X-UID: 18 Content-Length: 3406
Microsoft Promotion Award Team
40 Ryecroft Way Stopsley
London,
United Kingdom.
 
Your e-mail address winning details:
Reference Number: LSLUK/8034/8191
 
Batch Number: 11/821/2PDH /DZRS/UK/50
 
 
Dear Beneficiary,
We are happy to inform you that your email address has emerged a winner in
the Second Category of our promotional programme for a consortium of
software manufacturing companies i.e. The Intel Group, Toshiba, Dell
Computers and Microsoft C orporation to encourage the use of the internet and
promote computer literacy worldwide. The 50 winning email addresses were
selected from a total of 450,000,000 e-mail addresses by our computerized
system on Monday 1st of September 2008, drawn from company and individual e-
mail addresses worldwide, no tickets were sold. You have therefore been
awarded a lump sum pay out of 450,000 GBP ( Four Hundred and Fifty Thousand
GBP Only ), which is the winning payout for each Category B winner.
 
 
For easy reference and identification, remember to quote your reference and
batch numbers as above in all your correspondences with our Claims
Department. E-mail addresses registered with false names are not eligible to
claiming this prize.
 
 
Payment Authority of your claim and the immediate remittance of your winning
funds will be effected immediately after due verification of your identity.
 
 
For verifications, contact your category claim office with the following
details to avoid unnecessary delay and complications:
 
 
Verification/Claim Form:
(1) Your Full Names:
(2) Your contact address:
(3) Your Telephone numbers:
(4) Your Nationality/Country:
(5) Occupation:
(6) Sex:
(7)Age:
(8)How do you fill being a winner:
 
 
 
Contact Person: Gerald Walter
E-mail: awardverification@microsoftpromotion.eu.tc
All winnings must be claimed not later than 29th of march, 2009. After
this date, all unclaimed funds will be transferred to our International Debt
Payment Reconcilia tion Unit.
 
 
Congratulations!
Sincerely yours,
Salvatore Murgiana
Promotions Coordinator
Netherlands Staatsloterij:
Dayzers Nederland:
Paleisstraat 5, 2514 JA - Den Haag;
The Netherlands:
www.dayzers.nl
 
DISCLAIMER: This email was sent from a notification only email address. The
information contained in this e-mail message and any files transmitted with
it are confidential and intended only for the use of the individual or
entity identified. If the reader of this message is not the intended
recipient, any dissemination, distribu tion or copying of the information
contained in this e-mail message is strictly prohibited
 From info@honda.com Sat Jan 10 19:39:24 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************ X-Spam-Status: Yes, score=12.3 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, DNS_FROM_RFC_ABUSE,LOTTO_AGENT,LOTTO_YOU_WON_02,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_SBL,THOUS_EMAIL_ADDRS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.220.75.3 listed in zen.spamhaus.org] Received: from outbound-mail-24.bluehost.com (outbound-mail-24.bluehost.com [69.89.21.19]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0B3dKdq003066 for ; Sat, 10 Jan 2009 19:39:24 -0800 Received: (qmail 14525 invoked by uid 0); 11 Jan 2009 03:12:43 -0000 Received: from unknown (HELO box137.bluehost.com) (69.89.22.137) by outboundproxy2.bluehost.com with SMTP; 11 Jan 2009 03:12:43 -0000 Received: from localhost ([127.0.0.1]) by box137.bluehost.com with esmtpa (Exim 4.69) (envelope-from ) id 1LLqkd-0001P8-Oz; Sat, 10 Jan 2009 20:12:36 -0700 Received: from 41.220.75.3 ([41.220.75.3]) by mail.floridawaterfront.net (Horde MIME library) with HTTP; Sat, 10 Jan 2009 20:12:29 -0700 Message-ID: <20090110201229.1cnfkd85jk8ws4oc@mail.floridawaterfront.net> Date: Sat, 10 Jan 2009 20:12:29 -0700 From: 2009 HONDA PROMOTION Reply-to: honda-uk02@live.com To: undisclosed-recipients:; Subject: [SPAM] Contact: Mr. Richard Olsen? MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.1.6) X-Identified-User: {1036:box137.bluehost.com:cpanelhorde:box137.bluehost.com} {sentby:program running on server} X-Greylist: Delayed for 00:26:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 10 Jan 2009 19:39:24 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n0B3dKdq003066 X-Spam-Prev-Subject: Contact: Mr. Richard Olsen? Status: R X-Status: X-Keywords: X-UID: 19 Sir/Madam, We are pleased to inform you of the release, of the long awaited results of the HONDA CAR INTERNATIONAL PROMOTION PROGRAM, your email address has luckly won you the star-prize of 1,750,000.00 GBP .contact the claims agent. Mr. Richard Olsen Email Address: honda-uk02@live.com Tel: +44 703 596 5568 You are also advised to provide him with the under listed information as soon as possible: 1.Name in full 2.Address 3.Nationality 4.Age 5.Occupation 6.Phone/Fax 7.Present Country 8.Male/female Yours Sincerely, C.H.G.M. BLOM (Program Co-ordinator.) From bamayousuf13@yahoo.com Sun Jan 11 06:32:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_47,J_CHICKENPOX_61,J_CHICKENPOX_73, J_CHICKENPOX_83,PHISH_05,SARE_SUB_NEED_REPLY,SUBJ_ALL_CAPS,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n76a.bullet.mail.sp1.yahoo.com (n76a.bullet.mail.sp1.yahoo.com [98.136.45.23]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0BEW4D9020808 for ; Sun, 11 Jan 2009 06:32:07 -0800 Received: from [69.147.84.144] by n76.bullet.mail.sp1.yahoo.com with NNFMP; 11 Jan 2009 14:05:33 -0000 Received: from [68.142.230.28] by t6.bullet.mail.sp1.yahoo.com with NNFMP; 11 Jan 2009 14:05:33 -0000 Received: from [67.195.9.83] by t1.bullet.re2.yahoo.com with NNFMP; 11 Jan 2009 14:05:33 -0000 Received: from [67.195.9.105] by t3.bullet.mail.gq1.yahoo.com with NNFMP; 11 Jan 2009 14:05:32 -0000 Received: from [127.0.0.1] by omp109.mail.gq1.yahoo.com with NNFMP; 11 Jan 2009 14:05:32 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 975107.31116.bm@omp109.mail.gq1.yahoo.com Received: (qmail 35300 invoked by uid 60001); 11 Jan 2009 14:05:32 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.com; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=l5u7msT2LCmWsX+oQ2oV7b/0gn9Gzc8+vLufRwQhlZ8H2CJUtBmW3nM9MnuR8tQ9b6zsw6at8OkULRyYqcSQp3y1AmHbi1/8JSkCE8E2kwAE9q9kXFEBLzfny8qZL0jpa2GygYjFLatvO/HMBgvLIDiYAn4T5/lHTpmmS+1b/z4=; Received: from [41.203.228.140] by web111016.mail.gq1.yahoo.com via HTTP; Sun, 11 Jan 2009 06:05:32 PST Date: Sun, 11 Jan 2009 06:05:32 -0800 (PST) From: Bama Yousuf Reply-To: bama_yousuf12@live.com Subject: [SPAM] TREAT AS URGENT/REPLY IMMEDIATELY To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1378496099-1231682732=:33735" Content-Transfer-Encoding: 8bit Message-ID: <805379.33735.qm@web111016.mail.gq1.yahoo.com> X-Greylist: Delayed for 00:26:27 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 11 Jan 2009 06:32:07 -0800 (PST) X-Spam-Prev-Subject: TREAT AS URGENT/REPLY IMMEDIATELY Status: R X-Status: X-Keywords: X-UID: 20 Content-Length: 3712 --0-1378496099-1231682732=:33735 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: bamayousuf13@yahoo.com - Dear Friend,I know that this mail will come to you as a surprise. I am the bill and Exchange manager in African Development Bank .I Hope that you will not expose or betray this trust and confident that i am about to Repose on you for the mutual benefit of our both families.I need your urgent assistance in transferring the sum of $15.6 million Immediately to your account. The money has been dormant for years in our Bank here without any body coming for it.I want to release the money to yu as the nearest person to our deceased customer(the owner Of the account) who died a long with his supposed next of kin in an air Crash since July 2000.I don't want the money to go into our Bank treasury as an abandoned fund. So this is the reason why i contacted you, so that the bank can release the money to you as the nearest person to the deceased customer.Please i will like you to keep this proposal as a top secret and delete if you are not interested.Upon receipt of your reply, I will send you full details on how the business will be executed and also note that you will have 40% of the Above mentioned sum. Acknowledge receipt of this message in acceptance of my mutual business endeavour by furnishing me with the following:1. Your Full Names and Address.2. Direct telephone and Fax numbers Dr. Bama Yousuf Bill and Exchange Manager African Development Bank,Burkina Faso West Africa. Email bama_yousuf12@live.com --0-1378496099-1231682732=:33735 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: bamayousuf13@yahoo.com



- Dear Friend,I know that this mail will come to you as a surprise. I am the bill and Exchange manager in African Development Bank .I Hope that you will not expose or betray this trust and confident that i am about to Repose on you for the mutual benefit of our both families.I need your urgent assistance in transferring the sum of $15.6 million Immediately to your account. The money has been dormant for years in our Bank here without any body coming for it.I want to release the money to yu as the nearest person to our deceased customer(the owner Of the account) who died a long with his supposed next of kin in an air Crash since July 2000.I don't want the money to go into our Bank treasury as an abandoned fund. So this is the reason why i contacted you, so that the bank can release the money to you as the nearest person to the deceased customer.Please i will like you to keep this proposal as a top secret and delete if you are not interested.Upon receipt of your reply, I will send you full details on how the business will be executed and also note that you will have 40% of the Above mentioned sum. Acknowledge receipt of this message in acceptance of my mutual business endeavour by furnishing me with the following:1. Your Full Names and Address.2. Direct telephone and Fax numbers Dr. Bama Yousuf Bill and Exchange Manager African Development Bank,Burkina Faso West Africa. Email bama_yousuf12@live.com
--0-1378496099-1231682732=:33735-- From rich1orgaranya@gmail.com Sun Jan 11 19:01:36 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_80,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO,FREEMAIL_FROM,L_SOME_STD_PROBS,MILLIONS_01,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SPF_NEUTRAL,STOX_30,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=rich1orgaranya%40gmail.com&ip=200.87.100.237&receiver=ga.impsec.org] * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 PHISH_05 BODY: Phishing for account information * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8557] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 57] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 57] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.207.196.67 listed in zen.spamhaus.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.entelnet.bo (mailx237.entelnet.bo [200.87.100.237]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0C31V1D006272 for ; Sun, 11 Jan 2009 19:01:35 -0800 MIME-version: 1.0 Content-transfer-encoding: 8BIT Content-type: text/plain; charset=Windows-1251 Received: from User ([83.138.136.91]) by huayna3.entelnet.bo (EntelNet) with ESMTPA id <0KDC008ZD2NKZJ00@huayna3.entelnet.bo> for jhardin@impsec.org; Sun, 11 Jan 2009 20:57:51 -0400 (BOT) Received: from Adsl-41.207.196.67.aviso.ci (samira1@Adsl-41.207.196.67.aviso.ci [41.207.196.67]) by scandium.onspeed.com (SlipStream SP Server 6.0.19 built 2007/11/22 15:27:31 -0500 (EST)); Mon, 12 Jan 2009 00:57:51 +0000 (GMT) X-Originating-IP: [41.207.196.67] X-Originating-User: [samira1] Message-id: Reply-to: rich_1orgaranya@cantv.net From: Rich Orgaranya Subject: [SPAM] Reply us at rich_1orgaranya@cantv.net Date: Mon, 12 Jan 2009 01:57:46 +0100 X-Priority: 3 X-MSMail-priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 To: Undisclosed recipients: ; X-Greylist: Delayed for 01:28:25 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 11 Jan 2009 19:01:35 -0800 (PST) X-Spam-Prev-Subject: Reply us at rich_1orgaranya@cantv.net Status: R X-Status: X-Keywords: X-UID: 21 Content-Length: 3361 Reply us at rich_1orgaranya@cantv.net Dearest One, My name is Rich Orgaranya the only son of Late Mr Bawan Orgaranya the former Director of military intelligence and special acting General Manager of the Sierra Leone Diamond mining co-operation (SLDMC). We are contacting you to seek your good assistance to transfer and invest (USD 15 million) belonging to our late father which is deposited in a bank here in Abidjan. This money is revenues from solid minerals and diamonds sales which were under my fathers possession before the civil war broke out. Following the break out of the war, almost all government offices, co-operations and parastatal were attacked and vandalized. The SLDMC was loathed and burnt down to ashes, and diamonds worth millions of dollars was stolen by the rebel military forces who attacked our fathers office, many top government officials and senior army officers were assassinated and our father was a key target because of his very sensitive military position and appointment in the SLDMC. Regrettably, our father was captured and murdered along with his brother in cool blood during a mid-night rebel shoot-out when our official residence in Freetown was ambushed by Fordey Sanko the notorious rebel leader. Our mother sustained very severs bullet injuries which resulted to her untimely and painful death in a private hospital here in Ivory Coast. Now we are alone in a totally strange country without parents, relatives or any body to care for us at our tender ages. Before our mother died, she told us that our father deposited some money which he made from diamond sales and contracts in a bank here in Ivory Coast and that we should pray and find a trust worthy foreign business partner who would help us to transfer and invest this money in profitable business venture overseas. She told us to do this quickly so that we can leave Ivory Coast and then settle down abroad. She gave us the bank document to prove the deposit and then told us that our father used my name as the only son to deposit the money in the bank. She told us that this is the reason why we came to Ivory Coast. My mother died after wards. May she rest in perfect peace. I have gone to the bank to make inquires about this money and I spoke with the Manager of International remittance who assured me that everything is intact and promised to help us transfer this money to my fathers foreign partners bank account as soon as we provide our fathers partners foreign bank account for them. However, the manager is very concerned because of our age. I am 19 years why my younger sister is 16 years and as such advised that we should look for a matured person that will represent me at the bank. If you are willing to assist us, please let us know immediately so that you will arrange the transfer of the money to your account with the bank. Please note that we will offer you 15% of the total money as compensation for your noble assistance in accordance with my mothers advice. I am interested in any profitable commercial venture which you consider very well in your country and you would also get a school for me, my little sister so that we can finish our college education. We are hoping to hear your urgent response. Thank you and May God bless you and your dear family. Reply us at rich_1orgaranya@cantv.net Yours Children Rich and Rose. From edwpalmedpalmer3559@yahoo.co.uk Mon Jan 12 08:54:04 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************************* X-Spam-Status: Yes, score=43.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,MILLIONS_01,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID, NA_DOLLARS,PHISH_05,PHISH_18,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, STOX_52,TO_CC_NONE,UNCLAIMED_MONEY,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_18 BODY: Phishing * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 2.4 UNCLAIMED_MONEY BODY: People just leave money laying around * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 0.1 STOX_52 RAW: Very long blank lines * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mout3.freenet.de (mout3.freenet.de [195.4.92.93]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0CGrwBu027057 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 12 Jan 2009 08:54:04 -0800 Message-Id: <200901121654.n0CGrwBu027057@ga.impsec.org> Received: from [195.4.92.12] (helo=2.mx.freenet.de) by mout3.freenet.de with esmtpa (ID alexbaba12@freenet.de) (port 25) (Exim 4.69 #76) id 1LMPmX-0000KG-Nn; Mon, 12 Jan 2009 17:36:59 +0100 Received: from 82.159.7.191.dyn.user.ono.com ([82.159.7.191]:50245 helo=User) by 2.mx.freenet.de with esmtpa (ID alexbaba12@freenet.de) (port 25) (Exim 4.69 #76) id 1LMPmT-0002k1-TE; Mon, 12 Jan 2009 17:36:53 +0100 Reply-To: From: "EDWIN PALMER" Subject: [SPAM] From; Edwin Palmer Date: Mon, 12 Jan 2009 17:36:48 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Warning: yahoo.co.uk is listed at postmaster.rfc-ignorant.org X-Warning: yahoo.co.uk is listed at abuse.rfc-ignorant.org X-Greylist: Delayed for 00:16:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 12 Jan 2009 08:54:04 -0800 (PST) X-Spam-Prev-Subject: From; Edwin Palmer Status: R X-Status: X-Keywords: X-UID: 22 Content-Length: 4251 SALVADOR AND ASOCIADOS VALENCIA SPAIN. Calle Paseo de Gracia, Valencia Spain. Good morning, I know my letter will come to you as a surprise based on we dont know each other before, but first of all let me f introduce my self to you. I am Barrister Edwin Palmer Registered attorney in Spain. I have confidential business proposal I want to share with you in confidence. I got your contact from international brochure and I decided to contact you based on you bear the same surname with my late client an oil dealer residing in Iraq. My late client deposited these funds in a bank here in Spain before he died in a bomb blast in his house with his entire family in Iraq. My client deposited the sum of $15, 000, 000, 00 US Dollars (Fifteen million US Dollars) in a bank here in Spain before he died. Of which I have all the documents which he used in making the deposit with me here in our law firm, I am seeking for your permission to present you to the bank as a relation/ representative from my late client based on his instructions before he died, since you bear the same surname with him and I am his attorney here in Spain which I have the full right to present any of his representative or family member as next of kin to my clients deposit. You can easily make this deal with me since no body else knows about this deposit except me because he died after the deposit was made and I was a witness to the deposit agreement. I have tried to search for any member of his family but could not get to any one and the bank management can not release it unless somebody applies for it as next of kin or relation to the deceased as indicated in the banking guideline but unfortunately he died a It is therefore upon this that I decided to make this business proposal to you so that I will present you and direct you To apply as a family representative to the deceased for safety and subsequent disbursement since nobody knows about this deposit and I dont want this money to go into the Bank treasury as unclaimed funds or declared to the government of Spain which they will confiscate it. The request of foreigner as next of kin in this business is occasioned by the fact that my late client was a foreigner, and it will be better for you to stand as a family representative to him since you bear the same surname with him. I and my brother in law that works in this bank are the only people that know about this transaction. We have both agreed that 30% of this money will be for you as a foreign partner, in respect to the provision of a foreign family representative, while 60% will be for me and my brother in law then the remaining 10% you will use it for charity to help the less privilege people In your country. There after I will visit your country for disbursement according to the percentage indicated. Therefore to enable the immediate transfer of these funds to you as arranged, I will first of all present you to the bank as the family representative or next of kin of the deceased indicating your application for the withdrawal of these Family Inheritance to your nominated bank account before applying I will give you the necessary informations you will need to know about the deceased deposit. When responding I need your private telephone and fax numbers for easy and effective communication. Upon receipt of your reply, I will send to you by fax or email the text of the application which you will send to the bank and every order documents required. I will not fail to bring to your notice that this transaction is a hitch free and you should not entertain any atom of fear based on I am his legal attorney here in Spain. Trusting to hear from you immediately you receive this letter you can reach me by Phone, Fax or through my personal Emails below thank you and I look forward to hear from you. Best regards Edwin Palmer From calendar-invite@reply.yahoo.com Mon Jan 12 18:31:06 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_WHOIS,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_50_60,HTML_EMBED_IMG_03,HTML_EMBED_IMG_04,HTML_MESSAGE, JM_SOUGHT_FRAUD_3,MILLIONS_01,MILLION_USD,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,PHISH_05,RCVD_IN_BRBL,SUBJ_ALL_CAPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 HTML_EMBED_IMG_03 RAW: Contains embedded images * 0.2 HTML_EMBED_IMG_04 RAW: Contains embedded images * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 0.1 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [69.147.64.243 listed in b.barracudacentral.org] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n23b.bullet.mail.sp1.yahoo.com (n23b.bullet.mail.sp1.yahoo.com [69.147.64.243]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0D2V2pw009506 for ; Mon, 12 Jan 2009 18:31:06 -0800 Message-Id: <200901130231.n0D2V2pw009506@ga.impsec.org> Received: from [69.147.84.145] by n23.bullet.sp1.yahoo.com with NNFMP; 13 Jan 2009 02:31:01 -0000 Received: from [68.142.194.243] by t8.bullet.mail.sp1.yahoo.com with NNFMP; 13 Jan 2009 02:31:01 -0000 Received: from [209.191.93.246] by t1.bullet.mud.yahoo.com with NNFMP; 13 Jan 2009 02:31:01 -0000 Date: 12 Jan 2009 18:31:01 -0800 Received: from [127.0.0.1] by web123.cal.pim.mud.yahoo.com with NNFMP; 13 Jan 2009 02:31:01 -0000 x-yahoo-newman-errors: calendar-invite.mjwgk43tnfxgo2tpnzqwqmrxenvwkljrgiztcobrgm4dmmbnmjwgk43tnfxgo2tpnzqwqmrxenvwkort-jhardin=impsec.org@returns.bulk.yahoo.com MIME-Version: 1.0 Reply-to: blessingjonah27@yahoo.fr Errors-To: blessingjonah27@yahoo.fr From: Blessing Jonah To: jhardin@impsec.org Subject: [SPAM] I WAIT YOUR EMAIL FROM MIS BLESSING X-Yahoo-Newman-Property: calendar-invite X-Yahoo-Newman-Id: blessingjonah27#ke-1231813860-blessingjonah27#ke:3 X-Yahoo-Calendar-Iid: XxZhNwz%40ylq6%40gi69hJHdf3%40833DAfqfpxeAIh%40%40 X-RocketSRV: siu=http://us.i1.yimg.com/us.yimg.com/i/us/pim/el/inv16_1.gif;siw=16;sih=16;allow=all Content-Type: multipart/alternative; boundary="YCalInvites=GURK1Q2PErVhQ3HasaDptPvCNNxiIXE1231813852-1" X-Spam-Prev-Subject: I WAIT YOUR EMAIL FROM MIS BLESSING Status: R X-Status: X-Keywords: X-UID: 23 Content-Length: 10670 --YCalInvites=GURK1Q2PErVhQ3HasaDptPvCNNxiIXE1231813852-1 Content-type: text/plain; charset=windows-1252; Content-Transfer-Encoding: 8bit Invitation : "I WAIT YOUR EMAIL FROM MIS BLESSING". Par votre hte Blessing Jonah: Date: mardi 13 janvier 2009 Heure: 2h 00 - 3h 00 (GMT+00:00) Lieu: From Miss Blessing Jonah. Republic of Benin, Hello dear, With profound respect and humble submission, I beg to state the following few lines for your kind consideration, I hope you will spare some of your valuable minutes to read the following appeal with sympathetic mind. I must confess that it is with great hopes, joy and enthusiasm that I write you this mail which I know and believe by the faith that it must surely find you in good condition of health. My name is Miss Blessing Jonah, I am the only Daughter of my late parents Mr.and Mrs Jonah Hanukah. My father was a highly reputable business magnet who operated in the capital of Benin during his days. It is sad to say that he passed away mysteriously in France during one of his business trips abroad on the 20th May 2007. Though his sudden death was linked or rather suspected to have been masterminded by an uncle of mine who travelled with him at that time. But god knows the truth! My mother died when I was just 6yrs old, and since then my father took me so special. Before the death of my father on May 2007, he called me and informed me that he has the sum of Ten Million, Five Hundred thousand United State Dollars.(USD$10,500,000.00) he deposited in a private Bank here in Republic of Benin , He told me that he deposited the money in my name, and also gave me all the necessary legal documents regarding to this deposit with the Bank I am just 21 years old and a university undergraduate and really don't know what to do. Now I want an honest and god fearing partner overseas who I can transfer this money with his assistance and after the transaction I will come and reside permanently in your country till such a time that it will be convinient for me to return back home if I so desire. This is because I have suffered a lot of set backs as a result of incessant political crisis here in Benin. The death of my father actually brought sorrow to my life. I also want to invest the fund under your care because I am ignorant of business world. I am in a sincere desire of your humble assistance in this regards. Your suggestions and ideas will be highly regarded. Now permit me to ask these few questions: 1. Can you honestly help me from your heart? 2. Can I completely trust you? 3. What percentage of the total amount in question will be good for you after the fund has being transfeered to your account and i come over to meet you ? Please, consider this and get back to me as soon as possible. Immedaitely I confirm your willingness, I will send to you my Picture and also inform you more details involved in this matter. Anticipating hearing from you soon you can contact me through this my private email,(blessing_jonah209@yahoo.fr) Kind Regards, Miss Blessing Jonah. Viendrez-vous ? Rpondre cette invitation, : http://calendar.yahoo.com/blessingjonah27?v=126&a1=0&iid=XxZhNwz%40ylq6%40gi69hJHdf3%40833DAfqfpxeAIh%40%40&igid=whBn%40gvb4mU0%40fm0DxYRQpd%401hBDBvpsZxEvNXn%40xmv%40 Copyright 2009 Tous droits rservs. www.yahoo.fr Donnes personnelles: http://privacy.yahoo.com/privacy/us Conditions d'utilisation: http://docs.yahoo.com/info/terms/ --YCalInvites=GURK1Q2PErVhQ3HasaDptPvCNNxiIXE1231813852-1 Content-type: text/html; charset=windows-1252; Content-Transfer-Encoding: 8bit
Vous tes invit ::   I WAIT YOUR EMAIL FROM MIS BLESSING
Par votre hte:   Blessing Jonah
 
Date:   mardi 13 janvier 2009
Heure:   2h 00 - 3h 00  (GMT+00:00)
Lieu:   From Miss Blessing Jonah. Republic of Benin, Hello dear, With profound respect and humble submission, I beg to state the following few lines for your kind consideration, I hope you will spare some of your valuable minutes to read the following appeal with sympathetic mind. I must confess that it is with great hopes, joy and enthusiasm that I write you this mail which I know and believe by the faith that it must surely find you in good condition of health. My name is Miss Blessing Jonah, I am the only Daughter of my late parents Mr.and Mrs Jonah Hanukah. My father was a highly reputable business magnet who operated in the capital of Benin during his days. It is sad to say that he passed away mysteriously in France during one of his business trips abroad on the 20th May 2007. Though his sudden death was linked or rather suspected to have been masterminded by an uncle of mine who travelled with him at that time. But god knows the truth! My mother died when I was just 6yrs old, and since then my father took me so special. Before the death of my father on May 2007, he called me and informed me that he has the sum of Ten Million, Five Hundred thousand United State Dollars.(USD$10,500,000.00) he deposited in a private Bank here in Republic of Benin , He told me that he deposited the money in my name, and also gave me all the necessary legal documents regarding to this deposit with the Bank I am just 21 years old and a university undergraduate and really don't know what to do. Now I want an honest and god fearing partner overseas who I can transfer this money with his assistance and after the transaction I will come and reside permanently in your country till such a time that it will be convinient for me to return back home if I so desire. This is because I have suffered a lot of set backs as a result of incessant political crisis here in Benin. The death of my father actually brought sorrow to my life. I also want to invest the fund under your care because I am ignorant of business wor ld. I am in a sincere desire of your humble assistance in this regards. Your suggestions and ideas will be highly regarded. Now permit me to ask these few questions: 1. Can you honestly help me from your heart? 2. Can I completely trust you? 3. What percentage of the total amount in question will be good for you after the fund has being transfeered to your account and i come over to meet you ? Please, consider this and get back to me as soon as possible. Immedaitely I confirm your willingness, I will send to you my Picture and also inform you more details involved in this matter. Anticipating hearing from you soon you can contact me through this my private email,(blessing_jonah209@yahoo.fr) Kind Regards, Miss Blessing Jonah.
 
Viendrez-vous ?   Rpondre cette invitation
Copyright 2009  Yahoo! Tous droits rservs. | Conditions d'utilisation | Donnes personnelles
--YCalInvites=GURK1Q2PErVhQ3HasaDptPvCNNxiIXE1231813852-1-- From samsonlucas2002@yahoo.co.jp Mon Jan 5 12:27:56 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_JP_1,FREEMAIL_FROM,FREEMAIL_REPLYTO, HTML_MESSAGE,J_CHICKENPOX_74,J_CHICKENPOX_83,MILLIONS_01,MILLION_USD,PHISH_05, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SPF_PASS,URG_BIZ, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 0.5 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from web3106.mail.kcd.yahoo.co.jp (web3106.mail.kcd.yahoo.co.jp [124.147.37.250]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n05KRpVA030033 for ; Mon, 5 Jan 2009 12:27:55 -0800 Received: (qmail 82944 invoked by uid 60001); 5 Jan 2009 19:55:34 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=yj20050223; d=yahoo.co.jp; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=h9TS2U5hDAsHCAePJQyL3f40mEyivpThYea5lEKezsqJE730h1iTkkQcXkrfA1d0/wDx33XmyodKONUd3e8sIrSZF9XRfe+J8phaHTGVFW7ucloEN1tl19TdDU718bgT ; Message-ID: <20090105195534.82942.qmail@web3106.mail.kcd.yahoo.co.jp> Received: from [41.202.69.132] by web3106.mail.kcd.yahoo.co.jp via HTTP; Tue, 06 Jan 2009 04:55:34 JST Date: Tue, 6 Jan 2009 04:55:34 +0900 (JST) From: "samsonlucas2002@yahoo.co.jp" Reply-To: samslucas1@yahoo.fr Subject: [SPAM] Please I need your Help . To: samsonlucas2002@yahoo.co.jp MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-876142596-1231185334=:82810" X-Greylist: Delayed for 00:32:12 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 05 Jan 2009 12:27:56 -0800 (PST) X-Spam-Prev-Subject: Please I need your Help . Status: R X-Status: X-Keywords: X-UID: 24 Content-Length: 6118 --0-876142596-1231185334=:82810 Content-Type: text/plain; charset=iso-2022-jp From : Samson Lucas Abidjan Ivory coast APPEAL FOR URGENT ASSISTANCE. With due respect and with GOD all thing are possible that is why I call for help to please Permit me to inform you of my desire of going into business relationship with you.I got your contacts through my personal research,and out of desperation i decided to reach you through this medium. I am Samson Lucas the only son of late Mr Edward Lucas My father was a very wealthy cocoa merchant in Abidjan the economic capital of Ivory coast.My father was poisoned to dearth by his business associates on one of their outings on a business trip . My mother died when I was a baby and since then my father took me so special. Before the death of my father in a private hospital here in Abidjan he secretly called me on his bed side and told me that he has the sum of (Eleven million five hundred thousand United State Dollars)$11.5m left in fixed /suspence account in one of the prime bank here in Abidjan,that he used my name as his only son for the next of Kin in depositing of the fund. He also explained to me that it was because of this wealth that he was poisoned by his business associates. That I should seek for a foreign partner in a country of my choice where i will transfer this money and use it for investment purpose such as real estate management or hotel management. I am honourably seeking your assistance in the following ways: (1) To provide a bank account into which this money would be transferred into. (2) To serve as a guardian of this fund since I'm only 20 years old. (3) To make arrangement for me to come over to your country to further my education and to secure a resident permit in your country. Moreover, I am willing to offer you 15% of the total sum as compensation for your effort/input after the successful transfer of this fund into your nominated account overseas. Furthermore, you indicate your options towards assisting me as I believe that this transaction would be concluded within seven (7) days you signify interest to assist me. Please get back to me immediately you receive this my message for futher informations and important oral discussions. For your information I will like you to keep this transaction in secrecy and confidential within you because of my dear life and due to the large amount of money involve and as well for security reason. I'm Anticipating to hear from you today. Thanks and God bless you. Best regards. Samson lucas --------------------------------- Power up the Internet with Yahoo! Toolbar. --0-876142596-1231185334=:82810 Content-Type: text/html; charset=iso-2022-jp
From : Samson Lucas
Abidjan Ivory coast

       APPEAL FOR URGENT ASSISTANCE.

   With due respect and with GOD all thing are possible that is why I call for help to please Permit me to inform you of my desire of going into business relationship with you.I got your contacts through my personal research,and out of desperation i decided to reach you through this medium.
 
I am Samson Lucas the only son of late Mr Edward Lucas My father was a very wealthy cocoa merchant in Abidjan the economic capital of Ivory coast.My father was poisoned to dearth by his business associates on one of their outings on a business trip .

My mother died when I was a baby and since then my father took me so special. Before the death of my father in a private hospital here in Abidjan he secretly called me on his bed side and told me that he has the sum of (Eleven million five hundred thousand United State Dollars)$11.5m left in fixed /suspence account in one of the prime bank here in Abidjan,that he used my name as his only son for the next of Kin in depositing of the fund.

He also explained to me that it was because of this wealth that he was poisoned by his business associates. That I should seek for a foreign partner in a country of my choice where i will transfer this money and use it for investment purpose such as real estate management or hotel management.

I am honourably seeking your assistance in the following ways:

(1) To provide a bank account into which this money would be transferred into.

(2) To serve as a guardian of this fund since I'm only 20 years old. 

(3) To make arrangement for me to come over to your country to  further my education and to secure a resident permit in your country.

Moreover, I am willing to offer you 15% of the total sum as compensation for your effort/input after the successful transfer of this fund into your nominated account overseas.

Furthermore, you indicate your options towards assisting me as I believe that this transaction would be concluded within seven (7) days you signify interest to assist me.

Please get back to me immediately you receive this my message for futher informations and important oral discussions.
 
 For your information I will like you to keep this transaction in secrecy and confidential within you because of my dear life and due to the large amount of money involve and as well for security reason.
 
 I'm Anticipating to hear from you today.

Thanks and God bless you.

Best regards.
 Samson lucas
 

Power up the Internet with Yahoo! Toolbar.
--0-876142596-1231185334=:82810-- From FEDEX@FASTDELIVERY.NET Wed Jan 7 01:15:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********** X-Spam-Status: Yes, score=10.0 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, FROM_NO_LOWER,J_CHICKENPOX_41,J_CHICKENPOX_61,J_CHICKENPOX_71,LOTTO_AGENT, MILLIONS_01,STOX_58,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FROM_NO_LOWER From address has no lower-case characters * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 LOTTO_AGENT BODY: Claims Agent * 0.2 STOX_58 BODY: This company * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from outbound-mail-315.bluehost.com (outbound-mail-315.bluehost.com [67.222.54.8]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n079FN1B020966 for ; Wed, 7 Jan 2009 01:15:39 -0800 Received: (qmail 7194 invoked by uid 0); 7 Jan 2009 08:45:35 -0000 Received: from unknown (HELO box385.bluehost.com) (69.89.31.185) by outboundproxy6.bluehost.com with SMTP; 7 Jan 2009 08:45:35 -0000 Received: from localhost ([127.0.0.1]) by box385.bluehost.com with esmtpa (Exim 4.69) (envelope-from ) id 1LKU5Y-00023W-N2; Wed, 07 Jan 2009 01:48:32 -0700 Received: from syd-ult-slb1-vlan5.ii.net (syd-ult-slb1-vlan5.ii.net [203.215.17.58]) by 69.89.31.185 (Horde MIME library) with HTTP; Wed, 07 Jan 2009 01:48:31 -0700 Message-ID: <20090107014831.8uztcnp0is4w8oc8@69.89.31.185> Date: Wed, 07 Jan 2009 01:48:31 -0700 From: FEDEX COURIERS Reply-to: fedex.couriers420@gmail.com To: undisclosed-recipients:; Subject: [SPAM] I HAVE REGISTERED YOUR PARCEL WITH THE FedEx COURIERS SERVICE / Call: {+234-807- MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.1.6) X-Identified-User: {2057:box385.bluehost.com:cpanelhorde:box385.bluehost.com} {sentby:program running on server} X-Greylist: Delayed for 00:26:51 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 07 Jan 2009 01:15:39 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n079FN1B020966 X-Spam-Prev-Subject: I HAVE REGISTERED YOUR PARCEL WITH THE FedEx COURIERS SERVICE / Status: R X-Status: X-Keywords: X-UID: 25 Content-Length: 3917 I HAVE REGISTERED YOUR PARCEL WITH THE FedEx COURIERS SERVICE / Call: {+234-807- 8455-927}URGENTLY. Email: fedex.couriers420@gmail.com Good day!!! CLAIM NOTIFICATION. This is to notify you that your parcel is still in our possession, this parcel contained an International Cashier Bank Draft/Cheque worth the sum of $2 Million dollars only and it is ready for delivery to your door step. Meanwhile, before the delivery or shipment will take place, you are advice to send to us the following data?s mention Fill this Form: Name: Address: City: State: Date of Birth: Postal Code: Country: Marital Status: And your contact phone number: The above requested information?s will enable us deliver your parcel correctly without any mistake or delivering your parcel to a wrong person. FedEx courier service company mailing you as per your parcel that was brought to this company to be delivered to you by lottery groups, We are happy to inform you once again that your parcel that contains the sum of $2 million dollars is among the 24 parcel?s listed which is now in our office and also with your name as the receiver despite that we lost your private residential address?s, which is an indication that you can now re-send your residential address, telephone as stated above back to the FedEx company where your parcel can be delivered to you without hesitation with this e-mail (fedex.couriers420@gmail.com) Meanwhile remember that the sender of this parcel to you that the fiduciary agent still owes this company the sum of $290 before incident occurs that he has to Travel all the way to Amsterdam for bussiness research, Note that this company has spend out of their incomes in the process by recovery back your parcel?s dear customer we once again appreciate your patronage in our favour. Without hesitations you are to pay for just the balance left by your sender since we have lost his contact via western union so that your parcel can be delivered to your residential address before it accumulate a dumerrage after one week only, as you know your parcel is not just an ordinary parcel but with a huge amount and I think you understand what I mean by accumulating a demurrage? Which you will not allow to happen to your recovery parcel that almost gone if not for the love that the good God have for you by favouring you with his Mercy. We assure you that your parcel will arrive at your country in two days time and it will get to your door step the third day as soon as this company receive the balance left by your sender? and the tracking number of your parcel will be sent to you via e-mail immediately so that you can track it yourself to see your parcel coming on the way and you will also know when it will arrive at your country because we operate in trust and loyalty . FedEx provides access to a growing global market place through a network of supply chain, transportation, business and related information Services. YOU ARE TO PROCEED TO THE WESTERN UNION AND MAKE THE PAYMENT. Below is our approved payment department officer where you can direct all payment to for the delivery of your parcel. SENDERS NAME------- RECEIVERS NAME------MR.SMITH PETER. SENDERS COUNTRY/ HOME ADDRESS ----- RECEIVERS COUNTRY----129 DEFENCE HOUSING AREA Abuja NIGERIA. TEXT QUESTION------------ IN GOD?. TEXT ANSWER--------------- WE TRUST. AMOUNT TO BE PAID --------- $ 290 AND ALSO WITH THE MTCN NUMBER. Please you have to send the full payment information including the MTCN Number for we to fully proceed on your delivery FedEx is one of the world's great success stories, the start-up that revolutionized the delivery of packages and information. In the past 35 years, we've grown up and grown into a diverse family of companies -all over the world. FedEx that's bigger, stronger, better than ever. Call:{+234-807-8455-927} WAITING TO READ YOUR E-MAIL. YOURS AFFECTIONATLY. MRS.JOAN MARY. From online@abbey2009.com Wed Jan 14 03:55:36 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=25.0 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_NG_2,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_73,MILLIONS_01,MSGID_FROM_MTA_HEADER, RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET,SUBJ_ALL_CAPS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [81.169.146.189 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mo-p07-ob.rzone.de (mo-p07-ob.rzone.de [81.169.146.189]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0EBtWF6027657 for ; Wed, 14 Jan 2009 03:55:36 -0800 X-RZG-CLASS-ID: mo00 X-RZG-AUTH: :I2IIfE6tW/5PROUCrmbsgTmO/lzm5ThKNDhDcOwfjPhjmOqPnte5X/adYVMmhQ== To: undisclosed-recipients:; Message-ID: Received: from User ([196.29.214.21]) by post.strato.de (mrclete mo13) (RZmta 18.10) with ESMTP id y04bd7l0EB5wkO ; Wed, 14 Jan 2009 12:10:04 +0100 (MET) Reply-To: From: "MRS SARAH THOMAS" Subject: [SPAM] 2008 SCAM VICTIMS COMPENSATIONS PAYMENTS Date: Wed, 14 Jan 2009 12:11:05 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-7" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:21:03 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 14 Jan 2009 03:55:36 -0800 (PST) X-Spam-Prev-Subject: 2008 SCAM VICTIMS COMPENSATIONS PAYMENTS Status: R X-Status: X-Keywords: X-UID: 26 Content-Length: 1049 SIR/MADAM, This is to bring to your notice that we are delegated from the UNITED NATIONS in Central Bank to pay 50 victims of scam $500,000 USD (five Hundred Thousand Dollars) each.. You are listed and approved for this payment as one of the scammed victims to be paid this amount, get back to this office as soon as possible for the immediate payment of your $500,000 USD compensation funds. My dear friend I will like you to contact the finance house for the collection of this international certificated bank draft. The name and contact address of The Person with your Cheque is Mr. Wesley Greenfield. Send a copy of your response to official email: SECURITY & FINACIAL CONTACT AGENT: Mr. Wesley Greenfield EMAIL: georgeellissrrr@googlemail.com CELL PHONE: +234-801-334-8760 You are advised to send your communication particulars, full names, telephone/fax numbers,mailing address,age and occupation to enable us have your cheque sent to your designated address. Yours Faithfully, Mrs.Sarah Thomas Secretary United Nations West Africa From info@euromillions.es Thu Jan 15 15:29:27 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.9 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_TW_1,BL_COUNTRY_TW_2,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO,JM_SOUGHT_3,J_CHICKENPOX_43,LOTTO_AGENT,LOTTO_WIN_02, LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,SARE_LOTTO_SPAM2,THOUS_EMAIL_ADDRS, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_02 BODY: * Winner * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.64.21.75 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [84.120.65.124 listed in dnsbl.sorbs.net] * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [210.64.21.75 listed in tw.countries.nerd.dk] * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 4.0 JM_SOUGHT_3 Body contains frequently-spammed text patterns * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from nuee.com.tw (h75-210-64-21.fb.com.tw [210.64.21.75] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0FNTMOC020105 for ; Thu, 15 Jan 2009 15:29:26 -0800 Message-Id: <200901152329.n0FNTMOC020105@ga.impsec.org> Received: from 84.120.65.124.dyn.user.ono.com ([84.120.65.124]:55497 helo=User) by nuee.com.tw with esmtpa (Exim 4.60) (envelope-from ) id 1LNFzK-00005F-KO; Thu, 15 Jan 2009 08:21:36 +0800 From: "EURO MILLION S.L" Subject: [SPAM] Confirmation Batch Number: 097/310-XL11 Date: Thu, 15 Jan 2009 00:06:22 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 24:21:48 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 15 Jan 2009 15:29:27 -0800 (PST) X-Spam-Prev-Subject: Confirmation Batch Number: 097/310-XL11 Status: R X-Status: X-Keywords: X-UID: 27 Confirmation Batch Number: 097/310-XL11 FROM:GOVERNMENT ACCREDITED LICENSED LOTTERY, INTERNATIONAL PROMOTIONS/ PRIZE AWARD DEPARTMENT. Pol.Lasao, Area Anardi 155, 28090 Madrid. Spain Branch. We are pleased to inform you of the result of the Lottery Winners International programs held January 2009,your e-mail address attached to Ref Num.T9Q/102/0035, Has just won you an award sum of 500,000.00 Euros,(Five Hundred Thousand Euros) In this category A, You re requires to stake your claim with this info: Ref. Number: T9Q/102/131/0035. Batch Number: 097/310-XL11 Name,Age,Sex.Address,Telephone Number Contact The Fiduciary Agent: Mr. Fredrick Weenink, Email: claimprize1@gmail.com Tel: +34 622-347-210 From idiomaadams@nnpcgroup.int.tf Fri Jan 16 15:02:20 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,DATE_IN_PAST_24_48,FORGED_MUA_OUTLOOK,L_MANY_STD_PROBS, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,PHISH_05,RCVD_BY_IP, SARE_PROLOSTOCK_SYM3,TO_CC_NONE,UNPARSEABLE_RELAY,X_PRIORITY_HIGH autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.0 RCVD_BY_IP Received by mail server with no name * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 0.9 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 0.2 PHISH_05 BODY: Phishing for account information * 1.6 SARE_PROLOSTOCK_SYM3 BODY: Last week's hot stock scam * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 3.0 L_MANY_STD_PROBS Three or more standards-compliance problems Received: from plesk2.speedfox.com ([216.177.130.10]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0GN2Bws024711 for ; Fri, 16 Jan 2009 15:02:17 -0800 Message-Id: <200901162302.n0GN2Bws024711@ga.impsec.org> Received: (qmail 912 invoked from network); 15 Jan 2009 18:54:29 -0600 Received: from (HELO User) (195.166.239.227) by 64.40.153.201 with SMTP; 15 Jan 2009 18:54:27 -0600 Reply-To: From: "Idioma Adams St.Michaels" Subject: [SPAM] Re:Investment in your Gremany 201 Date: Thu, 15 Jan 2009 00:06:53 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 19:24:31 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 16 Jan 2009 15:02:17 -0800 (PST) X-Spam-Prev-Subject: Re:Investment in your Gremany 201 Status: R X-Status: X-Keywords: X-UID: 28 Hello my friend, I am Mr. Adams St.Michael, I work for NNPC. We Have an over invoiced $28.6M to be transfered to your account. If you are interested kindly get back to us via e-mail. Once again, we are serious and no risk involved. Tel:234 706 121 6502 Yours Sincerely, Adams St.Michael From fccauuil@bullieti.com Fri Jan 16 16:23:49 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.2 required=5.0 tests=BAYES_80,DATE_IN_PAST_24_48, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,JM_SOUGHT_FRAUD_2,L_SOME_STD_PROBS, SARE_FRAUD_X3,SARE_FRAUD_X4,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 0.9 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8899] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from csmtp3.b-one.net (csmtp3.one.com [195.47.247.213]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0H0NhIR027205 for ; Fri, 16 Jan 2009 16:23:47 -0800 Received: from User (92.40.170.109.sub.mbb.three.co.uk [92.40.170.109]) by csmtp3.b-one.net (Postfix) with ESMTP id AA0723819C0F; Sat, 17 Jan 2009 00:59:16 +0100 (CET) Reply-To: From: "Mrs Elaine Masters" Subject: [SPAM] Do Assist The Needy Date: Thu, 15 Jan 2009 23:58:59 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Message-Id: <20090116235916.AA0723819C0F@csmtp3.b-one.net> To: undisclosed-recipients:; X-Greylist: Delayed for 00:23:20 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 16 Jan 2009 16:23:47 -0800 (PST) X-Spam-Prev-Subject: Do Assist The Needy Status: R X-Status: X-Keywords: X-UID: 29 Hello, I am Elaine Masters now undergoing medical treatment for cancer. I am married to Dr. David Masters who worked with South Africa embassy in Malaysia for ten years before he died in the year 2002. Before my Husband died, we both made a deposit of a total sum $8.6M in a financial company here in U.K. Recently, my Doctor told me that I have few months to live due to cancer problem. Having known my condition I have decided to donate this fund to an honest Person. My Attorney will issue you a Letter of Authority from Court naming you the original Beneficiary of these funds. Please assure me that you will act accordingly as I stated herein. Hoping to hear from you. Remember to send your response to this email address: mrselaine.masters@gmail.com In His Arms. Mrs. Elaine Masters From chineudha111@yahoo.com.hk Sat Jan 17 08:37:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************** X-Spam-Status: Yes, score=38.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FORGED_RCVD_HELO,FREEMAIL_FROM, HTML_10_20,HTML_MESSAGE,HTML_TITLE_EMPTY,J_CHICKENPOX_42,J_CHICKENPOX_52, L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,MIME_HTML_ONLY, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BRBL,RCVD_IN_SORBS_WEB,SUBJ_ALL_CAPS,TO_CC_NONE,URG_BIZ, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [70.88.17.82 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [41.202.92.33 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [41.202.92.33 listed in psbl.surriel.com] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.202.92.33 listed in dnsbl.sorbs.net] * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.whitfieldoil.com (70-88-17-82-chattanooga-tn.hfc.comcastbusiness.net [70.88.17.82] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0HGaQlF019478 for ; Sat, 17 Jan 2009 08:37:03 -0800 Received: from User ([41.202.92.33]) by mail.whitfieldoil.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 17 Jan 2009 11:12:34 -0500 Reply-To: From: "Udha Chine" Subject: [SPAM] URGENT AND CONFIDENTIAL ASSIST Date: Sat, 17 Jan 2009 16:12:08 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 17 Jan 2009 16:12:40.0399 (UTC) FILETIME=[6BC56DF0:01C978BE] X-Greylist: Delayed for 00:24:10 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 17 Jan 2009 08:37:26 -0800 (PST) X-Spam-Prev-Subject: URGENT AND CONFIDENTIAL ASSIST Status: R X-Status: X-Keywords: X-UID: 30 Content-Length: 1865
Hello Dear,
How are you and every members of your family we hope fine It is my pleasure to identify with you.I am Chine Udha and My younger brother Joel is 18 years we are from sierra leone but residing in Ivory Coast in Africa. It is my desire to contact you on honesty and sincerity to assist us in transferring the sum ofUS$5.600.000 (FIVE MILLION SIX HUNDRED THOUSAND,UNITED STATES DOLLARS)inherited from my late father Udha Johnson to your country for investment.
 
It is sad to say that he passed away mysteriously in France during one of his business trips broad.Though his sudden death was linked or rather suspected to have been masterminded by our wicked uncle who travelled with him at that time.But God knows the truth,we are motivated to contact you after our prayers, and as we get to know you better, we hope to gradually build trust, relationship and confidence in you as our step parent.So if you can be in position to assist us in any way, we will be glad and willing to offer you 20% of the total sum for your assistance in retrieving the money and effort input after the successful transfer of this money and  investment.
 
Indicate your interest towards assisting us by sending your phone # and address so that we can communicate with you at any time.we need your expected guidance in investing the money in any profitable business investment in your country.If you are willing to assist us, kindly get back to us immediately with your adequate communication.
 
Thanks
Chine and Joel
 
 
 From ben_sankara0099@msn.com Sat Jan 17 10:31:58 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************************************** X-Spam-Status: Yes, score=42.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO,FROM_HAS_ULINE_NUMS, HTML_MESSAGE,HTML_STOOPID_02,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_61,LOTTO_YOU_WON_03,PHISH_05,RAZOR2_CHECK,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_SXLIFE,SPF_PASS,STOX_30, SUBJ_ALL_CAPS,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.3 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.1 SARE_SXLIFE BODY: Talks about your sex life * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 HTML_STOOPID_02 RAW: stupid HTML: empty STRONG tag * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from bay0-omc1-s13.bay0.hotmail.com (bay0-omc1-s13.bay0.hotmail.com [65.54.246.85]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0HIVsi9022330 for ; Sat, 17 Jan 2009 10:31:57 -0800 Received: from BAY102-W35 ([64.4.61.135]) by bay0-omc1-s13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 17 Jan 2009 10:14:39 -0800 Message-ID: Content-Type: multipart/alternative; boundary="_17b5607f-72e5-4340-9f74-0fdb992db314_" X-Originating-IP: [41.203.225.85] Reply-To: From: benard sankara Subject: [SPAM] DEAR FRIEND,I NEED YOUR ASSISTANCE. Date: Sat, 17 Jan 2009 18:14:39 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 17 Jan 2009 18:14:39.0554 (UTC) FILETIME=[7653DA20:01C978CF] X-Greylist: Delayed for 00:17:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 17 Jan 2009 10:31:58 -0800 (PST) X-Spam-Prev-Subject: DEAR FRIEND,I NEED YOUR ASSISTANCE. Status: R X-Status: X-Keywords: X-UID: 31 Content-Length: 9035 --_17b5607f-72e5-4340-9f74-0fdb992db314_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FROM MR BENARD SANKARA.AUDITING AND ACCOUNTING UNIT. AFRICA DEVELOPMENT BAN= K (A.D.B) OUAGADOUGOU BURKINA-FASO. = Dear friend this is real I a= m the manager auditting and accounting department african development bank.= (ADB) Ouagadougou Burkina-faso in west africa.I wish to seek your partnersh= ip in business.I discovered unclaim sum of $10.5m us dollars in our bank wh= ich belonged to one of our late foreign customer who died with his entire f= amily in Kenya plane crash on 21 July 2003. I discovered this while cross-c= hecking the files of foreigners in my department since our federal governme= nt has announced on the need of settling all foreign bills to enable foreig= n investors to come into our country and as an order from african unity gov= erned by african heads. Since I discovered the unclaim fund and about his d= eath=2C I have been expecting his next of kin to come over and claim his mo= ney because our bank cannot release it unless somebody applies for it as ne= xt of kin or relation to the deceased as indicated in our banking guideline= s but unfortunately I learnt that all his supposed next of kin or relation = died alongside with him at the plane crash leaving nobody behind for the cl= aim. it is therefore upon this discovery that I now decided to make this bu= siness proposal to you as to be a partner and stand as the next of kin to c= laim the fund since nobody is coming for it. The banking law and guideline = here stipulates that if such money remained unclamed after six years=2C the= money will be transfered into the bank treasury as unclaimed fund. The req= uest of foreigner as next of kin in this business is because the customer = was not a burkinabe and a burkinabe cannot stand as next of kin to a foreig= ner.You will be entitled to 40 % of this money as foreign partner=2C since= you provide an account for the claim=2C 5 % will be set aside for expenses= incured during the business and 55 % will be for me. There after I will vi= sit your country for disbursement accoding to the percentages indicated if = agreed. Please you have been adviced to keep this transaction secret as I a= m still in service and intend to retire from service after I conclude this = deal with you. I keep this information secret within myself to enable the w= hole plans and idea be profitable and successful during the time of executi= on.Meanwhile all the whole arrangement to put claim over this fund as the b= onafide next of kin to the deceased=2C get the required approval and transf= er this money to a foreign account has been put in place and directives and= needed information will be relayed to you as soon as you indicate your int= erest and willingness to assist me and also benefit your self to this great= business opportunity. I will be monitoring the whole situation here in th= is bank until you confirm the money in your account and ask me to come down= to your country for subsequent sharing of the fund according to percentage= s previously indicated and further investment=2C either in your country or = any country you advice us to invest in. I will not fail to bring to your no= tice that this transaction is 100% risk free and that you should not entert= ain any atom of fear as all required arrangements have been made for the tr= ansfer and the file of the fund is under my desk.All other necessary vital = information will be sent to you when I hear from you. Now our questions ar= e:1) Can you handle this project?2) Can I give you this trust? Please let u= s get this fund transfer into your account very fast.I look foward to recei= ve your reply as soon as you receive this email. =20 I wish you happy new year 2009 All the best to you from=2C Mr Benard Sankar= a. = --_17b5607f-72e5-4340-9f74-0fdb992db314_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
FROM MR BENARD SANKARA.
AUDITING AND ACCOUNTING UNIT.
A= FRICA DEVELOPMENT BANK (A.D.B)
OUAGADOUGOU BURKINA-FASO. =3B
&n= bsp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B
 =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B  =3B =3B =3B =3B Dear friend = this is real
I am the manager auditting and accounting department afric= an development bank.(ADB) Ouagadougou Burkina-faso in west africa.I wish to= seek your partnership in business.I discovered unclaim sum of $10.5m us do= llars in our bank which belonged to one of our late foreign customer who di= ed with his entire family in Kenya plane crash on 21 July 2003. I discovere= d this while cross-checking the files of foreigners in my department since = our federal government has announced on the need of settling all foreign bi= lls to enable foreign investors to come into our country and as an order fr= om african unity governed by african heads. Since I discovered the unclaim = fund and about his death=2C I have been expecting his next of kin to come o= ver and claim his money because our bank cannot release it unless somebody = applies for it as next of kin or relation to the deceased as indicated in o= ur banking guidelines but unfortunately I learnt that all his supposed next= of kin or relation died alongside with him at the plane crash leaving nobo= dy behind for the claim. it is therefore upon this discovery that I now dec= ided to make this business proposal to you as to be a partner and stand as = the next of kin to claim the fund since nobody is coming for it.
 = =3B
The banking law and guideline here stipulates that if such money rem= ained unclamed after =3Bsix years=2C the money will be transfered into = the bank treasury as unclaimed fund. The request of =3B foreigner as ne= xt of kin in this business is because the customer was not a burkinabe and = a burkinabe cannot stand as next of kin to a foreigner.You will be entitled= to =3B 40 % of this money as foreign partner=2C since you provide an a= ccount for the claim=2C 5 % will be set aside for expenses incured during t= he business and 55 % will be for me. There after I will visit your country = for disbursement accoding to the percentages indicated if agreed. Please yo= u have been adviced to keep this transaction secret as I am still in servic= e and intend to retire from service after I conclude this deal with you. I = keep this information secret within myself to enable the whole plans and id= ea be profitable and successful during the time of execution.Meanwhile all = the whole arrangement to put claim over this fund as the bonafide next of k= in to the deceased=2C get the required approval and transfer this money to = a foreign account has been put in place and directives and needed informati= on will be relayed to you as soon as you indicate your interest and willing= ness to assist me and also benefit your self to this great business opportu= nity.
 =3B
I will be monitoring the whole situation here in this= bank until you confirm the money in your account and ask me to come down t= o your country for subsequent sharing of the fund according to percentages = previously indicated and further investment=2C either in your country or an= y country you advice us to invest in. I will not fail to bring to your noti= ce that this transaction is 100% risk free and that you should not entertai= n any atom of fear as all required arrangements have been made for the tran= sfer and the file of the fund is under my desk.All other necessary vital in= formation will be sent to you when I hear from you. =3B
 =3B
= Now our questions are:
1) Can you handle this project?
2) Can I give = you this trust?
 =3B
Please let us get this fund transfer into yo= ur account very fast.I look foward to receive your reply as soon as you rec= eive this email.
 =3B
I wish you happy new year 2009 =3B

All the best to you from=2C
Mr Benard Sankara.
= --_17b5607f-72e5-4340-9f74-0fdb992db314_-- From vin.staff@shanghai.hk Sat Jan 17 16:42:15 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,MILLIONS_01,MILLION_USD,RAZOR2_CHECK, SUBJ_ALL_CAPS,UNDISC_RECIPS,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp-out5.iol.cz (smtp-out5.iol.cz [194.228.2.77]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0I0g9CS031824 for ; Sat, 17 Jan 2009 16:42:14 -0800 Received: from User (unknown [212.100.69.11]) by smtp-out5.iol.cz (Postfix) with ESMTP id EC731595507; Sun, 18 Jan 2009 00:23:53 +0100 (CET) Reply-To: From: "Vincent Cheng" Subject: [SPAM] FROM: (MR. V. H. C CHENG). Date: Sun, 18 Jan 2009 00:24:27 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090117232353.EC731595507@smtp-out5.iol.cz> To: undisclosed-recipients:; X-Greylist: Delayed for 01:17:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 17 Jan 2009 16:42:14 -0800 (PST) X-Spam-Prev-Subject: FROM: (MR. V. H. C CHENG). Status: R X-Status: X-Keywords: X-UID: 32 Content-Length: 1227 FROM: MR. V. H. C CHENG. Good Day, I am Mr. Vincent Hoi Chuen Cheng, GBS, Chairman of the Hong Kong and Shanghai Banking Corporation Limited. I have a business transaction that i want you to handle with me from my bank regarding a fund transfer of my late client. Gen. Zaiki Taha Abdel, a businessman and who was also with the Iraqi forces made a fixed deposit of Thirty million Five Hundred Thousand United State Dollars only in my branch. I have all the information needed to claim these funds and I want you to act as the beneficiary of the deposit. there is no risk involved in this matter, as we are going to adopt a legitimate method and an attorney will prepare all the necessary documents. All I require is your honest co-operation and I guarantee that this will be executed under a legitimate arrangement that will protect us from any breach of the law. If you are interested i await your urgent response to this email, Please accept my apologies and keep my confidence and disregard this email if you do not appreciate this proposition I have offered you. Your earliest response to this letter will be appreciated via my private Email below. Best Regard. Mr. Vincent Cheng. Email: vincent.chengch1@yahoo.com.hk From shell8130@iol.cz Sun Jan 18 21:00:18 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FORGED_RCVD_HELO,HTML_00_10,HTML_MESSAGE, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLIONS_01,PHISH_05, RCVD_IN_BL_SPAMCOP_NET,SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS, UNDISC_RECIPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.8 HTML_00_10 BODY: Message is 0% to 10% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from smtp-out1.iol.cz (smtp-out1.iol.cz [194.228.2.86]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0J50AbP011614 for ; Sun, 18 Jan 2009 21:00:14 -0800 Received: from iol.cz (unknown [194.228.2.126]) by smtp-out1.iol.cz (Postfix) with ESMTP id 2B22810BE3A; Mon, 19 Jan 2009 04:26:51 +0100 (CET) Received: from [192.168.30.65] (Forwarded-For: 41.220.75.3, [212.116.219.81]) by sxiolpkg.ux.to2cz.cz (mshttpd); Mon, 19 Jan 2009 03:26:51 GMT From: shell Reply-To: s.lile90@yahoo.com.hk Message-ID: Date: Mon, 19 Jan 2009 03:26:51 GMT X-Mailer: Sun Java(tm) System Messenger Express 6.2-7.04 (built Aug 17 2006) MIME-Version: 1.0 Content-Language: cs Subject: [SPAM] BUSINESS PROPOSITION X-Accept-Language: cs Priority: normal Content-Type: multipart/alternative; boundary="--2960a60df8958f34405" To: undisclosed-recipients:; X-Greylist: Delayed for 00:38:52 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 18 Jan 2009 21:00:15 -0800 (PST) X-Spam-Prev-Subject: BUSINESS PROPOSITION Status: R X-Status: X-Keywords: X-UID: 33 Content-Length: 7174 This is a multi-part message in MIME format. ----2960a60df8958f34405 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: 7bit Good Day, It is understandable that you might be a little bit apprehensive because you do not know me but I have a lucrative business proposal of mutual interest to share with you.Let me start by introducing myself again.I am MR. SONG LI LE I work with the Hang Seng Bank Ltd.Before the U.S and Iraqi war our client Colonel Sadiq Uday who was with the Iraqi forces and also businessman, made a numbered fixed deposit for 18 calendar months, with a value of Nineteen millions Five Hundred Thousand United State Dollars only in my branch.Upon maturity several notices was sent to him, even during the war which began in 2003. Again after the war another notification was sent and still no response came from him. We later found out that the Colonel along with his wife and only daughter had been killed during the war in a bomb blast that hit their home. After further investigation it was also discovered that Colonel Sadiq Uday did not declare any next of kin in his official papers including the paper work of his bank deposit. And he also confided in me the last time he was at my office that no one except me knew of his deposit in my bank. So, Nineteen millions Five Hundred Thousand United State Dollars is still lying in my bank and no one will ever come forward to claim it. What bothers me most is that according to the laws of my country at the expiration 5 years the funds will revert to the ownership of the Hong Kong Government if nobody applies to claim the funds. Against this backdrop, my suggestion to you is that I will like you as a foreigner to stand as the next of kin to Colonel Sadiq Uday so that you will be able to receive his funds. MODALITIES: I want you to know that I have had everything planned out so that we shall come out successful. I have an attorney that will prepare the necessary document that will back you up as the next of kin to Colonel Sadiq Uday, all that is required from you at this stage is for you to provide me with your Full Names and Address so that the attorney can commence his job. After you have been made the next of kin, the attorney will also fill in for claims on your behalf and secure the necessary approval and of probate in your favour for the move of the funds to an account that will be provided by you.There is no risk involved at all in this matter, as we are going to adopt a legalized method and the attorney will prepare all the necessary documents. Please endeavor to observe utmost discretion in all matters concerning this issue. Once the funds have been transferred to your nominated bank account we shall then share in the ratio of 70% for me, 30% for you. Should you be interested you can reach me on my private email: {s.lile90@yahoo.com.hk} please send me your, 1,Full names, 2,private phone number, 3,Occupation 4,current residential address, And finally after that I shall provide you with more details of this operation. Your earliest response to this letter will be appreciated. Kind Regards, Mr Song Lile ----2960a60df8958f34405 Content-Type: text/html; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable =3CDIV=3E=3C/DIV=3E=3CBR=3E=3CBR=3EGood Day=2C = =3Cbr=3E =3Cbr=3EIt is understandable that you might be a little bit apprehensive= because you do not know me but I have a lucrative business = =3Cbr=3E =3Cbr=3Eproposal of mutual interest to share with you=2ELet me start by = introducing myself again=2EI am MR=2E SONG LI LE I work with the = =3Cbr=3E =3Cbr=3EHang Seng Bank Ltd=2EBefore the U=2ES and Iraqi war our client C= olonel Sadiq Uday who was with the Iraqi forces and also = =3Cbr=3E =3Cbr=3Ebusinessman=2C made a numbered fixed deposit for 18 calendar mon= ths=2C with a value of Nineteen millions Five Hundred Thousand = =3Cbr=3E =3Cbr=3EUnited State Dollars only in my branch=2EUpon maturity several n= otices was sent to him=2C even during the war which began in = =3Cbr=3E =3Cbr=3E2003=2E Again after the war another notification was sent and st= ill no response came from him=2E We later found out that the = =3Cbr=3E =3Cbr=3EColonel along with his wife and only daughter had been killed du= ring the war in a bomb blast that hit their home=2E = =3Cbr=3E =3Cbr=3EAfter further investigation it was also discovered that Colonel = Sadiq Uday did not declare any next of kin in his official = =3Cbr=3E =3Cbr=3Epapers including the paper work of his bank deposit=2E And he al= so confided in me the last time he was at my office that no one = =3Cbr=3E =3Cbr=3Eexcept me knew of his deposit in my bank=2E So=2C Nineteen milli= ons Five Hundred Thousand United State Dollars is still lying in = =3Cbr=3E =3Cbr=3Emy bank and no one will ever come forward to claim it=2E What bo= thers me most is that according to the laws of my country at = =3Cbr=3E =3Cbr=3Ethe expiration 5 years the funds will revert to the ownership of= the Hong Kong Government if nobody applies to claim the = =3Cbr=3E =3Cbr=3Efunds=2E Against this backdrop=2C my suggestion to you is that I= will like you as a foreigner to stand as the next of kin to = =3Cbr=3E =3Cbr=3EColonel Sadiq Uday so that you will be able to receive his funds= =2E = =3Cbr=3E =3Cbr=3EMODALITIES=3A = =3Cbr=3E =3Cbr=3EI want you to know that I have had everything planned out so tha= t we shall come out successful=2E I have an attorney that will = =3Cbr=3E =3Cbr=3Eprepare the necessary document that will back you up as the next= of kin to Colonel Sadiq Uday=2C all that is required from you = =3Cbr=3E =3Cbr=3Eat this stage is for you to provide me with your Full Names and = Address so that the attorney can commence his job=2E After you = =3Cbr=3E =3Cbr=3Ehave been made the next of kin=2C the attorney will also fill in= for claims on your behalf and secure the necessary approval = =3Cbr=3E =3Cbr=3Eand of probate in your favour for the move of the funds to an ac= count that will be provided by you=2EThere is no risk involved = =3Cbr=3E =3Cbr=3Eat all in this matter=2C as we are going to adopt a legalized me= thod and the attorney will prepare all the necessary documents=2E = =3Cbr=3E =3Cbr=3EPlease endeavor to observe utmost discretion in all matters conc= erning this issue=2E Once the funds have been transferred to = =3Cbr=3E =3Cbr=3Eyour nominated bank account we shall then share in the ratio of = 70=25 for me=2C 30=25 for you=2E = =3Cbr=3E =3Cbr=3EShould you be interested you can reach me on my private email=3A= =7Bs=2Elile90=40yahoo=2Ecom=2Ehk=7D please send me your=2C = =3Cbr=3E =3Cbr=3E1=2CFull names=2C = =3Cbr=3E2=2Cprivate phone number=2C = =3Cbr=3E3=2COccupation = =3Cbr=3E4=2Ccurrent residential address=2C = =3Cbr=3E =3Cbr=3EAnd finally after that I shall provide you with more details of = this operation=2E = =3Cbr=3EYour earliest response to this letter will be appreciated=2E = =3Cbr=3E =3Cbr=3EKind Regards=2C = =3Cbr=3EMr Song Lile=3C/BR=3E=3C/BR=3E ----2960a60df8958f34405-- From richardsclark3@sify.com Sun Jan 18 21:46:17 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************************** X-Spam-Status: Yes, score=46.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_SOMETHING,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, MILLIONS_01,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_FREE_WEBM_ZCom01, SPAMMY_HEADER_10,STOX_30,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.6 SARE_FREE_WEBM_ZCom01 Sender used free email account - may be * spammer * 0.3 SPAMMY_HEADER_10 Found a X-Virus-Status header * 0.5 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail-in-08.arcor-online.net (mail-in-08.arcor-online.net [151.189.21.48]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0J5kBtT012921 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Sun, 18 Jan 2009 21:46:16 -0800 Received: from mail-in-14-z2.arcor-online.net (mail-in-14-z2.arcor-online.net [151.189.8.31]) by mail-in-08.arcor-online.net (Postfix) with ESMTP id 10B2127BC1E; Mon, 19 Jan 2009 06:46:09 +0100 (CET) Received: from mail-in-06.arcor-online.net (mail-in-06.arcor-online.net [151.189.21.46]) by mail-in-14-z2.arcor-online.net (Postfix) with ESMTP id ED66A100C0; Mon, 19 Jan 2009 06:46:08 +0100 (CET) Received: from User (unknown [216.118.254.83]) (Authenticated sender: mrscroner04@arcor.de) by mail-in-06.arcor-online.net (Postfix) with ESMTP id 4AF5B35E696; Mon, 19 Jan 2009 06:44:41 +0100 (CET) Reply-To: From: "Richards Clark" Subject: [SPAM] Re: I am eager to read from you Date: Sun, 18 Jan 2009 21:45:03 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 Message-Id: <20090119054506.4AF5B35E696@mail-in-06.arcor-online.net> To: undisclosed-recipients:; X-Virus-Scanned: ClamAV 0.94.1/8875/Mon Jan 19 01:02:33 2009 on mail-in-06.arcor-online.net X-Virus-Status: Clean X-Spam-Prev-Subject: Re: I am eager to read from you Status: R X-Status: X-Keywords: X-UID: 34 Content-Length: 2541 Dear Sir Greetings with good faith. I am Barrister Richards Clark, a solicitor at law. I am the personal attorney to Mr. Mack (CEO) a national of your country, who used to work with Shell Petroleum Development Company (SPDC) in Nigeria. Here in after shall be referred to as my client. On Sunday, 2 February, 2003, my client, his wife and their three children were involved in Ikeja bomb blast here in my country. My client and his family unfortunately lost their lives. Since then I have made several enquiries to your embassy to locate any of my clients extended relatives but all to no avail. After these several unsuccessful attempts, I decided to track his last name over the Internet, to locate any member of his family hence I contacted you. I have contacted you to assist in repatriating the money and property left behind by my client before they get confiscated or declared unserviceable by the bank where these huge deposits were lodged. Particularly, the finance company where the deceased had an account valued at about USD$30.95 million dollars has issued me a notice to provide the next of kin or have the account confiscated within the next few weeks. Since I have been unsuccessful in locating the relatives for over two years now. I seek your consent to present you as the next of kin of the deceased since you have the same last name so that the proceeds of this account valued at USD30.95 million dollars can be paid to you and then you and I can share the money in the following ration: 50% to me and 40% to you. I have all necessary legal documents that can be used to back up any claim we may make. I have worked out the modalities of this transaction. All I require is your sincere cooperation to enable us seeing this deal through. I guarantee that this will be executed under a legitimate arrangement that will protect you from any breach of the law. Please if you are interested to work with me with good faith and honesty, All you have to do is to send me Your company name and address if any, Your telephone and fax numbers which I will use to process and procure all the legal papers/documents that backs you up as the true next of kin to my client and I will submit it to the Finance house for proper Claim of the fund. I hope to hear further response from you regards the successful conclusion of this great success. God bless you. Please view these websites below to confirm what I am telling you. http://news.bbc.co.uk/1/hi/world/africa/2718295.stm Respectfully, Barrister Richards Clark. From shell8130@iol.cz Sun Jan 18 22:13:47 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FORGED_RCVD_HELO,HTML_00_10,HTML_MESSAGE, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLIONS_01,PHISH_05, SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS,UNDISC_RECIPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.8 HTML_00_10 BODY: Message is 0% to 10% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from smtp-out1.iol.cz (smtp-out1.iol.cz [194.228.2.86]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0J6DebG013595 for ; Sun, 18 Jan 2009 22:13:45 -0800 Received: from iol.cz (unknown [194.228.2.126]) by smtp-out1.iol.cz (Postfix) with ESMTP id C9DE110BE6D; Mon, 19 Jan 2009 04:38:44 +0100 (CET) Received: from [192.168.30.65] (Forwarded-For: 41.220.75.3, [212.116.219.81]) by sxiolpkg.ux.to2cz.cz (mshttpd); Mon, 19 Jan 2009 03:38:44 GMT From: shell Reply-To: s.lile90@yahoo.com.hk Message-ID: Date: Mon, 19 Jan 2009 03:38:44 GMT X-Mailer: Sun Java(tm) System Messenger Express 6.2-7.04 (built Aug 17 2006) MIME-Version: 1.0 Content-Language: cs Subject: [SPAM] BUSINESS PROPOSITION X-Accept-Language: cs Priority: normal Content-Type: multipart/alternative; boundary="--27467eef2bef7cd270f3" To: undisclosed-recipients:; X-Spam-Prev-Subject: BUSINESS PROPOSITION Status: R X-Status: X-Keywords: X-UID: 35 Content-Length: 7177 This is a multi-part message in MIME format. ----27467eef2bef7cd270f3 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: 7bit Good Day, It is understandable that you might be a little bit apprehensive because you do not know me but I have a lucrative business proposal of mutual interest to share with you.Let me start by introducing myself again.I am MR. SONG LI LE I work with the Hang Seng Bank Ltd.Before the U.S and Iraqi war our client Colonel Sadiq Uday who was with the Iraqi forces and also businessman, made a numbered fixed deposit for 18 calendar months, with a value of Nineteen millions Five Hundred Thousand United State Dollars only in my branch.Upon maturity several notices was sent to him, even during the war which began in 2003. Again after the war another notification was sent and still no response came from him. We later found out that the Colonel along with his wife and only daughter had been killed during the war in a bomb blast that hit their home. After further investigation it was also discovered that Colonel Sadiq Uday did not declare any next of kin in his official papers including the paper work of his bank deposit. And he also confided in me the last time he was at my office that no one except me knew of his deposit in my bank. So, Nineteen millions Five Hundred Thousand United State Dollars is still lying in my bank and no one will ever come forward to claim it. What bothers me most is that according to the laws of my country at the expiration 5 years the funds will revert to the ownership of the Hong Kong Government if nobody applies to claim the funds. Against this backdrop, my suggestion to you is that I will like you as a foreigner to stand as the next of kin to Colonel Sadiq Uday so that you will be able to receive his funds. MODALITIES: I want you to know that I have had everything planned out so that we shall come out successful. I have an attorney that will prepare the necessary document that will back you up as the next of kin to Colonel Sadiq Uday, all that is required from you at this stage is for you to provide me with your Full Names and Address so that the attorney can commence his job. After you have been made the next of kin, the attorney will also fill in for claims on your behalf and secure the necessary approval and of probate in your favour for the move of the funds to an account that will be provided by you.There is no risk involved at all in this matter, as we are going to adopt a legalized method and the attorney will prepare all the necessary documents. Please endeavor to observe utmost discretion in all matters concerning this issue. Once the funds have been transferred to your nominated bank account we shall then share in the ratio of 70% for me, 30% for you. Should you be interested you can reach me on my private email: {s.lile90@yahoo.com.hk} please send me your, 1,Full names, 2,private phone number, 3,Occupation 4,current residential address, And finally after that I shall provide you with more details of this operation. Your earliest response to this letter will be appreciated. Kind Regards, Mr Song Lile ----27467eef2bef7cd270f3 Content-Type: text/html; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable =3CDIV=3E=3C/DIV=3E=3CBR=3E=3CBR=3EGood Day=2C = =3Cbr=3E =3Cbr=3EIt is understandable that you might be a little bit apprehensive= because you do not know me but I have a lucrative business = =3Cbr=3E =3Cbr=3Eproposal of mutual interest to share with you=2ELet me start by = introducing myself again=2EI am MR=2E SONG LI LE I work with the = =3Cbr=3E =3Cbr=3EHang Seng Bank Ltd=2EBefore the U=2ES and Iraqi war our client C= olonel Sadiq Uday who was with the Iraqi forces and also = =3Cbr=3E =3Cbr=3Ebusinessman=2C made a numbered fixed deposit for 18 calendar mon= ths=2C with a value of Nineteen millions Five Hundred Thousand = =3Cbr=3E =3Cbr=3EUnited State Dollars only in my branch=2EUpon maturity several n= otices was sent to him=2C even during the war which began in = =3Cbr=3E =3Cbr=3E2003=2E Again after the war another notification was sent and st= ill no response came from him=2E We later found out that the = =3Cbr=3E =3Cbr=3EColonel along with his wife and only daughter had been killed du= ring the war in a bomb blast that hit their home=2E = =3Cbr=3E =3Cbr=3EAfter further investigation it was also discovered that Colonel = Sadiq Uday did not declare any next of kin in his official = =3Cbr=3E =3Cbr=3Epapers including the paper work of his bank deposit=2E And he al= so confided in me the last time he was at my office that no one = =3Cbr=3E =3Cbr=3Eexcept me knew of his deposit in my bank=2E So=2C Nineteen milli= ons Five Hundred Thousand United State Dollars is still lying in = =3Cbr=3E =3Cbr=3Emy bank and no one will ever come forward to claim it=2E What bo= thers me most is that according to the laws of my country at = =3Cbr=3E =3Cbr=3Ethe expiration 5 years the funds will revert to the ownership of= the Hong Kong Government if nobody applies to claim the = =3Cbr=3E =3Cbr=3Efunds=2E Against this backdrop=2C my suggestion to you is that I= will like you as a foreigner to stand as the next of kin to = =3Cbr=3E =3Cbr=3EColonel Sadiq Uday so that you will be able to receive his funds= =2E = =3Cbr=3E =3Cbr=3EMODALITIES=3A = =3Cbr=3E =3Cbr=3EI want you to know that I have had everything planned out so tha= t we shall come out successful=2E I have an attorney that will = =3Cbr=3E =3Cbr=3Eprepare the necessary document that will back you up as the next= of kin to Colonel Sadiq Uday=2C all that is required from you = =3Cbr=3E =3Cbr=3Eat this stage is for you to provide me with your Full Names and = Address so that the attorney can commence his job=2E After you = =3Cbr=3E =3Cbr=3Ehave been made the next of kin=2C the attorney will also fill in= for claims on your behalf and secure the necessary approval = =3Cbr=3E =3Cbr=3Eand of probate in your favour for the move of the funds to an ac= count that will be provided by you=2EThere is no risk involved = =3Cbr=3E =3Cbr=3Eat all in this matter=2C as we are going to adopt a legalized me= thod and the attorney will prepare all the necessary documents=2E = =3Cbr=3E =3Cbr=3EPlease endeavor to observe utmost discretion in all matters conc= erning this issue=2E Once the funds have been transferred to = =3Cbr=3E =3Cbr=3Eyour nominated bank account we shall then share in the ratio of = 70=25 for me=2C 30=25 for you=2E = =3Cbr=3E =3Cbr=3EShould you be interested you can reach me on my private email=3A= =7Bs=2Elile90=40yahoo=2Ecom=2Ehk=7D please send me your=2C = =3Cbr=3E =3Cbr=3E1=2CFull names=2C = =3Cbr=3E2=2Cprivate phone number=2C = =3Cbr=3E3=2COccupation = =3Cbr=3E4=2Ccurrent residential address=2C = =3Cbr=3E =3Cbr=3EAnd finally after that I shall provide you with more details of = this operation=2E = =3Cbr=3EYour earliest response to this letter will be appreciated=2E = =3Cbr=3E =3Cbr=3EKind Regards=2C = =3Cbr=3EMr Song Lile=3C/BR=3E=3C/BR=3E ----27467eef2bef7cd270f3-- From shell8130@iol.cz Mon Jan 19 00:12:34 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FORGED_RCVD_HELO,HTML_00_10,HTML_MESSAGE, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLIONS_01,PHISH_05, RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,SARE_FRAUD_X3,SARE_FRAUD_X4, SUBJ_ALL_CAPS,UNDISC_RECIPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.8 HTML_00_10 BODY: Message is 0% to 10% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [194.228.2.126 listed in zen.spamhaus.org] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from smtp-out2.iol.cz (smtp-out2.iol.cz [194.228.2.87]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0J8CUZn016556 for ; Mon, 19 Jan 2009 00:12:34 -0800 Received: from iol.cz (unknown [194.228.2.126]) by smtp-out2.iol.cz (Postfix) with ESMTP id 56E0093CD5; Mon, 19 Jan 2009 04:34:12 +0100 (CET) Received: from [192.168.30.65] (Forwarded-For: 41.220.75.3, [212.116.219.81]) by sxiolpkg.ux.to2cz.cz (mshttpd); Mon, 19 Jan 2009 03:34:12 GMT From: shell Reply-To: s.lile90@yahoo.com.hk Message-ID: Date: Mon, 19 Jan 2009 03:34:12 GMT X-Mailer: Sun Java(tm) System Messenger Express 6.2-7.04 (built Aug 17 2006) MIME-Version: 1.0 Content-Language: cs Subject: [SPAM] BUSINESS PROPOSITION X-Accept-Language: cs Priority: normal Content-Type: multipart/alternative; boundary="--297e8b31605d2d4c7dc0" To: undisclosed-recipients:; X-Greylist: Delayed for 03:34:23 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 19 Jan 2009 00:12:34 -0800 (PST) X-Spam-Prev-Subject: BUSINESS PROPOSITION Status: R X-Status: X-Keywords: X-UID: 36 Content-Length: 7177 This is a multi-part message in MIME format. ----297e8b31605d2d4c7dc0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: 7bit Good Day, It is understandable that you might be a little bit apprehensive because you do not know me but I have a lucrative business proposal of mutual interest to share with you.Let me start by introducing myself again.I am MR. SONG LI LE I work with the Hang Seng Bank Ltd.Before the U.S and Iraqi war our client Colonel Sadiq Uday who was with the Iraqi forces and also businessman, made a numbered fixed deposit for 18 calendar months, with a value of Nineteen millions Five Hundred Thousand United State Dollars only in my branch.Upon maturity several notices was sent to him, even during the war which began in 2003. Again after the war another notification was sent and still no response came from him. We later found out that the Colonel along with his wife and only daughter had been killed during the war in a bomb blast that hit their home. After further investigation it was also discovered that Colonel Sadiq Uday did not declare any next of kin in his official papers including the paper work of his bank deposit. And he also confided in me the last time he was at my office that no one except me knew of his deposit in my bank. So, Nineteen millions Five Hundred Thousand United State Dollars is still lying in my bank and no one will ever come forward to claim it. What bothers me most is that according to the laws of my country at the expiration 5 years the funds will revert to the ownership of the Hong Kong Government if nobody applies to claim the funds. Against this backdrop, my suggestion to you is that I will like you as a foreigner to stand as the next of kin to Colonel Sadiq Uday so that you will be able to receive his funds. MODALITIES: I want you to know that I have had everything planned out so that we shall come out successful. I have an attorney that will prepare the necessary document that will back you up as the next of kin to Colonel Sadiq Uday, all that is required from you at this stage is for you to provide me with your Full Names and Address so that the attorney can commence his job. After you have been made the next of kin, the attorney will also fill in for claims on your behalf and secure the necessary approval and of probate in your favour for the move of the funds to an account that will be provided by you.There is no risk involved at all in this matter, as we are going to adopt a legalized method and the attorney will prepare all the necessary documents. Please endeavor to observe utmost discretion in all matters concerning this issue. Once the funds have been transferred to your nominated bank account we shall then share in the ratio of 70% for me, 30% for you. Should you be interested you can reach me on my private email: {s.lile90@yahoo.com.hk} please send me your, 1,Full names, 2,private phone number, 3,Occupation 4,current residential address, And finally after that I shall provide you with more details of this operation. Your earliest response to this letter will be appreciated. Kind Regards, Mr Song Lile ----297e8b31605d2d4c7dc0 Content-Type: text/html; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable =3CDIV=3E=3C/DIV=3E=3CBR=3E=3CBR=3EGood Day=2C = =3Cbr=3E =3Cbr=3EIt is understandable that you might be a little bit apprehensive= because you do not know me but I have a lucrative business = =3Cbr=3E =3Cbr=3Eproposal of mutual interest to share with you=2ELet me start by = introducing myself again=2EI am MR=2E SONG LI LE I work with the = =3Cbr=3E =3Cbr=3EHang Seng Bank Ltd=2EBefore the U=2ES and Iraqi war our client C= olonel Sadiq Uday who was with the Iraqi forces and also = =3Cbr=3E =3Cbr=3Ebusinessman=2C made a numbered fixed deposit for 18 calendar mon= ths=2C with a value of Nineteen millions Five Hundred Thousand = =3Cbr=3E =3Cbr=3EUnited State Dollars only in my branch=2EUpon maturity several n= otices was sent to him=2C even during the war which began in = =3Cbr=3E =3Cbr=3E2003=2E Again after the war another notification was sent and st= ill no response came from him=2E We later found out that the = =3Cbr=3E =3Cbr=3EColonel along with his wife and only daughter had been killed du= ring the war in a bomb blast that hit their home=2E = =3Cbr=3E =3Cbr=3EAfter further investigation it was also discovered that Colonel = Sadiq Uday did not declare any next of kin in his official = =3Cbr=3E =3Cbr=3Epapers including the paper work of his bank deposit=2E And he al= so confided in me the last time he was at my office that no one = =3Cbr=3E =3Cbr=3Eexcept me knew of his deposit in my bank=2E So=2C Nineteen milli= ons Five Hundred Thousand United State Dollars is still lying in = =3Cbr=3E =3Cbr=3Emy bank and no one will ever come forward to claim it=2E What bo= thers me most is that according to the laws of my country at = =3Cbr=3E =3Cbr=3Ethe expiration 5 years the funds will revert to the ownership of= the Hong Kong Government if nobody applies to claim the = =3Cbr=3E =3Cbr=3Efunds=2E Against this backdrop=2C my suggestion to you is that I= will like you as a foreigner to stand as the next of kin to = =3Cbr=3E =3Cbr=3EColonel Sadiq Uday so that you will be able to receive his funds= =2E = =3Cbr=3E =3Cbr=3EMODALITIES=3A = =3Cbr=3E =3Cbr=3EI want you to know that I have had everything planned out so tha= t we shall come out successful=2E I have an attorney that will = =3Cbr=3E =3Cbr=3Eprepare the necessary document that will back you up as the next= of kin to Colonel Sadiq Uday=2C all that is required from you = =3Cbr=3E =3Cbr=3Eat this stage is for you to provide me with your Full Names and = Address so that the attorney can commence his job=2E After you = =3Cbr=3E =3Cbr=3Ehave been made the next of kin=2C the attorney will also fill in= for claims on your behalf and secure the necessary approval = =3Cbr=3E =3Cbr=3Eand of probate in your favour for the move of the funds to an ac= count that will be provided by you=2EThere is no risk involved = =3Cbr=3E =3Cbr=3Eat all in this matter=2C as we are going to adopt a legalized me= thod and the attorney will prepare all the necessary documents=2E = =3Cbr=3E =3Cbr=3EPlease endeavor to observe utmost discretion in all matters conc= erning this issue=2E Once the funds have been transferred to = =3Cbr=3E =3Cbr=3Eyour nominated bank account we shall then share in the ratio of = 70=25 for me=2C 30=25 for you=2E = =3Cbr=3E =3Cbr=3EShould you be interested you can reach me on my private email=3A= =7Bs=2Elile90=40yahoo=2Ecom=2Ehk=7D please send me your=2C = =3Cbr=3E =3Cbr=3E1=2CFull names=2C = =3Cbr=3E2=2Cprivate phone number=2C = =3Cbr=3E3=2COccupation = =3Cbr=3E4=2Ccurrent residential address=2C = =3Cbr=3E =3Cbr=3EAnd finally after that I shall provide you with more details of = this operation=2E = =3Cbr=3EYour earliest response to this letter will be appreciated=2E = =3Cbr=3E =3Cbr=3EKind Regards=2C = =3Cbr=3EMr Song Lile=3C/BR=3E=3C/BR=3E ----297e8b31605d2d4c7dc0-- From info@claims.com Mon Jan 19 10:40:31 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.3 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_TW_1,BL_COUNTRY_TW_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_63,LOTTO_GRANT, LOTTO_YOU_WIN_04,MILLIONS_01,RBL_PSBL_01,SARE_FRAUD_X3,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 LOTTO_YOU_WIN_04 BODY: Won a prize * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 1.0 LOTTO_GRANT BODY: Donation/grant/etc. * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [163.20.173.6 listed in tw.countries.nerd.dk] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [163.20.173.6 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from stud.fhjh.tpc.edu.tw (stud.fhjh.tpc.edu.tw [163.20.173.6]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0JIeOcH001189 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 19 Jan 2009 10:40:30 -0800 Received: from stud.fhjh.tpc.edu.tw (stud.fhjh.tpc.edu.tw [127.0.0.1]) by stud.fhjh.tpc.edu.tw (8.12.11/8.12.11) with ESMTP id n0JGgGOW016757; Tue, 20 Jan 2009 00:42:17 +0800 From: "OFFICE OF THE SENATE HOUSE" Reply-To: claimsdpt007@gmail.com Subject: [SPAM] N/A Date: Tue, 20 Jan 2009 00:42:16 +0800 Message-Id: <20090119164047.M22917@claims.com> X-Mailer: Open WebMail 2.40 20040816 X-OriginatingIP: 81.199.88.122 (s952205) MIME-Version: 1.0 Content-Type: text/plain; charset=big5 X-Greylist: Delayed for 01:03:05 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 19 Jan 2009 10:40:31 -0800 (PST) X-Spam-Prev-Subject: N/A Status: R X-Status: X-Keywords: X-UID: 37 Content-Length: 1348 OFFICE OF THE SENATE HOUSE FEDERAL REPUBLIC OF NIGERIA COMMITTEE ON FOREIGN PAYMENT (RESOLUTION PANEL ON CONTRACT PAYMENT) IKOYI-LAGOS NIGERIA Our Ref: FGN /SNT/STB Your Ref. Dear Beneficiary. Congratulations as we bring to your notice,The Office of the senate house of Assembly has chosen you by the board of trustees as one of the final recipients of this fiscal year 2009 promotion cash grant/Donation. To celebrate the 9th anniversary celebration,We are giving out a yearly donation of The ATM Card Value is $US750,000.00 (Seven Hundred And Fithy Thousand United States Dollars) to 5 lucky recipients, as Year 2009 promotion from the W.H.O,UN, and the EU in accordance with the enabling act of Parliament. To file for your claim you are to fill out below information and send it to the Payment Remitance Office Via their email contact address bellow Full Name...... Residential Address...... Occupation......... Country....Telephone.... Fax Number........... Sex.............. Age............ IDENTITY CARD IF ANY. Payment Remittance Contact Winning Batch No:W-342-8876,U-500-32) Mr.Jerry Martins. E-mail:claimsdpt007@gmail.com Tel: +234-806-490-1955 ALSO FOR YOUR INFORMATION,YOU HAVE TO STOP ANY FURTHER COMMUNICATION WITH ANY OTHER PERSON(S) OR OFFICE(S) TO AVOID ANY HITCHES IN RECEIVING YOUR PAYMENT. FOR ORAL DISCUSSION. From retired@sender.com Tue Jan 20 04:05:58 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK, J_CHICKENPOX_34,SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS,TO_CC_NONE,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from proxy3.bredband.net (proxy3.bredband.net [195.54.101.73]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0KC5rKR028931 for ; Tue, 20 Jan 2009 04:05:56 -0800 Received: from ironport.bredband.com (195.54.101.120) by proxy3.bredband.net (7.3.127) id 492A9CFF0133AAD4 for jhardin@impsec.org; Tue, 20 Jan 2009 12:45:44 +0100 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ArD1AFtIdUnUZPrYPGdsb2JhbACMTi2Fb4ERAQEBARZG X-IronPort-AV: E=Sophos;i="4.37,295,1231110000"; d="scan'208";a="475793399" Received: from magnesium.onspeed.com (HELO User) ([212.100.250.216]) by ironport1.bredband.com with ESMTP; 20 Jan 2009 12:44:38 +0100 Received: from mtnngprs.com (pguac7fd@mtnngprs.com [41.220.75.3]) by magnesium.onspeed.com (SlipStream SP Server 6.0.19 built 2007/11/22 15:27:31 -0500 (EST)); Tue, 20 Jan 2009 11:45:44 +0000 (GMT) X-Originating-IP: [41.220.75.3] X-Originating-User: [pguac7fd] Message-ID: Reply-To: From: "Lt General Richard Johnson (Rtd)" Subject: [SPAM] RE:CONFIDENTIAL DIPLOMATIC MOVEMENT OF US$11,000,000.00 Date: Tue, 20 Jan 2009 03:45:41 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:20:05 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 20 Jan 2009 04:05:57 -0800 (PST) X-Spam-Prev-Subject: RE:CONFIDENTIAL DIPLOMATIC MOVEMENT OF US$11,000,000.00 Status: R X-Status: X-Keywords: X-UID: 38 Content-Length: 2127 THE PRESIDENCY FEDERAL REPUBLIC OF NIGERIA Aso Rock villa, Asokoro District, Abuja RE:CONFIDENTIAL DIPLOMATIC MOVEMENT OF US$11,000,000.00 Hello , I am Lt General Richard Johnson (Rtd), National Security Adviser to the new Nigerian President Umaru Musa Yar'Adua. I am delighted to inform you that . However, I wish to bring to your notice that I was been able to move the sum of US$11,000,000.00 and I want you to help me receive this funds in your country and invest it in your country and I have decided to share this US$11,000,000.00 40% to you and 60% to me. This US$11,000,000.00 will be send by Professional Diplomat. Note: The money is coming on 1 Security Proof Box. The box are sealed with Synthetic Nylon Seal and Padded with Machine. Please you don't have to worry for anything, as the transaction is 100% risk free. The box is coming with a Professional Diplomatic Agent who will accompany the box to your . All you need to do now is to send to me your full house address and your identity such as, international passport or drivers license number and other information as below, The Diplomatic will travel with it. He will call you immediately he arrives yo Please kindly get back to me today also with the requested information's so that we can proceed on this matter as soon as possible. 1) Your full names. 2) Phone #. 3) mobile #. 4) fax #. 5) Company name, position and address. 6) Profession, age and marital status. Note: The diplomat does will not know the contents of the box. What l will declare to him is Sensitive Photographic Film Materials for security reasons. I will not declare money to them . If they call you and ask you the content please tell them the same thing Ok. Email me and I will let you know how far I have gone with the arrangement. Confirm the receipt of this message and send the requirements to me immediately you receive this message. Please I need urgent reply because the box are schedule to live as soon as we hear from you. Best Regards, Lt General Richard Johnson (Rtd). National Security Adviser to the President Federal Republic of Nigeria From chineudha111@yahoo.com.hk Tue Jan 20 10:16:25 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************ X-Spam-Status: Yes, score=36.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FORGED_RCVD_HELO,FREEMAIL_FROM, HTML_10_20,HTML_MESSAGE,HTML_TITLE_EMPTY,JM_SOUGHT_FRAUD_2,J_CHICKENPOX_42, J_CHICKENPOX_52,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,MIME_HTML_ONLY, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, SUBJ_ALL_CAPS,TO_CC_NONE,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [70.88.17.82 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.whitfieldoil.com (70-88-17-82-chattanooga-tn.hfc.comcastbusiness.net [70.88.17.82] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0KIGG9J007206 for ; Tue, 20 Jan 2009 10:16:25 -0800 Received: from User ([41.202.75.24]) by mail.whitfieldoil.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 20 Jan 2009 13:16:25 -0500 Reply-To: From: "Udha Chine" Subject: [SPAM] URGENT AND CONFIDENTIAL ASSIST Date: Tue, 20 Jan 2009 18:15:59 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 20 Jan 2009 18:16:25.0916 (UTC) FILETIME=[34F6A7C0:01C97B2B] X-Spam-Prev-Subject: URGENT AND CONFIDENTIAL ASSIST Status: R X-Status: X-Keywords: X-UID: 39 Content-Length: 1865
Hello Dear,
How are you and every members of your family we hope fine It is my pleasure to identify with you.I am Chine Udha and My younger brother Joel is 18 years we are from sierra leone but residing in Ivory Coast in Africa. It is my desire to contact you on honesty and sincerity to assist us in transferring the sum ofUS$5.600.000 (FIVE MILLION SIX HUNDRED THOUSAND,UNITED STATES DOLLARS)inherited from my late father Udha Johnson to your country for investment.
 
It is sad to say that he passed away mysteriously in France during one of his business trips broad.Though his sudden death was linked or rather suspected to have been masterminded by our wicked uncle who travelled with him at that time.But God knows the truth,we are motivated to contact you after our prayers, and as we get to know you better, we hope to gradually build trust, relationship and confidence in you as our step parent.So if you can be in position to assist us in any way, we will be glad and willing to offer you 20% of the total sum for your assistance in retrieving the money and effort input after the successful transfer of this money and  investment.
 
Indicate your interest towards assisting us by sending your phone # and address so that we can communicate with you at any time.we need your expected guidance in investing the money in any profitable business investment in your country.If you are willing to assist us, kindly get back to us immediately with your adequate communication.
 
Thanks
Chine and Joel
 
 
 From chineudha111@yahoo.com.hk Tue Jan 20 15:55:18 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************ X-Spam-Status: Yes, score=36.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FORGED_RCVD_HELO,FREEMAIL_FROM, HTML_10_20,HTML_MESSAGE,HTML_TITLE_EMPTY,JM_SOUGHT_FRAUD_2,J_CHICKENPOX_42, J_CHICKENPOX_52,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,MIME_HTML_ONLY, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, SUBJ_ALL_CAPS,TO_CC_NONE,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [70.88.17.82 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.whitfieldoil.com (70-88-17-82-chattanooga-tn.hfc.comcastbusiness.net [70.88.17.82] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0KNtD8s016016 for ; Tue, 20 Jan 2009 15:55:18 -0800 Received: from User ([41.202.91.32]) by mail.whitfieldoil.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 20 Jan 2009 18:55:33 -0500 Reply-To: From: "Udha Chine" Subject: [SPAM] URGENT AND CONFIDENTIAL ASSIST Date: Tue, 20 Jan 2009 23:55:09 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 20 Jan 2009 23:55:33.0753 (UTC) FILETIME=[95382E90:01C97B5A] X-Spam-Prev-Subject: URGENT AND CONFIDENTIAL ASSIST Status: R X-Status: X-Keywords: X-UID: 40 Content-Length: 1865
Hello Dear,
How are you and every members of your family we hope fine It is my pleasure to identify with you.I am Chine Udha and My younger brother Joel is 18 years we are from sierra leone but residing in Ivory Coast in Africa. It is my desire to contact you on honesty and sincerity to assist us in transferring the sum ofUS$5.600.000 (FIVE MILLION SIX HUNDRED THOUSAND,UNITED STATES DOLLARS)inherited from my late father Udha Johnson to your country for investment.
 
It is sad to say that he passed away mysteriously in France during one of his business trips broad.Though his sudden death was linked or rather suspected to have been masterminded by our wicked uncle who travelled with him at that time.But God knows the truth,we are motivated to contact you after our prayers, and as we get to know you better, we hope to gradually build trust, relationship and confidence in you as our step parent.So if you can be in position to assist us in any way, we will be glad and willing to offer you 20% of the total sum for your assistance in retrieving the money and effort input after the successful transfer of this money and  investment.
 
Indicate your interest towards assisting us by sending your phone # and address so that we can communicate with you at any time.we need your expected guidance in investing the money in any profitable business investment in your country.If you are willing to assist us, kindly get back to us immediately with your adequate communication.
 
Thanks
Chine and Joel
 
 
 From messager@sendout.com Tue Jan 20 22:11:20 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK, J_CHICKENPOX_34,RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS,TO_CC_NONE,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.220.75.3 listed in zen.spamhaus.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [195.54.101.72 listed in dnsbl.sorbs.net] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from proxy2.bredband.net (proxy2.bredband.net [195.54.101.72]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0L6BGbM026248 for ; Tue, 20 Jan 2009 22:11:20 -0800 Received: from ironport.bredband.com (195.54.101.120) by proxy2.bredband.net (7.3.127) id 494BF302009ADB80 for jhardin@impsec.org; Wed, 21 Jan 2009 06:51:04 +0100 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AjL2AJdGdknUZPrjPGdsb2JhbACMVS2FXIESAQEBARYSBDA X-IronPort-AV: E=Sophos;i="4.37,298,1231110000"; d="scan'208";a="476095121" Received: from copper.onspeed.com (HELO User) ([212.100.250.227]) by ironport1.bredband.com with ESMTP; 21 Jan 2009 06:50:25 +0100 Received: from mtnngprs.com (jeffmikes@mtnngprs.com [41.220.75.3]) by copper.onspeed.com (SlipStream SP Server 6.0.19 built 2007/11/22 15:27:31 -0500 (EST)); Wed, 21 Jan 2009 05:51:04 +0000 (GMT) X-Originating-IP: [41.220.75.3] X-Originating-User: [jeffmikes] Message-ID: Reply-To: From: "Lt General Richard Johnson (Rtd)" Subject: [SPAM] RE:CONFIDENTIAL DIPLOMATIC MOVEMENT OF US$11,000,000.00 Date: Tue, 20 Jan 2009 21:51:00 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:20:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 20 Jan 2009 22:11:20 -0800 (PST) X-Spam-Prev-Subject: RE:CONFIDENTIAL DIPLOMATIC MOVEMENT OF US$11,000,000.00 Status: R X-Status: X-Keywords: X-UID: 41 Content-Length: 2127 THE PRESIDENCY FEDERAL REPUBLIC OF NIGERIA Aso Rock villa, Asokoro District, Abuja RE:CONFIDENTIAL DIPLOMATIC MOVEMENT OF US$11,000,000.00 Hello , I am Lt General Richard Johnson (Rtd), National Security Adviser to the new Nigerian President Umaru Musa Yar'Adua. I am delighted to inform you that . However, I wish to bring to your notice that I was been able to move the sum of US$11,000,000.00 and I want you to help me receive this funds in your country and invest it in your country and I have decided to share this US$11,000,000.00 40% to you and 60% to me. This US$11,000,000.00 will be send by Professional Diplomat. Note: The money is coming on 1 Security Proof Box. The box are sealed with Synthetic Nylon Seal and Padded with Machine. Please you don't have to worry for anything, as the transaction is 100% risk free. The box is coming with a Professional Diplomatic Agent who will accompany the box to your . All you need to do now is to send to me your full house address and your identity such as, international passport or drivers license number and other information as below, The Diplomatic will travel with it. He will call you immediately he arrives yo Please kindly get back to me today also with the requested information's so that we can proceed on this matter as soon as possible. 1) Your full names. 2) Phone #. 3) mobile #. 4) fax #. 5) Company name, position and address. 6) Profession, age and marital status. Note: The diplomat does will not know the contents of the box. What l will declare to him is Sensitive Photographic Film Materials for security reasons. I will not declare money to them . If they call you and ask you the content please tell them the same thing Ok. Email me and I will let you know how far I have gone with the arrangement. Confirm the receipt of this message and send the requirements to me immediately you receive this message. Please I need urgent reply because the box are schedule to live as soon as we hear from you. Best Regards, Lt General Richard Johnson (Rtd). National Security Adviser to the President Federal Republic of Nigeria From h391v@hotmail.com Wed Jan 21 03:12:40 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********** X-Spam-Status: Yes, score=10.3 required=5.0 tests=ADVANCE_FEE_1,BAYES_50, DEAR_SOMETHING,FREEMAIL_FROM,HTML_10_20,HTML_MESSAGE,J_CHICKENPOX_36,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SPF_PASS, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.6 J_CHICKENPOX_36 BODY: 3alpha-pock-6alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5035] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 63] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 63] * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from col0-omc3-s8.col0.hotmail.com (col0-omc3-s8.col0.hotmail.com [65.55.34.146]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0LBCaWB001672 for ; Wed, 21 Jan 2009 03:12:40 -0800 Received: from COL120-W80 ([65.55.34.135]) by col0-omc3-s8.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 21 Jan 2009 02:56:09 -0800 Message-ID: Content-Type: multipart/alternative; boundary="_2e68c511-43dd-47f8-91a0-61d283b1339f_" X-Originating-IP: [83.229.62.12] From: V B Sender: Subject: [SPAM] Happy New Year Date: Wed, 21 Jan 2009 10:56:09 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 21 Jan 2009 10:56:09.0991 (UTC) FILETIME=[DE422170:01C97BB6] X-Greylist: Delayed for 00:16:24 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 21 Jan 2009 03:12:40 -0800 (PST) X-Spam-Prev-Subject: Happy New Year Status: R X-Status: X-Keywords: X-UID: 42 Content-Length: 2984 --_2e68c511-43dd-47f8-91a0-61d283b1339f_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Dept. of Offshore Mortgage Services=2CFidelity Investment International(Uni= ted-Kingdom)Dear Sir=2CThanks for finding time to read this proposal.After = thinking about this transaction and the need to make contact with someone t= o assist me do it=2C I found it interesting and decided to contact you for = this business transaction.Be so kind to contact me at your earliest conveni= ence for a possible business deal involving money transfer of about $52=2C0= 00=2C000.00.I am working as Investment Manager with Fidelity Investment Int= ernational here in United Kingdom. With your sincere assistant and co-opera= tion=2C I am determined to work this deal out if we can do business.As at t= his moment=2C I am constrained to issue more details about this business un= til your response is received. If you are not familiar with the above infor= mation which I believe is scanty for security purposes=2C please contact me= for further Inquiry.We will start the first transfer with thirty two [$32= =2C000.000 USD] upon successful transaction without any disappointment from= your side=2C we shall re-apply for the payment of the remaining amount to = your account.Regards=2CMr. William Alexander Hayes = --_2e68c511-43dd-47f8-91a0-61d283b1339f_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Dept. of Offshore Mortgage Services=2C
Fidelity Investment Inter= national
(United-Kingdom)
Dear Sir=2C
Thanks for finding time to r= ead this proposal.
After thinking about this transaction and the need to= make contact with someone to assist me do it=2C I found it interesting and= decided to contact you for this business transaction.
Be so kind to con= tact me at your earliest convenience for a possible business deal involving= money transfer of about $52=2C000=2C000.00.
I am working as Investment = Manager with Fidelity Investment International here in United Kingdom. With= your sincere assistant and co-operation=2C I am determined to work this de= al out if we can do business.
As at this moment=2C I am constrained to i= ssue more details about this business until your response is received.
&= nbsp=3BIf you are not familiar with the above information which I believe i= s scanty for security purposes=2C please contact me for further Inquiry.We will start the first transfer with thirty two [$32=2C000.000 USD] upon = successful transaction without any disappointment from your side=2C we shal= l re-apply for the payment of the remaining amount to your account.
Rega= rds=2C
Mr. William Alexander Hayes


= --_2e68c511-43dd-47f8-91a0-61d283b1339f_-- From uli1199@inMail24.com Wed Jan 21 12:12:44 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************* X-Spam-Status: Yes, score=37.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_KR_1,BL_COUNTRY_KR_2, FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_40_50,HTML_MESSAGE,HTML_TITLE_EMPTY,L_SOME_STD_PROBS, MIME_HTML_ONLY,PHISH_05,RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, RCVD_IN_SORBS_WEB,SARE_FREE_WEBM_MailD,SPF_HELO_PASS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.5 SARE_FREE_WEBM_MailD Sender used free email account - may be spammer * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * 0.5 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 HTML_40_50 BODY: Message is 40% to 50% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 0.5 BL_COUNTRY_KR_1 RBL: Mail client in Korea * [211.214.161.140 listed in kr.countries.nerd.dk] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [211.214.161.140 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [193.220.50.10 listed in dnsbl.sorbs.net] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [193.220.50.10 listed in dnsbl.sorbs.net] * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from webpple.com ([211.214.161.140]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0LKCaog016622 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 21 Jan 2009 12:12:43 -0800 Received: from User ([193.220.50.10]) (authenticated bits=0) by webpple.com (8.13.1/8.13.1) with ESMTP id n0LCH7Bb018053; Wed, 21 Jan 2009 21:17:12 +0900 Message-Id: <200901211217.n0LCH7Bb018053@webpple.com> Reply-To: From: "David Afonso" Subject: [SPAM] Happy New Year... Date: Wed, 21 Jan 2009 13:14:58 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 07:53:07 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 21 Jan 2009 12:12:44 -0800 (PST) X-Spam-Prev-Subject: Happy New Year... Status: R X-Status: X-Keywords: X-UID: 43 Content-Length: 2888
Hello,
I got your contact in course of my inquiry to locate relations of my Deceased Client who died in a car crash. On the 7th of August 2003 it
 
was reported to us that my Client, his wife and their only daughter were involved in a car crash along shagamu-benin express way. The
 
reason for this is to inherit a Contract Payment Deposits Account of $7.4 million of which the Deceased left in a Finance Firm.
 
This request emerged when the Finance Firm contacted me for the attention of my Deceased Client (perhaps for one reason or the other
 
they have tried to contact him and was unsuccessful) I announced his death and protocols observed. I was mandated (as the deceased's
 
attorney) to provide the Next of Kin to inherit the Deposits or they will freeze it as" Unclaimed Deposit" Unfortunately, and unknown to the
 
Finance Firm, the Next of Kin was among the dead in the car crash.
But rather leaving the Deposits/Account frozen hence I seek your help to claim the fund into your Account as you share same names with
 
the Deceased and I have the required Information to execute the transaction under legal process. Please contact me through my private
 
email below.
Upon the conclusion of this transaction, I will come to your country, for the disbursement of this fund, which 40% of the total amount will be
 
your compensation, while 60% will be my share for the investment I will need your help to establish in your country.
 
Yours Faithfully,
David Afonso.
Private Email: davidafonso2009@live.com
 From nenekoffi52@yahoo.com.co Wed Jan 21 21:10:12 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********** X-Spam-Status: Yes, score=10.1 required=5.0 tests=BAYES_95,FREEMAIL_FROM, FREEMAIL_REPLYTO,FROM_EXCESS_QP,HTML_MESSAGE,JM_SOUGHT_FRAUD_2, J_CHICKENPOX_65,RBL_PSBL_01 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9813] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [68.142.236.45 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.0 FROM_EXCESS_QP From: quoted-printable encoded unnecessarily Received: from n7a.bullet.mail.re3.yahoo.com (n7a.bullet.mail.re3.yahoo.com [68.142.236.45]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0M5A8pq031451 for ; Wed, 21 Jan 2009 21:10:12 -0800 Received: from [68.142.230.28] by n7.bullet.re3.yahoo.com with NNFMP; 22 Jan 2009 04:42:27 -0000 Received: from [67.195.9.83] by t1.bullet.re2.yahoo.com with NNFMP; 22 Jan 2009 04:42:27 -0000 Received: from [67.195.9.111] by t3.bullet.mail.gq1.yahoo.com with NNFMP; 22 Jan 2009 04:42:27 -0000 Received: from [127.0.0.1] by omp115.mail.gq1.yahoo.com with NNFMP; 22 Jan 2009 04:42:27 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 282479.16555.bm@omp115.mail.gq1.yahoo.com Received: (qmail 5818 invoked by uid 60001); 22 Jan 2009 04:42:27 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.com.co; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=V27reaAhZP3m5OCbGElWUmvj1IwItVT86KLcZbJM8fbmPtZfyw1QWNXQj3YWVYoCQtsNCE1CWPJRoLsRvm7H8x3J6b2lwt2i/NMu6rvoQmWM58KqMXQUqQK1WZVBbNHTgYn/VBHSAslaMmkzi4HEZ/OWeLIa/Dr+SpBZZoW1ce0=; Received: from [41.207.15.42] by web112208.mail.gq1.yahoo.com via HTTP; Wed, 21 Jan 2009 20:42:27 PST Date: Wed, 21 Jan 2009 20:42:27 -0800 (PST) From: =?utf-8?q?Nene=20Koffi?= Reply-To: nenek001@yahoo.co.jp Subject: [SPAM] Dr koffi To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-474789352-1232599347=:97633" Content-Transfer-Encoding: 8bit Message-ID: <81905.97633.qm@web112208.mail.gq1.yahoo.com> X-Greylist: Delayed for 00:27:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 21 Jan 2009 21:10:12 -0800 (PST) X-Spam-Prev-Subject: Dr koffi Status: R X-Status: X-Keywords: X-UID: 44 Content-Length: 1071 --0-474789352-1232599347=:97633 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit ¡Tengo nueva dirección de correo!Ahora puedes escribirme a:nenekoffi52@yahoo.com.co Am P.A to Late president of Togo i want to transfer some Fund i need your assistance. - Nene Koffi --0-474789352-1232599347=:97633 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
¡Tengo nueva dirección de correo!
Ahora puedes escribirme a:nenekoffi52@yahoo.com.co

Am P.A to Late president of Togo i want to transfer some Fund i need your assistance.

- Nene Koffi
--0-474789352-1232599347=:97633-- From victoranthony208@rocketmail.com Wed Jan 21 23:15:23 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_FRAUD_X6,SPAMMY_WEBMAIL,THOUS_EMAIL_ADDRS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [203.157.114.14 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [203.157.114.14 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [203.157.114.14 listed in psbl.surriel.com] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from webmail.nswo.moph.go.th ([203.157.114.14]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0M7ExP8002782 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 21 Jan 2009 23:15:17 -0800 Received: from webmail.nswo.moph.go.th (localhost.localdomain [127.0.0.1]) by webmail.nswo.moph.go.th (8.12.8/8.12.8) with ESMTP id n0M084oj010887; Thu, 22 Jan 2009 07:08:24 +0700 From: "Victor Anthony" To: undisclosed-recipients: ; Reply-To: info@valiantprivatbank.ch.tt Subject: [SPAM] HONOUR. Date: Thu, 22 Jan 2009 07:08:04 +0700 Message-Id: <20090121204310.M90683@rocketmail.com> X-Mailer: Open WebMail 2.00 20030325 X-OriginatingIP: 41.210.19.151 (cio01) MIME-Version: 1.0 Content-Type: text/plain; charset=tis-620 X-Greylist: Delayed for 06:59:51 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 21 Jan 2009 23:15:23 -0800 (PST) X-Spam-Prev-Subject: HONOUR. Status: R X-Status: X-Keywords: X-UID: 45 Content-Length: 2527 Mr. Victor Anthony Valiant Privat Bank AG Postfach, 3001 Bern, Switzerland. Confidential Tel : +871-764107753 Confidential Fax : +871-764107751 Email: victoranthony@valiantprivatbank.ch.tt Hello, I am contacting you on a business transaction of a huge sum of money from a deceased account,though i know a transaction of this magnitude will make any one apprehensive and worried, but I'm assuring you that all will be well at the end of the day and this is why am contacting you due to the urgency of this transaction. We discovered an abandoned sum of (Seven million five hundred thousand United States dollars) in an account that belongs to one of our foreign customer who died along side with his entire family, and ever since his death none of his next of kin or relations has come forward to lay claims for this money as his heir. We cannot release the funds from his account unless someone applies for claim as the next of kin to the deceased as indicated on our banking guidelines. And upon this discovery we now seek your permission to have you stand as a next of kin to the deceased in which all documentations will be carefully worked out by us for the (Seven million five hundred thousand United States dollars) to be released in your favor as the beneficiary's/next of kin to the deceased. And It may interest you to know that we have secured from the probate an order of mandamus to locate any of the deceased beneficiary. Kindly acknowledge receipt of this message in acceptance of our mutual business endeavor by furnishing me with the following; 1. Beneficiary name and address. 2. Direct telephone and fax numbers. These requirements will enable us file letter of claim to the appropriate departments and authorities for necessary approvals for the release of the funds in your favor, before the transfer can be made to you. And we will be compensating you with thirty percent of the total funds on final conclusion of this project, while the rest will be for us and for investment purposes. And If this proposal is acceptable by you, do not take undue advantage of the trust we have bestowed in you. NB: If you are willing to assist me, including the information's i have requested from you, call me on my confidential tel: +871-764107753 for further details on what to do next. I await your response and call. Please Reply to Email: victoranthony@valiantprivatbank.ch.tt Best Regards, Mr. Victor Anthony. Confidential Tel : +871-764107753 Confidential Fax : +871-764107751 From ben_sankara00140@msn.com Thu Jan 22 07:41:05 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************************************** X-Spam-Status: Yes, score=42.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO,FROM_HAS_ULINE_NUMS, HTML_MESSAGE,HTML_STOOPID_02,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_61,LOTTO_YOU_WON_03,PHISH_05,RAZOR2_CHECK,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_SXLIFE,SPF_PASS,STOX_30, SUBJ_ALL_CAPS,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.3 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.1 SARE_SXLIFE BODY: Talks about your sex life * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 HTML_STOOPID_02 RAW: stupid HTML: empty STRONG tag * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from blu0-omc4-s27.blu0.hotmail.com (blu0-omc4-s27.blu0.hotmail.com [65.55.111.166]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0MFf2E8016287 for ; Thu, 22 Jan 2009 07:41:05 -0800 Received: from BLU120-W19 ([65.55.111.136]) by blu0-omc4-s27.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 22 Jan 2009 07:23:36 -0800 Message-ID: Content-Type: multipart/alternative; boundary="_9bb9cf01-03d4-4bbc-9936-4f8ec7ee6958_" X-Originating-IP: [41.203.228.160] Reply-To: From: benard sankara Subject: [SPAM] DEAR FRIEND,I NEED YOUR ASSISTANCE. Date: Thu, 22 Jan 2009 15:23:36 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 22 Jan 2009 15:23:36.0262 (UTC) FILETIME=[64FE8660:01C97CA5] X-Greylist: Delayed for 00:17:25 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 22 Jan 2009 07:41:05 -0800 (PST) X-Spam-Prev-Subject: DEAR FRIEND,I NEED YOUR ASSISTANCE. Status: R X-Status: X-Keywords: X-UID: 46 Content-Length: 9035 --_9bb9cf01-03d4-4bbc-9936-4f8ec7ee6958_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FROM MR BENARD SANKARA.AUDITING AND ACCOUNTING UNIT. AFRICA DEVELOPMENT BAN= K (A.D.B) OUAGADOUGOU BURKINA-FASO. = Dear friend this is real I a= m the manager auditting and accounting department african development bank.= (ADB) Ouagadougou Burkina-faso in west africa.I wish to seek your partnersh= ip in business.I discovered unclaim sum of $10.5m us dollars in our bank wh= ich belonged to one of our late foreign customer who died with his entire f= amily in Kenya plane crash on 21 July 2003. I discovered this while cross-c= hecking the files of foreigners in my department since our federal governme= nt has announced on the need of settling all foreign bills to enable foreig= n investors to come into our country and as an order from african unity gov= erned by african heads. Since I discovered the unclaim fund and about his d= eath=2C I have been expecting his next of kin to come over and claim his mo= ney because our bank cannot release it unless somebody applies for it as ne= xt of kin or relation to the deceased as indicated in our banking guideline= s but unfortunately I learnt that all his supposed next of kin or relation = died alongside with him at the plane crash leaving nobody behind for the cl= aim. it is therefore upon this discovery that I now decided to make this bu= siness proposal to you as to be a partner and stand as the next of kin to c= laim the fund since nobody is coming for it. The banking law and guideline = here stipulates that if such money remained unclamed after six years=2C the= money will be transfered into the bank treasury as unclaimed fund. The req= uest of foreigner as next of kin in this business is because the customer = was not a burkinabe and a burkinabe cannot stand as next of kin to a foreig= ner.You will be entitled to 40 % of this money as foreign partner=2C since= you provide an account for the claim=2C 5 % will be set aside for expenses= incured during the business and 55 % will be for me. There after I will vi= sit your country for disbursement accoding to the percentages indicated if = agreed. Please you have been adviced to keep this transaction secret as I a= m still in service and intend to retire from service after I conclude this = deal with you. I keep this information secret within myself to enable the w= hole plans and idea be profitable and successful during the time of executi= on.Meanwhile all the whole arrangement to put claim over this fund as the b= onafide next of kin to the deceased=2C get the required approval and transf= er this money to a foreign account has been put in place and directives and= needed information will be relayed to you as soon as you indicate your int= erest and willingness to assist me and also benefit your self to this great= business opportunity. I will be monitoring the whole situation here in th= is bank until you confirm the money in your account and ask me to come down= to your country for subsequent sharing of the fund according to percentage= s previously indicated and further investment=2C either in your country or = any country you advice us to invest in. I will not fail to bring to your no= tice that this transaction is 100% risk free and that you should not entert= ain any atom of fear as all required arrangements have been made for the tr= ansfer and the file of the fund is under my desk.All other necessary vital = information will be sent to you when I hear from you. Now our questions ar= e:1) Can you handle this project?2) Can I give you this trust? Please let u= s get this fund transfer into your account very fast.I look foward to recei= ve your reply as soon as you receive this email. =20 I wish you happy new year 2009 All the best to you from=2C Mr Benard Sankar= a. = --_9bb9cf01-03d4-4bbc-9936-4f8ec7ee6958_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
FROM MR BENARD SANKARA.
AUDITING AND ACCOUNTING UNIT.
A= FRICA DEVELOPMENT BANK (A.D.B)
OUAGADOUGOU BURKINA-FASO. =3B
&n= bsp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B
 =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B  =3B =3B =3B =3B Dear friend = this is real
I am the manager auditting and accounting department afric= an development bank.(ADB) Ouagadougou Burkina-faso in west africa.I wish to= seek your partnership in business.I discovered unclaim sum of $10.5m us do= llars in our bank which belonged to one of our late foreign customer who di= ed with his entire family in Kenya plane crash on 21 July 2003. I discovere= d this while cross-checking the files of foreigners in my department since = our federal government has announced on the need of settling all foreign bi= lls to enable foreign investors to come into our country and as an order fr= om african unity governed by african heads. Since I discovered the unclaim = fund and about his death=2C I have been expecting his next of kin to come o= ver and claim his money because our bank cannot release it unless somebody = applies for it as next of kin or relation to the deceased as indicated in o= ur banking guidelines but unfortunately I learnt that all his supposed next= of kin or relation died alongside with him at the plane crash leaving nobo= dy behind for the claim. it is therefore upon this discovery that I now dec= ided to make this business proposal to you as to be a partner and stand as = the next of kin to claim the fund since nobody is coming for it.
 = =3B
The banking law and guideline here stipulates that if such money rem= ained unclamed after =3Bsix years=2C the money will be transfered into = the bank treasury as unclaimed fund. The request of =3B foreigner as ne= xt of kin in this business is because the customer was not a burkinabe and = a burkinabe cannot stand as next of kin to a foreigner.You will be entitled= to =3B 40 % of this money as foreign partner=2C since you provide an a= ccount for the claim=2C 5 % will be set aside for expenses incured during t= he business and 55 % will be for me. There after I will visit your country = for disbursement accoding to the percentages indicated if agreed. Please yo= u have been adviced to keep this transaction secret as I am still in servic= e and intend to retire from service after I conclude this deal with you. I = keep this information secret within myself to enable the whole plans and id= ea be profitable and successful during the time of execution.Meanwhile all = the whole arrangement to put claim over this fund as the bonafide next of k= in to the deceased=2C get the required approval and transfer this money to = a foreign account has been put in place and directives and needed informati= on will be relayed to you as soon as you indicate your interest and willing= ness to assist me and also benefit your self to this great business opportu= nity.
 =3B
I will be monitoring the whole situation here in this= bank until you confirm the money in your account and ask me to come down t= o your country for subsequent sharing of the fund according to percentages = previously indicated and further investment=2C either in your country or an= y country you advice us to invest in. I will not fail to bring to your noti= ce that this transaction is 100% risk free and that you should not entertai= n any atom of fear as all required arrangements have been made for the tran= sfer and the file of the fund is under my desk.All other necessary vital in= formation will be sent to you when I hear from you. =3B
 =3B
= Now our questions are:
1) Can you handle this project?
2) Can I give = you this trust?
 =3B
Please let us get this fund transfer into yo= ur account very fast.I look foward to receive your reply as soon as you rec= eive this email.
 =3B
I wish you happy new year 2009 =3B

All the best to you from=2C
Mr Benard Sankara.
= --_9bb9cf01-03d4-4bbc-9936-4f8ec7ee6958_-- From yanehdenni@gmail.com Thu Jan 22 09:51:52 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_NG_2,DEAR_FRIEND,DNS_FROM_RFC_POST, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,MILLIONS_01,NA_DOLLARS, RAZOR2_CHECK,SPF_NEUTRAL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=yanehdenni%40gmail.com&ip=64.8.90.218&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.charlescolehospital.com (mail.charlescolehospital.com [64.8.90.218]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0MHpmuD019808 for ; Thu, 22 Jan 2009 09:51:51 -0800 Received: from User ([41.220.64.135]) by mail.charlescolehospital.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 22 Jan 2009 12:27:48 -0500 Reply-To: From: "Fred Kazi" Subject: [SPAM] rerere Date: Thu, 22 Jan 2009 09:27:34 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 22 Jan 2009 17:27:49.0475 (UTC) FILETIME=[BF749330:01C97CB6] X-Greylist: Delayed for 00:23:42 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 22 Jan 2009 09:51:52 -0800 (PST) X-Spam-Prev-Subject: rerere Status: R X-Status: X-Keywords: X-UID: 47 Content-Length: 1149 Dear friend, I write to solicit your assistance in a project of mutual benefit and regret any inconveniences contacting you this way with my proposal. I am . Fred Saseh Kazi, former Head of Accounts Department at the Diamond Mining Company of Sierra Leone. I and my partners (two others) are in urgent need of a foreign associate to work with us to facilitate the transfer of a large sum of money which we intend to invest into profitable areas of business in your country. The money involved is eighteen million five hundred thousand US Dollars. However, as a result of the regulations here, we cannot transfer the funds to your country without having an associate there. We propose your commission shall be 20 per cent of the total money been transferred, in view of the importance your role as our overseas partners will be, without which we cannot transfer the funds. Please consider this proposal seriously and handle with utmost confidentiality the information I have provided you with here. If you are in a position to assist, then get back to me immediately, so I can give you more details. Sincerely, Fred Kazi. From Mrgrtavil4@aol.com Thu Jan 22 23:34:10 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_50_60,HTML_MESSAGE,HTML_TITLE_EMPTY, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,J_CHICKENPOX_74,LOTTO_AGENT, LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_02,MIME_HTML_ONLY,PHISH_05, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_LOTTO_SPAM, SPF_PASS,UNDISC_RECIPS,UPPERCASE_25_50,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 0.2 PHISH_05 BODY: Phishing for account information * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 0.0 UPPERCASE_25_50 message body is 25-50% uppercase * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 2.4 SARE_LOTTO_SPAM Lottery Spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from omr-m33.mx.aol.com (omr-m33.mx.aol.com [64.12.143.145]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0N7Y6UJ022356 for ; Thu, 22 Jan 2009 23:34:10 -0800 Received: from imo-d03.mx.aol.com (imo-d03.mail.aol.com [172.18.150.227]) by omr-m33.mx.aol.com (8.14.1/8.14.1) with ESMTP id n0N7EpEP012231; Fri, 23 Jan 2009 02:14:51 -0500 Received: from Mrgrtavil4@aol.com by imo-d03.mx.aol.com (mail_out_v39.1.) id 6.c78.4a0af69b (34940); Fri, 23 Jan 2009 02:14:40 -0500 (EST) Received: from User (dsl-146-28-111.telkomadsl.co.za [165.146.28.111]) by cia-da05.mx.aol.com (v121_r5.5) with ESMTP id MAILCIADA051-887c49796e483a1; Fri, 23 Jan 2009 02:14:36 -0500 Reply-To: From: "WINNING NOTIFICATION" Subject: [SPAM] CONGRATULATIONS! YOU HAVE WON 800,000.00 GBP (Eight Hundred Thousand Great British Pounds) Date: Fri, 23 Jan 2009 09:14:38 +0200 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AOL-IP: 165.146.28.111 To: undisclosed-recipients:; Message-ID: X-Greylist: Delayed for 00:18:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 22 Jan 2009 23:34:10 -0800 (PST) X-Spam-Prev-Subject: CONGRATULATIONS! YOU HAVE WON 800,000.00 GBP (Eight Hundred Thousand Great British Pounds) Status: R X-Status: X-Keywords: X-UID: 48 Content-Length: 9025
MICROSOFT AWARD TEAM
The Microsoft Corp World Lottery,
United Kingdom
P O Box 1010 Liverpool, L70 1NL
United Kingdom.
Winning Numbers 887 13 865 37 10 83
 
WINNING NOTIFICATION:
 
We happily announce to you the draw (#953) of the MICROSOFT CORP WORLD LOTTERY AW ARD International programs held in U.K your "email address" was attached to ticket number; B9665 75604546 199 serial number 97560, This batch draws the lucky winning numbers as follows 887/13/865/37/10/83, bonus number 2, which consequently won the lottery in the second category.
All participants "email address" were selected through a computer balloting system drawn from Nine hundred thousand names from Canada, Australia, United States, Asia, Europe, Middle East, Africa and Oceanic as part of our international promotions program which is conducted annually.
 
You have therefore been approved to claim a total sum of 800,000.00 (Eight Hundred Thousand United Kingdom Pounds) in cash credited to file MSW-L/200-26937, This is from total prize money of 60,000,000, shared among the Seventy-five (75) lucky Worldwide winners in first category.
HOW TO CLAIM YOUR PRIZE
Simply contact our fiduciary Claim Agent in South Africa where your payment is zoned. He will immediately commence the process to facilitate the release of your winning prize money.
His contact details is shown below
Delive ry agency contact information:
CONTACT CLAIM OFFICE
DR STEVEN JONESFOXTER
EMAIL:awardscontact_office@yahoo.co.uk
ALT:agentstevenjonesfoxter@gmail.com
TEL: +27 743 665 351
 
PLEASE FILL THIS CLAIM FORM AND FORWARD TO YOUR CLAIM AGENT FOR CLAIM OF YOUR WINNING PRIZE FUND.
 
FULL NAME:.....................................................................
 
DATE OF BIRTH...............................................................
 
CONTACT ADDRESS:........................................................
 
COUNTRY OF RESIDENCE:................................................
 
NATIONALITY:........................................................................
 
COMPANY:.............................................................................
DIRECT TELEPHONE & FAX NUMBER:................................
 
YOUR WINNING REF:NO AND BATCH NO:..........................
 
YOUR WINNING EMAIL ADDRESS:.....................................
 
OCCUPATION:......................................................................
 
SEX:.....................................................................................
MODE OF PAYMENT:BANK TRANSFER{T/T}......................
 
BANK ACCOUNT NUMBER:................................................
 
BANK NAME:....................................................................
 
BANK ADDRESS:...............................................................
 
BRANCH CODE:................................................................
 
BANK SWIFT CODE:..........................................................
 
BANK TELEPHPNE NUMBER:.............................................
 
BANK FAX NUMBER:.........................................................
 
TOTAL AMOUNT WON:.....................................................
 
SCAN TWO PAGES OF YOUR INTERNATIONAL PASSPORT/DRIVING LICENSE:
 
Our special thanks and gratitude to MICROSOFT PROMOTIONS. We wish you the best of luck a s you spend your good fortune in this season.
 
For security reasons, you are advised to keep your winning information confidential till your cash prize is processed and your winning money remitted to your nominated account
 
NB: PLEASE DO NOT REPLY TO THIS EMAIL BECAUSE YOU MIGHT NOT BE ATTENDED TO, KINDLY CONTACT YOUR FIDUCIARY AGENT DIRECTLY FOR FURTHER DIRECTIONS.
 From jainhagis601@yahoo.com Fri Jan 23 04:28:51 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,BL_COUNTRY_NG_2,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_10_20,HTML_MESSAGE, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_27, J_CHICKENPOX_34,J_CHICKENPOX_47,J_CHICKENPOX_63,J_CHICKENPOX_72, J_CHICKENPOX_73,MILLIONS_01,RCVD_IN_BL_SPAMCOP_NET,SARE_FRAUD_X3,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 0.6 J_CHICKENPOX_27 BODY: 2alpha-pock-7alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n61a.bullet.mail.sp1.yahoo.com (n61a.bullet.mail.sp1.yahoo.com [98.136.45.8]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0NCSlIl029970 for ; Fri, 23 Jan 2009 04:28:50 -0800 Received: from [69.147.84.144] by n61.bullet.mail.sp1.yahoo.com with NNFMP; 23 Jan 2009 12:01:32 -0000 Received: from [67.195.9.83] by t6.bullet.mail.sp1.yahoo.com with NNFMP; 23 Jan 2009 12:01:32 -0000 Received: from [67.195.9.101] by t3.bullet.mail.gq1.yahoo.com with NNFMP; 23 Jan 2009 12:01:32 -0000 Received: from [127.0.0.1] by omp105.mail.gq1.yahoo.com with NNFMP; 23 Jan 2009 12:01:32 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 391054.12310.bm@omp105.mail.gq1.yahoo.com Received: (qmail 94103 invoked by uid 60001); 23 Jan 2009 12:01:05 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.com; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=nTIYx569muixkzKMooIL3CEDQnPRiNjD74pjxY5L+uMclx4QZ689yDRoL5VrD27RthoFcjS1uI+aBatZvZvGWrYcZgvyqP30YCdcpeZSiSFZLIbESa1VH3Z6uoFRwqNwH0Rn2t17oquLYPwn2Fx7Wot2hxyr5/gYozYrqS4xr8I=; Received: from [196.1.176.210] by web111009.mail.gq1.yahoo.com via HTTP; Fri, 23 Jan 2009 04:01:04 PST Date: Fri, 23 Jan 2009 04:01:04 -0800 (PST) From: Jain Hagis Reply-To: jainhagis45@sunumail.sn Subject: [SPAM] Dear Beloved, To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-664671122-1232712064=:90541" Content-Transfer-Encoding: 8bit Message-ID: <823196.90541.qm@web111009.mail.gq1.yahoo.com> X-Greylist: Delayed for 00:18:58 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 23 Jan 2009 04:28:51 -0800 (PST) X-Spam-Prev-Subject: Dear Beloved, Status: R X-Status: X-Keywords: X-UID: 49 Content-Length: 4862 --0-664671122-1232712064=:90541 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: jainhagis601@yahoo.com - Dear Beloved,As you read this, I don't want you to feel sorry for me,because, I Believe Everyone will die someday. My name is JAIN HAGIS I am a merchant of Oman Nationality.I have been diagnosed with Oesophageal cancer .It has defiled all forms of medical treatment, and Right now Ihave only about a few months to live, according to medical experts.I have not particularly lived my life so well, as I never really cared for Anyone (not even myself)but my business.Though I am very rich, I was never generous, I was always hostile to people and only focused on my business as that was the only thing I cared for. But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world.I believe when God gives me a second chance to come to this world I would live my life a different way from how I have lived it.Now that God has called me, I have willed and given most of my property and assets to my immediate and extended family members as well as a few close friends.I want God to be merciful to me and accept my soul so, I have decided to give alms to charity organizations, as I want this to be one of the last good deeds I do on earth. So far, Ihave distributed money to some charity organizations in the Oman,Algeria and Malaysia. Now that my health has deteriorated so badly, I cannot do this myself anymore. I once asked members of my family to close one of my accounts and distribute the money which I have there to charity organization in Bulgaria and Pakistan, they refused and kept the money to themselves.Hence, I do not trust them anymore, as they seem not to be contended with what I have left for them. The last of my money which no one knows of is the huge cash deposit of eighteen million dollars $18,000,000 that I have with a finance/Security Company in europe. I will want you to help me collect this deposit and dispatche it to charity organizations.I have set aside 30% for you and for your time. God be with you.JAIN HAGIS. --0-664671122-1232712064=:90541 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: jainhagis601@yahoo.com



- Dear Beloved,As you read this, I don't want you to feel sorry for me,because, I Believe Everyone will die someday. My name is JAIN HAGIS I am a merchant of Oman Nationality.I have been diagnosed with Oesophageal cancer .It has defiled all forms of medical treatment, and Right now Ihave only about a few months to live, according to medical experts.I have not particularly lived my life so well, as I never really cared for Anyone (not even myself)but my business.Though I am very rich, I was never generous, I was always hostile to people and only focused on my business as that was the only thing I cared for. But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world.I believe when God gives me a second chance to come to this world I would live my life a different way from how I have lived it.Now that God has called me, I have willed and given most of my property and assets to my immediate and extended family members as well as a few close friends.I want God to be merciful to me and accept my soul so, I have decided to give alms to charity organizations, as I want this to be one of the last good deeds I do on earth. So far, Ihave distributed money to some charity organizations in the Oman,Algeria and Malaysia. Now that my health has deteriorated so badly, I cannot do this myself anymore. I once asked members of my family to close one of my accounts and distribute the money which I have there to charity organization in Bulgaria and Pakistan, they refused and kept the money to themselves.Hence, I do not trust them anymore, as they seem not to be contended with what I have left for them. The last of my money which no one knows of is the huge cash deposit of eighteen million dollars $18,000,000 that I have with a finance/Security Company in europe. I will want you to help me collect this deposit and dispatche it to charity organizations.I have set aside 30% for you and for your time. God be with you.JAIN HAGIS.
--0-664671122-1232712064=:90541-- From edit@smsservice24.com Tue Jan 20 09:21:04 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.8 required=5.0 tests=BAYES_80,BL_COUNTRY_CN_1, BL_COUNTRY_CN_2,DATE_IN_FUTURE_12_24,JM_SOUGHT_1,JM_SOUGHT_FRAUD_1, LOTTO_YOU_WON_03,L_MANY_STD_PROBS,REPLY_TYPE_01 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 REPLY_TYPE_01 Content-Type with Reply-Type option * 0.5 BL_COUNTRY_CN_2 Mail client in China * 2.8 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.9340] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [58.245.219.27 listed in cn.countries.nerd.dk] * 4.0 JM_SOUGHT_1 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.0 L_MANY_STD_PROBS Three or more standards-compliance problems Received: from [58.245.219.27] ([58.245.219.27]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0KHKiDc005666 for ; Tue, 20 Jan 2009 09:21:02 -0800 Message-ID: <480401c97ba3$00d7ceb3$1bdbf53a@[58.245.219.27]> From: "Jacco Scheibe" To: Subject: [SPAM] Want the degree but can't find the time ? Date: Wed, 21 Jan 2009 08:40:01 +0300 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-2022-jp"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4942.400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4942.400 X-Assassin-report: false-positive X-Rcpt-To: apeacock@joya-arts.com X-MDRcpt-To: apeacock@joya-arts.com X-Greylist: Delayed for 00:17:20 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 20 Jan 2009 09:21:04 -0800 (PST) X-Spam-Prev-Subject: Want the degree but can't find the time ? Status: R X-Status: X-Keywords: X-UID: 50 If you are more than qualified with your experience, but are lacking that prestigious piece of paper known as a diploma that is often the passport to success. We provide a concept that will allow anyone with sufficient work experience to obtain a fully verifiable University Degree - Bachelors, Masters or even a Doctorate. Within four to six weeks, you will be a college graduate. Many people are doing the work of the person that has the degree and the person that has the degree is getting all the money. Don$B!G(Bt you think that it is time you were paid fair compensation for the level of work you are already doing? This is your chance to finally make the right move and receive your due benefits. CALL US TODAY AND GIVE YOUR WORK EXPERIENCE THE CHANCE TO EARN YOU THE HIGHER COMPENSATION YOU DESERVE! Ring Anytime +1-904-346-1158 From kevinbt27@yahoo.de Wed Jan 21 04:28:14 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************************** X-Spam-Status: Yes, score=30.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_95,DEAR_FRIEND,FREEMAIL_FROM, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLIONS_01,MILLION_USD,MISSING_SUBJECT, NO_REAL_NAME,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9845] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [12.180.242.135 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.8 MISSING_SUBJECT Missing Subject: header * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from mail.qwis.net (mail.qwis.net [12.180.242.135]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0LCS9rs004056 for ; Wed, 21 Jan 2009 04:28:14 -0800 From: kevinbt27@yahoo.de Received: from User [216.147.130.132] by mail.qwis.net with ESMTP (SMTPD-9.23) id A882030C; Wed, 21 Jan 2009 04:27:14 -0600 X-Antivirus: avast! (VPS 090120-0, 01/20/2009), Outbound message X-Antivirus-Status: Not-Tested Message-Id: <200901210429875.SM02908@User> Date: Wed, 21 Jan 2009 06:32:00 -0600 X-Greylist: Delayed for 01:43:36 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 21 Jan 2009 04:28:14 -0800 (PST) Subject: [SPAM] X-Spam-Prev-Subject: (nonexistent) Status: R X-Status: X-Keywords: X-UID: 51 Content-Length: 1507 Dear Friend, I introduce myself as Kevin Barrett, finance director at Royal Finance Bank, Charlemont Place, Dublin, Ireland. A contracted staff of Perez and Hamilton contacted you earlier concerning Mr. Mohamed Abdul Ramah and an investment placed under our bank's management 10 years ago. I would respectfully request that you keep the contents of this mail confidential and respect the integrity of the information you come by as a result of this mail. I contact you independently of our investigation and emphasize the reason of this communication. I would like to intimate you with certain facts that I believe would be of interest to you. In 1997, the subject matter; Mohamed came to our bank to engage in business discussions with our private banking division. He informed us that he had a financial portfolio of Nine million United States dollars. After some time we did not hear from Mr Ramah again, I was then given the task to investigate his where about only to find out that he has died and he left no next of kin in his file, that is where you come in, I want you to act as the next of kin to the deceased. I explain more to you as soon as I get back your response with readiness to assist, for your assistance, you will have 35% of the funds and 65% goes to me. I await your response. Please call me on Tel:+447045712276 or reply to my private email address: kevinbarrett2006@hotmail.com Note: Do not at any time contact me through my official email or phone for confidentiality. Kevin From petermageza1002@live.co.za Sat Jan 24 16:15:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.9 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, DEAR_SOMETHING,FORGED_MUA_OUTLOOK,RCVD_IN_BL_SPAMCOP_NET,RCVD_NUMERIC_HELO, SPF_SOFTFAIL,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=petermageza1002%40live.co.za&ip=194.228.2.77&receiver=ga.impsec.org] * 1.5 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp-out5.iol.cz (smtp-out5.iol.cz [194.228.2.77]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0P0F44H022239 for ; Sat, 24 Jan 2009 16:15:08 -0800 Received: from User (manganese.onspeed.com [83.138.172.77]) by smtp-out5.iol.cz (Postfix) with ESMTP id 0E27A5AC4E8; Sun, 25 Jan 2009 00:41:50 +0100 (CET) Received: from 41.16.220.33 (7deemu33@41.16.220.33 [41.16.220.33]) by manganese.onspeed.com (SlipStream SP Server 6.0.19 built 2007/11/22 15:27:31 -0500 (EST)); Sat, 24 Jan 2009 23:43:46 +0000 (GMT) X-Originating-IP: [41.16.220.33] X-Originating-User: [7deemu33] Message-ID: <7deemu33$41.16.220.33$.497ba7b2.56a74.55e1.82@manganese.onspeed.com> Reply-To: From: "Peter Mageza" Subject: [SPAM] Call me or email me back Date: Sun, 25 Jan 2009 01:43:43 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 To: undisclosed-recipients:; X-Greylist: Delayed for 00:31:16 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 24 Jan 2009 16:15:08 -0800 (PST) X-Spam-Prev-Subject: Call me or email me back Status: R X-Status: X-Keywords: X-UID: 52 Content-Length: 1084 Dear Sir/Madam, I am a Bank Manager in one of the leading banks in South Africa; I write to seek your permission, corporations and trust in presenting you to my bank as the next of Kin/beneficiary to my deceased client, Mr. Dr.George Brumley who has a bank balance of ($14.6m USD) with my bank where I work; He is an American and was a businessman who was a victim of a plane crash in Kenya along with his entire family years ago. http://www.cnn.com/2003/WORLD/africa/07/20/kenya.crash/index.html You can confirm from the website above for more info. But as you must be aware that no other person except my colleagues and I knows about this account, the Strategy is to use our influences as the Managers/Directors of the bank to approve the funds to you legally without any problem for our mutual benefits. So, indicate your interested by forwarding to my attention your names, cell, Phone/fax, address, profession, age and country so as to enable me contact you with the legal proceedings in trust. Or better still indicate if otherwise. Thank you Mr. Peter Mageza +27-71-034-7732 From noreply@games.com Sun Jan 25 00:10:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.2 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, FORGED_OUTLOOK_HTML,FORGED_RCVD_HELO,HTML_50_60,HTML_MESSAGE, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_13, J_CHICKENPOX_14,J_CHICKENPOX_23,J_CHICKENPOX_31,J_CHICKENPOX_61, J_CHICKENPOX_83,LOTTO_WIN_01,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MIME_HTML_ONLY, RBL_POXLAY_01,RCVD_IN_BRBL,THOUS_EMAIL_ADDRS,TO_CC_NONE,UNCLAIMED_MONEY autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_23 BODY: 2alpha-pock-3alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 2.4 UNCLAIMED_MONEY BODY: People just leave money laying around * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_14 BODY: 1alpha-pock-4alpha * 0.6 J_CHICKENPOX_13 BODY: 1alpha-pock-3alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [66.79.163.50 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [62.234.209.237 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from secure.trigohost.com (ns1.kandooey.com [66.79.163.50] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0P8A5d8001602 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 25 Jan 2009 00:10:10 -0800 Received: from p0491.nas3-asd6.dial.wanadoo.nl ([62.234.209.237] helo=thisday) by secure.trigohost.com with esmtpa (Exim 4.69) (envelope-from ) id 1LQwyc-0004U8-57; Sat, 24 Jan 2009 20:52:10 -0800 Message-ID: <001b01c97f0c$f8791a4a$d5c02aaf@hkktbgdrrdnjx> From: "De lotto" Subject: [SPAM] Lotto Millionaire Results Date: Sun, 25 Jan 2009 05:47:45 +0100 Organization: lotto.nl MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - secure.trigohost.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - games.com X-Greylist: Delayed for 03:17:49 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 25 Jan 2009 00:10:10 -0800 (PST) X-Spam-Prev-Subject: Lotto Millionaire Results Status: R X-Status: X-Keywords: X-UID: 53 Content-Length: 6803
De Lotto.
Operators of De Lotto Millionaire
laan van Hoornwijck 55 2289 DG Rijswijk.
Amsterdam The Netherlands
KvK: 41151075
 
    
WINNING NOTIFICATION
 
The Netherlands Millionaire Lotto wishes to inform you  that the results of the Millionaire lotto Promo is out and 
you are been chosen as the second winner for the programme by the Millionaire Lotto held on the  24th of JANUARY 2009. 
Your Email has been picked as a winner of a lump  sum pay out of Nine Hundred Thousand euros (9 hundres thounsand).
 
 
The Millionaire Lotto. draws was conducted from an  exclusive list of 13 lucky emails of individual and corporate
 bodies picked by an advanced automated random computer search. No tickets were sold.
 
 -------------------------------------------------------
You email address is attached to
Your Batch No: LSN 2009/81345
Your Reference No:LSN 6976/aico/009
Your Ticket No: LSN 912746372/lco/ 07421 
Your Security File No: LSN 63183/lco/7730 
---------------------------------------------------------
 
To begin your claim, do file for the release of your winning by contacting the Corporate Officer below.
 
Mr. Ron Vlietveld
De Lotto Corporate Officer
Email:millionaire.lotto@games.com
 
Indicate your Full Name, Address, Country, Telephone, Mobile, Fax Number, Occupation and Age. 
 
Failure to provide the information above will result to immediate disqualification !!
 
This promotion is this year's De Lotto Deaf in conjunction with Lotto Millionaire New Year bonanza. All winning must be 
claimed not later than 10 working days from this notification. After this time  all unclaimed funds will be returned to 
De Lotto Treasury Department as unclaimed.
 
Congratulations!!
 
Sincerely,
 
Mrs. Leonie Hartwig.
Lottery Coordinator.
 
 
****************************************************************************** . 
De informatie in dit email bericht is vertrouwelijk en uitsluitend bestemd 
voor de geadresseerde. 
A informa??o neste E-mail ? relatada foi pretendida confidentially e 
exclusivamente para o destinat?rio. A informa??o neste boletim ? 
confidential e foi protegida possivelmente legalmente. A informa??o 
emitida com este E-mail que se relata o foi pretendida exclusivamente 
para o destinat?rio. O uso desta informa??o pela outra destinat?rio 
tem sido proibido ent?o. A publica??o, multiplicar, distribui??o e/ou 
fonte desta informa??o aos terceiros partidos n?o foram permitidas 
n?o para transferir correto e completo dos ?ndices de um E-mail 
emitido, nem para a recep??o r?pida dela. Este footer d? a esse este 
E-mail ? feito a varredura por um varredor atual do v?rus na presen?a 
do virussdn do computador. Considera??o am?vel, 
****************************************************************************
 From colepcole@gmail.com Sun Jan 25 06:02:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_SOMETHING,DNS_FROM_RFC_POST, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RCVD_NUMERIC_HELO,SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_NEUTRAL, UNDISC_RECIPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=colepcole%40gmail.com&ip=194.228.2.91&receiver=ga.impsec.org] * 1.5 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp-out3.iol.cz (smtp-out3.iol.cz [194.228.2.91]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0PE24sZ011767 for ; Sun, 25 Jan 2009 06:02:07 -0800 Received: from antivir5.iol.cz (unknown [192.168.30.212]) by smtp-out3.iol.cz (Postfix) with ESMTP id A3739BE204E; Sun, 25 Jan 2009 13:42:16 +0000 (UTC) Received: from localhost (antivir5.iol.cz [127.0.0.1]) by antivir5.iol.cz (Postfix) with ESMTP id C61B728008; Sun, 25 Jan 2009 14:42:13 +0100 (CET) X-Virus-Scanned: amavisd-new at iol.cz Received: from antivir5.iol.cz ([127.0.0.1]) by localhost (antivir5.iol.cz [127.0.0.1]) (amavisd-new, port 10224) with LMTP id gzrhipdTTR3x; Sun, 25 Jan 2009 14:42:13 +0100 (CET) Received: from smtp-out3.iol.cz (mta-out3 [192.168.30.28]) by antivir5.iol.cz (Postfix) with ESMTP id 7B97328005; Sun, 25 Jan 2009 14:42:13 +0100 (CET) Received: from User (aluminium.onspeed.com [212.100.250.217]) by smtp-out3.iol.cz (Postfix) with ESMTP id 4572B6B4266; Sun, 25 Jan 2009 14:41:01 +0100 (CET) Received: from 41.15.147.125 (7deemu33@41.15.147.125 [41.15.147.125]) by aluminium.onspeed.com (SlipStream SP Server 6.0.19 built 2007/11/22 15:27:31 -0500 (EST)); Sun, 25 Jan 2009 13:42:15 +0000 (GMT) X-Originating-IP: [41.15.147.125] X-Originating-User: [7deemu33] Message-ID: <7deemu33$41.15.147.125$.497c6c37.b7bd3.7c1c.1453@aluminium.onspeed.com> Reply-To: From: "Mr. Peter Cole" Subject: [SPAM] Please Call Me Or Email !!++ Date: Sun, 25 Jan 2009 15:42:16 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 To: undisclosed-recipients:; X-Greylist: Delayed for 00:19:46 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 25 Jan 2009 06:02:08 -0800 (PST) X-Spam-Prev-Subject: Please Call Me Or Email !!++ Status: R X-Status: X-Keywords: X-UID: 54 Content-Length: 1643 Dear Sir/madam, I am a staff of one of the leading banks in South Africa I am writing asking for your indulgence in re-profiling funds, which we want to keep under your supervision. The Funds totaling ($14,700,000) I am only contacting you as a foreigner because this fund cannot be approved to a local Bank here in South Africa, because the funds are in US Dollars and the owner of this account is Mr. Morris Thompson from America, and he died since 2000 in an air crash along with his wife & Daughter on 31/01/2000 in an Alaska Airlines Flight 261 with other passengers on board. You can confirm from this http://www.cnn.com/2000/US/02/01/alaska.airlines.list/ Please, I am proposing 30% for you for your assistance while my colleagues and I receive 60% and 10% earmarked for purposes of taxation in your country and mine. Please if you are interested kindly forward to me the following informations stated below: (1) Your direct telephone number (2) Your direct fax number (3) Your Full Names (4) Your age (5) Your Country of Origin (6) Your Residential Address All that is require from you is your honest cooperation to enable us see this transaction through. I guarantee that this will be executed under legitimate arrangement that will protect you from any breach of the law. Your reply should indicate your willingness in assisting us. And I will send you all the detailed informations and documents that you will need to process an application for the claims of the funds. I look forward towards a good business relationship with you. You can also call me on my direct number +27 73 225 5053. Regards. Mr. Peter Cole From mohammedsani2@live.com Sun Jan 25 07:58:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_60,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_75,MILLIONS_01,NA_DOLLARS, PHISH_05,SARE_PROLOSTOCK_SYM3,SARE_URI_MEDS,SPF_SOFTFAIL,STOX_30, UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=mohammedsani2%40live.com&ip=200.60.36.128&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 1.6 SARE_PROLOSTOCK_SYM3 BODY: Last week's hot stock scam * 0.8 SARE_URI_MEDS URI: domain selling meds * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7435] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from nuevavision.com.pe (linuxnv.nuevavision.com.pe [200.60.36.128]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0PFw50o014456 for ; Sun, 25 Jan 2009 07:58:08 -0800 Received: by nuevavision.com.pe (Postfix, from userid 33) id 3E7DD1165B5; Sun, 25 Jan 2009 10:04:37 -0500 (PET) To: undisclosed-recipients:; Subject: [SPAM] {Spam?} DEAR CONTRACTOR X-PHP-Script: mail.nuevavision.com.pe/webmail/index.php for 212.100.69.11 MIME-Version: 1.0 Date: Sun, 25 Jan 2009 10:04:37 -0500 From: MOHAMMED SANI Organization: CENTRAL BANK OF NIGERIA Reply-To: mohammedsani1@hotmail.com Message-ID: <96292ee4405b83f4e4c56a77a94fc875@nuevavision.com.pe> X-Sender: mohammedsani2@live.com Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="UTF-8" X-unconfigured-debian-site-MailScanner: Found to be clean X-unconfigured-debian-site-MailScanner-SpamCheck: spam, SpamAssassin (cached, score=11.578, required 6, ADVANCE_FEE_1 0.00, ADVANCE_FEE_2 1.39, ADVANCE_FEE_3 3.34, ADVANCE_FEE_4 3.73, BAYES_50 0.00, NA_DOLLARS 1.28, NO_RELAYS -0.00, SUBJ_ALL_CAPS 1.00, UNDISC_RECIPS 0.84) X-unconfigured-debian-site-MailScanner-SpamScore: sssssssssss X-unconfigured-debian-site-MailScanner-From: mohammedsani2@live.com X-Greylist: Delayed for 00:39:34 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 25 Jan 2009 07:58:09 -0800 (PST) X-Spam-Prev-Subject: {Spam?} DEAR CONTRACTOR Status: R X-Status: X-Keywords: X-UID: 55 Content-Length: 1928 -- Dear Contractor, The Central Bank of Nigeria has released the sum of USD$800,000,000.00 this first quarter of the year to settle some foreign contractors whose contract has already been vetted by the contract reconciliation committee of the senate and the settlement committee of the Federal Ministry of Finance. I am glad to state that your contract NO CAD/1177A/NNPC/06 was among the ones listed for immediate payment into your designated bank account. Please could you supply this office with your current bank account for your payment of USD$15,500,000.00 (Fifteen Million Five Hundred Thousand US Dollars)which was approved and your payment order signed by the Presidency last year 2008. Note that the previous bank of America account details your supplied could no longer be traced due to the fire incident that gutted our file and records office in 2007. You are advised not to communicated with anybody in any department of central bank for assistant or give bribe to anybody because this is against the payment conditions stated in the Central bank payment decree N0 17 of 1995. Please note that all contractors listed for this payment under category A Contracts, that is contract above USD$1,000,000.00 must present their tax clearance certificate for citing. If you have not paid your Tax, you should authorize central bank to deduct such tax from amount approved for payment to your company. All application for such deduction must be sent to the Director of Taxation, Federal Ministry of Finance using this email:Ibrahimsanusi@financier.com for consideration. The undersigned is the Chairman Contract revalidation and payment committee central bank of Nigeria. Reply to mohammedsani1@hotmail.com Please supply contact information. Thank you Mohammed Sani C.R.C.P(CBN) +234 7037370720 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From noreply@games.com Mon Jan 26 05:40:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.7 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, FORGED_OUTLOOK_HTML,FORGED_RCVD_HELO,HTML_50_60,HTML_MESSAGE, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_13,J_CHICKENPOX_14, J_CHICKENPOX_23,J_CHICKENPOX_31,J_CHICKENPOX_61,J_CHICKENPOX_83,LOTTO_WIN_01, LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_BRBL, THOUS_EMAIL_ADDRS,TO_CC_NONE,UNCLAIMED_MONEY autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_23 BODY: 2alpha-pock-3alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 2.4 UNCLAIMED_MONEY BODY: People just leave money laying around * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_14 BODY: 1alpha-pock-4alpha * 0.6 J_CHICKENPOX_13 BODY: 1alpha-pock-3alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [66.79.163.50 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.116.160.176 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from secure.trigohost.com (ns1.kandooey.com [66.79.163.50] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0QDeYLU014613 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 26 Jan 2009 05:40:39 -0800 Received: from 1cust176.tnt33.rtm1.nld.da.uu.net ([213.116.160.176] helo=thisday) by secure.trigohost.com with esmtpa (Exim 4.69) (envelope-from ) id 1LRRhH-0008G5-N8; Mon, 26 Jan 2009 05:40:19 -0800 Message-ID: <001601c9801e$aacd8abf$2a969e29@pmpz> From: "De lotto" Subject: [SPAM] Lotto Millionaire Results Date: Mon, 26 Jan 2009 14:35:02 +0100 Organization: lotto.nl MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - secure.trigohost.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - games.com X-Greylist: Delayed for 32:48:18 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 26 Jan 2009 05:40:39 -0800 (PST) X-Spam-Prev-Subject: Lotto Millionaire Results Status: R X-Status: X-Keywords: X-UID: 56 Content-Length: 6803
De Lotto.
Operators of De Lotto Millionaire
laan van Hoornwijck 55 2289 DG Rijswijk.
Amsterdam The Netherlands
KvK: 41151075
 
    
WINNING NOTIFICATION
 
The Netherlands Millionaire Lotto wishes to inform you  that the results of the Millionaire lotto Promo is out and 
you are been chosen as the second winner for the programme by the Millionaire Lotto held on the  24th of JANUARY 2009. 
Your Email has been picked as a winner of a lump  sum pay out of Nine Hundred Thousand euros (9 hundres thounsand).
 
 
The Millionaire Lotto. draws was conducted from an  exclusive list of 13 lucky emails of individual and corporate
 bodies picked by an advanced automated random computer search. No tickets were sold.
 
 -------------------------------------------------------
You email address is attached to
Your Batch No: LSN 2009/81345
Your Reference No:LSN 6976/aico/009
Your Ticket No: LSN 912746372/lco/ 07421 
Your Security File No: LSN 63183/lco/7730 
---------------------------------------------------------
 
To begin your claim, do file for the release of your winning by contacting the Corporate Officer below.
 
Mr. Ron Vlietveld
De Lotto Corporate Officer
Email:millionaire.lotto@games.com
 
Indicate your Full Name, Address, Country, Telephone, Mobile, Fax Number, Occupation and Age. 
 
Failure to provide the information above will result to immediate disqualification !!
 
This promotion is this year's De Lotto Deaf in conjunction with Lotto Millionaire New Year bonanza. All winning must be 
claimed not later than 10 working days from this notification. After this time  all unclaimed funds will be returned to 
De Lotto Treasury Department as unclaimed.
 
Congratulations!!
 
Sincerely,
 
Mrs. Leonie Hartwig.
Lottery Coordinator.
 
 
****************************************************************************** . 
De informatie in dit email bericht is vertrouwelijk en uitsluitend bestemd 
voor de geadresseerde. 
A informa??o neste E-mail ? relatada foi pretendida confidentially e 
exclusivamente para o destinat?rio. A informa??o neste boletim ? 
confidential e foi protegida possivelmente legalmente. A informa??o 
emitida com este E-mail que se relata o foi pretendida exclusivamente 
para o destinat?rio. O uso desta informa??o pela outra destinat?rio 
tem sido proibido ent?o. A publica??o, multiplicar, distribui??o e/ou 
fonte desta informa??o aos terceiros partidos n?o foram permitidas 
n?o para transferir correto e completo dos ?ndices de um E-mail 
emitido, nem para a recep??o r?pida dela. Este footer d? a esse este 
E-mail ? feito a varredura por um varredor atual do v?rus na presen?a 
do virussdn do computador. Considera??o am?vel, 
****************************************************************************
 From d.west1956@yahoo.co.in Mon Jan 26 11:44:44 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************* X-Spam-Status: Yes, score=37.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_61,MILLIONS_01, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,PHISH_05,RBL_PSBL_01,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.185.237.86 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [64.185.237.86 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from phoenix.dnsdc.com (phoenix.dnsdc.com [64.185.237.86]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0QJidii023976 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 26 Jan 2009 11:44:44 -0800 Message-Id: <200901261944.n0QJidii023976@ga.impsec.org> Received: from [82.128.34.66] (helo=User) by phoenix.dnsdc.com with esmtpa (Exim 4.69) (envelope-from ) id 1LRTQh-0003CF-2W; Mon, 26 Jan 2009 10:31:19 -0500 Reply-To: From: "MR.DANIEL WEST" Subject: [SPAM] FROM THE DESK OF MR. DANIEL WEST.......(URGENT ATTENTION) Date: Mon, 26 Jan 2009 07:31:32 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - phoenix.dnsdc.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - yahoo.co.in X-Source: X-Source-Args: X-Source-Dir: X-Greylist: Delayed for 04:11:41 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 26 Jan 2009 11:44:44 -0800 (PST) X-Spam-Prev-Subject: FROM THE DESK OF MR. DANIEL WEST.......(URGENT ATTENTION) Status: R X-Status: X-Keywords: X-UID: 57 Content-Length: 2289 FROM THE DESK OF MR. DANIEL WEST THE BILL AND EXCHANGE ACCOUNTANT. AUDITING AND ACCOUNTING UNIT. FOREIGN REMITTANCE DEPT. CHASE CHARTER BANK (C.C.B). GUERNSEY CHANNEL ISLANDS. danielwest101@live.com Dear Partner, I got your contact during my search on the Internet, search for a honest person. My name is Mr. Daniel West, the accountant in charge of auditing and accounting unit foreign remittance department of Chase Charter Bank (C.C.B), Guernsey Channel Islands. I am an British Australian by birth, 46 years of age and married with three children.Although i am not comfortable with sending this proposal to you because of the increase in SCAM and FRAUD floating around, but I am too sure that this is not Scam because you have access to confirm, provided you do not let my Bank to know the source of your information. I have packaged a financial transaction that will benefit both of us. As the accountant of the bank, On the course of the year 2007 end of the year's report,i discovered that my bank in which i am an accountant ,made Five Million Four Hundred Thousand Great British Pounds Sterling Only .(5,400,000.00 GBP) of which my head office is not aware and will never be aware of it. I have since then PLACED this fund in an ESCROW CALL ACCOUNT without a beneficiary. As the accountant in charge of auditing of the bank, I cannot be directly connected to this Money thus, I am impelled to request for your assistance to receive this money into your bank account. I intend to part 25% of this fund to you while 75% shall be for me and two officers who will assist me to move the fund to your account. I do need to assure you that there are no risks involved in this Business. All i need from you is to stand as the original depositor of this fund; If you accept this offer, I will appreciate your timely response and then we shall discuss on how you will keep our share. Please if you are satisfy with this proposal due reply me through my most confidential email address;- (danielwest101@live.com) Regards, Mr.Daniel West NB: Your early reply is highly welcomed and attaches your profiles, such as your name and address, and also your contact telephone number for easy means of communication, and your international passport for self identification. From esechick@yahoo.co.uk Mon Jan 26 20:29:33 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=21.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,JM_SOUGHT_FRAUD_3,LOTTO_YOU_WON_01,LOTTO_YOU_WON_03, SUBJ_ALL_CAPS,UNDISC_RECIPS,UPPERCASE_25_50,X_PRIORITY_HIGH,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.0 LOTTO_YOU_WON_01 BODY: You won! * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 0.0 UPPERCASE_25_50 message body is 25-50% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp-out4.iol.cz (smtp-out4.iol.cz [194.228.2.92]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0R4TTXc005554 for ; Mon, 26 Jan 2009 20:29:33 -0800 Received: from antivir6.iol.cz (unknown [192.168.30.215]) by smtp-out4.iol.cz (Postfix) with ESMTP id 4EAF9CE68DF; Tue, 27 Jan 2009 03:54:59 +0000 (UTC) Received: from localhost (antivir6.iol.cz [127.0.0.1]) by antivir6.iol.cz (Postfix) with ESMTP id 38C2F1C44032; Tue, 27 Jan 2009 04:54:59 +0100 (CET) X-Virus-Scanned: amavisd-new at iol.cz Received: from antivir6.iol.cz ([127.0.0.1]) by localhost (antivir6.iol.cz [127.0.0.1]) (amavisd-new, port 10224) with LMTP id gNVZ9zsfTIYJ; Tue, 27 Jan 2009 04:54:58 +0100 (CET) Received: from smtp-out4.iol.cz (mta-out4 [192.168.30.31]) by antivir6.iol.cz (Postfix) with ESMTP id E877E1C44031; Tue, 27 Jan 2009 04:54:58 +0100 (CET) Received: from User (92.41.154.100.sub.mbb.three.co.uk [92.41.154.100]) by smtp-out4.iol.cz (Postfix) with ESMTP id 2919170406B; Tue, 27 Jan 2009 04:54:10 +0100 (CET) Reply-To: From: "YAHOO MSN PROMOTIONS" Subject: [SPAM] ATTENTION:PRIVATE MASSAGE:/// Date: Tue, 27 Jan 2009 03:55:00 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090127035411.2919170406B@smtp-out4.iol.cz> To: undisclosed-recipients:; X-Greylist: Delayed for 00:29:53 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 26 Jan 2009 20:29:33 -0800 (PST) X-Spam-Prev-Subject: ATTENTION:PRIVATE MASSAGE:/// Status: R X-Status: X-Keywords: X-UID: 58 Content-Length: 1212 FROM: THE DESK OF THE CLAIMS DIRECTOR, YAHOO MSN LIVE INTERNATIONAL PROMOTIONS / PRIZE AWARD DEPARTMENT, REF: YAHOO6/315116127/27 BATCH: 8254297137 Registered Lottery No 220949 (Thanks for contributing to our Financial Success) ATTENTION: LUCKY WINNER We are pleased to inform you that your e-mail address has won the UK Sweepstakes International Programme.Therefore you have been approve for a lump sum payout (?500,000.00 Pounds) in the Uk Sweepstakes International Program held on 20th JANUARY 2009, and release 26th JANUARY 2009. Your e-mail ID emerged as one of the winners in the 1st category. Please fill the form below and send it to our payment department with the contact given below. (REMMITANCE DIRECTOR) NAME: MR WEST NEWTON EMAIL: west_off@live.co.uk Tell: +44-795-516-7964 Fax: +44-870-974-6645 To View Some Of Our Past Lucky Winner Click: **http://img.timeinc.net/TFK/media/news/2006a/060222_lottery_hor.jpg **http://images.usatoday.com/news/_photos/2005/09/23/lottery-winners-inside.jpg PAYMENT PROCESSING FORM 1.Full Name: 2.Full Address: 3.Status: 4.Occupation: 5.Phone Number: 6.Country: Yours faithfully, Mrs.Sherrell Barber (Zonal Coordinator) YAHOO MSN PROMOTIONS From winners@toyota.co.uk Mon Jan 26 21:51:22 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********** X-Spam-Status: Yes, score=11.8 required=5.0 tests=BAYES_99,BL_COUNTRY_BR_1, FILL_THIS_FORM_01,J_CHICKENPOX_52,LOTTO_YOU_WON_02,LOTTO_YOU_WON_03, SPAMMY_WEBMAIL,SPF_FAIL,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 1.1 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=winners%40toyota.co.uk&ip=201.90.89.245&receiver=ga.impsec.org] * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL Received: from rorainopolis.cti.rr.gov.br (rorainopolis.cti.rr.gov.br [201.90.89.245]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0R5pGED007512 for ; Mon, 26 Jan 2009 21:51:21 -0800 Received: from localhost (localhost.localdomain [127.0.0.1]) by rorainopolis.cti.rr.gov.br (Postfix) with ESMTP id 1D586DA4A5; Tue, 27 Jan 2009 00:45:42 -0400 (AMT) Received: from rorainopolis.cti.rr.gov.br ([127.0.0.1]) by localhost (localhost.localdomain [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IsyGrDC+wY94; Tue, 27 Jan 2009 00:45:41 -0400 (AMT) Received: from webmail.cti.rr.gov.br (localhost.localdomain [127.0.0.1]) by rorainopolis.cti.rr.gov.br (Postfix) with ESMTP id DA0BADA475; Tue, 27 Jan 2009 00:45:39 -0400 (AMT) Received: from 78.138.26.146 (SquirrelMail authenticated user decoex@cti.rr.gov.br) by webmail.cti.rr.gov.br with HTTP; Tue, 27 Jan 2009 00:45:40 -0400 (AMT) Message-ID: <1727.78.138.26.146.1233031540.squirrel@webmail.cti.rr.gov.br> Date: Tue, 27 Jan 2009 00:45:40 -0400 (AMT) Subject: [SPAM] You have won =?iso-8859-1?Q?=A3600=2C000.00._&_A_Brand_New_Toyota_Pirus_Car?= From: "Toyota Car Promotions" Reply-To: dr.davidrugman@hotmail.co.uk User-Agent: SquirrelMail/1.4.9a MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal To: undisclosed-recipients:; X-Greylist: Delayed for 00:49:01 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 26 Jan 2009 21:51:22 -0800 (PST) X-Spam-Prev-Subject: You have won Status: R X-Status: X-Keywords: X-UID: 59 The Lottery Department United Kingdom Toyota Car Promotions CVR-nr. 25554493. You have been selected for a Cash prize of 600,000.00.(Six Hundred Thousand Great British Pounds) and a brand new Toyota Prius car.You are to Contact your Agent:Dr. David Rugman. via. Email:dr.davidrugman@hotmail.co.uk When contacting him, please provide him with your code number 799BV91. 1.Full names: 2. Sex: 3.Age: 4.Occupation: 5. Residential address: 6. Phone number: 7.Nationality: Regards... Mr.Heather Washington Lottery Manager From info@lg.com Tue Jan 27 02:12:36 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.6 required=5.0 tests=BAYES_99,BL_COUNTRY_TW_1, BL_COUNTRY_TW_2,JM_SOUGHT_FRAUD_3,LOTTO_FROM,LOTTO_WIN_01,LOTTO_YOU_WON_02, LOTTO_YOU_WON_03,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SUBJ_ALL_CAPS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 2.0 LOTTO_FROM Admits to being a lottery * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [211.23.3.82 listed in tw.countries.nerd.dk] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.unipoint.com.tw (unipoint.com.tw [211.23.3.82] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0RACVxf014222 for ; Tue, 27 Jan 2009 02:12:35 -0800 Received: from mail.unipoint.com.tw (localhost [127.0.0.1]) by mail.unipoint.com.tw (Postfix) with ESMTP id D2E921C75F5; Tue, 27 Jan 2009 17:46:50 +0800 (CST) Received: from test.eflash.unipoint.com.tw (localhost [127.0.0.1]) by mail.unipoint.com.tw (Postfix) with ESMTP id 84D661C74CC; Tue, 27 Jan 2009 17:46:47 +0800 (CST) From: "LG ELECTRONICS INTERNATIONAL COMPUTER LOTTERY" Reply-To: lg.fundsclearancedept@gmail.com Subject: [SPAM] LG PROMO DRAW:::::::YOU ARE A WINNER ! Date: Tue, 27 Jan 2009 17:46:47 +0800 Message-Id: <20090127094650.M76176@lg.com> X-Mailer: OpenWebMail 2.52 20060502 X-OriginatingIP: 192.168.0.3 (unipoint) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 To: undisclosed-recipients:; X-NetStation-Status: PASS X-NetStation-SPAM: 0.00/6.00-7.00 X-Greylist: Delayed for 00:23:42 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 27 Jan 2009 02:12:35 -0800 (PST) X-Spam-Prev-Subject: LG PROMO DRAW:::::::YOU ARE A WINNER ! Status: R X-Status: X-Keywords: X-UID: 60 Content-Length: 1220 LG United Kingdom Head Office : LG House, 250 Bath Road, Slough, Berkshire, SL1 4DX We wish to congratulate you over your email success in our UPLIFT INTERNATIONAL COMPUTER LOTTERY PROGRAM. This is a millennium scientific computer game in which email addresses were used.It is a promotional program aimed at encouraging internet users; therefore you do not need to buy ticket to enter for it. You have been approve for the star prize of 750 000.000 (Seven Hundred And Fifty Thousand Great British Pounds) CONGRATULATIONS!! To claim your winning prize you are to contact our Capital financial agent as soon as possible. CAPITAL FINANCIAL AGENT .S.L Mr.Churchill Daves Email: lg.fundsclearancedept@gmail.com lg.fundsclearancedept@yahoo.co.uk Batch No: SUTO/980/TWM/EU Ticket No: WRNM/SMI/5990 Lucky No: 10-23-44-72-80 Serial No: MUOTI/82536 You must contact the appointed agent with your Full Names, Contact Address, occupation and Telephone Numbers (Home / Office / Mobile Number ) via email to enable him process and provide you with the contact details of our affiliated bank were you are to cash your winning prize. Thank you. Best Regards, Mrs. Kate. G. Castle Zonal Director From patrickarmstrong19@yahoo.es Tue Jan 27 05:27:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.3 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_NG_2,FREEMAIL_FROM,FROM_EXCESS_QP,HTML_50_60,HTML_MESSAGE, JM_SOUGHT_FRAUD_2,J_CHICKENPOX_65,RCVD_IN_BL_SPAMCOP_NET,SUBJ_ALL_CAPS, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.0 FROM_EXCESS_QP From: quoted-printable encoded unnecessarily * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n20.bullet.mail.ukl.yahoo.com (n20.bullet.mail.ukl.yahoo.com [87.248.110.137]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0RDR58q019356 for ; Tue, 27 Jan 2009 05:27:09 -0800 Received: from [217.146.182.179] by n20.bullet.mail.ukl.yahoo.com with NNFMP; 27 Jan 2009 12:59:19 -0000 Received: from [87.248.110.107] by t5.bullet.ukl.yahoo.com with NNFMP; 27 Jan 2009 12:59:19 -0000 Received: from [127.0.0.1] by omp212.mail.ukl.yahoo.com with NNFMP; 27 Jan 2009 12:59:19 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 97280.2365.bm@omp212.mail.ukl.yahoo.com Received: (qmail 94997 invoked by uid 60001); 27 Jan 2009 12:59:18 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.es; h=Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=mn6h2GUwR50b27If4ufCxgP1q6W/06PhUH9ufMl34YEMr/Z+rSZrcY7JZSlJqeEH+hhAHQ/bCRXmVIvfd/PKaRySJ/WBfwh9LXZSSUUZVsULZb2NhdtKezOtGh5QfJy78RlnvErbATeMMh8V/bwTdQqWg/QxQCxIEfgXMWKb0hI=; Received: from [212.100.69.25] by web24607.mail.ird.yahoo.com via HTTP; Tue, 27 Jan 2009 04:59:18 PST Date: Tue, 27 Jan 2009 04:59:18 -0800 (PST) From: =?iso-8859-1?q?Patrick=20Armstrong?= Subject: [SPAM] CAN I TRUST YOU? To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-360540472-1233061158=:93156" Content-Transfer-Encoding: 8bit Message-ID: <821746.93156.qm@web24607.mail.ird.yahoo.com> X-Greylist: Delayed for 00:27:45 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 27 Jan 2009 05:27:09 -0800 (PST) X-Spam-Prev-Subject: CAN I TRUST YOU? Status: R X-Status: X-Keywords: X-UID: 61 Content-Length: 1377 --0-360540472-1233061158=:93156 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Tengo nueva direccin de correo!Ahora puedes escribirme a: patrickarmstrong19@yahoo.es - Dear Friend,First and foremost the transaction demands absolute confidentiality as the people involved is men of integrity. Therefore, even if you will not be ready to be part of this transaction, I will suggest you still keep it to your self --0-360540472-1233061158=:93156 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
Tengo nueva direccin de correo!
Ahora puedes escribirme a: patrickarmstrong19@yahoo.es



- Dear Friend,First and foremost the transaction demands absolute confidentiality as the people involved is men of integrity. Therefore, even if you will not be ready to be part of this transaction, I will suggest you still keep it to your self
--0-360540472-1233061158=:93156-- From patrickarmstrong19@yahoo.es Tue Jan 27 05:40:24 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DNS_FROM_RFC_ABUSE, FREEMAIL_FROM,FREEMAIL_REPLYTO,FROM_EXCESS_QP,HTML_10_20,HTML_MESSAGE, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_65,PHISH_05, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,SUBJ_ALL_CAPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [212.100.69.25 listed in zen.spamhaus.org] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.0 FROM_EXCESS_QP From: quoted-printable encoded unnecessarily * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n27.bullet.mail.ukl.yahoo.com (n27.bullet.mail.ukl.yahoo.com [87.248.110.144]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0RDeKxL019572 for ; Tue, 27 Jan 2009 05:40:24 -0800 Received: from [217.12.4.215] by n27.bullet.mail.ukl.yahoo.com with NNFMP; 27 Jan 2009 13:27:35 -0000 Received: from [87.248.110.112] by t2.bullet.ukl.yahoo.com with NNFMP; 27 Jan 2009 13:27:35 -0000 Received: from [127.0.0.1] by omp217.mail.ukl.yahoo.com with NNFMP; 27 Jan 2009 13:27:35 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 71455.19595.bm@omp217.mail.ukl.yahoo.com Received: (qmail 29567 invoked by uid 60001); 27 Jan 2009 13:27:34 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.es; h=Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=vTuAprwwkO1yqR6IgikzmEAuCIV0Yf323zwZEwy6YmzG6I5U0iV6ivfPWzPo8DhKQx4do8H1nlyhfgF7xO+mAAJ6hUTjmzsbz/JZfIcfWHZWEZJQE30gD8QMwOQplf6hce3jt6x3MWILsw4gUWyPWlvZGXXlNiB8c8k7FedDI7o=; Received: from [212.100.69.25] by web24611.mail.ird.yahoo.com via HTTP; Tue, 27 Jan 2009 05:27:34 PST Date: Tue, 27 Jan 2009 05:27:34 -0800 (PST) From: =?iso-8859-1?q?Patrick=20Armstrong?= Subject: [SPAM] CAN I TRUST YOU? To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-331891098-1233062854=:27074" Content-Transfer-Encoding: 8bit Message-ID: <827327.27074.qm@web24611.mail.ird.yahoo.com> X-Greylist: Delayed for 00:15:33 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 27 Jan 2009 05:40:24 -0800 (PST) X-Spam-Prev-Subject: CAN I TRUST YOU? Status: R X-Status: X-Keywords: X-UID: 62 Content-Length: 4426 --0-331891098-1233062854=:27074 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Tengo nueva direccin de correo!Ahora puedes escribirme a: patrickarmstrong19@yahoo.es - Dear Friend,First and foremost the transaction demands absolute confidentiality as the people involved is men of integrity. Therefore, even if you will not be ready to be part of this transaction, I will suggest you still keep it to your self. I am a personal attorney to Dr. James Whitewood who is the Auditor manager of Bacleys Bank London. He has asked me to solicit your assistance to transfer 38.2.Million brithish pounds This fund is the excess of what his branch in which he is the manger made as profit during the last year. He has already submitted an approved End of the Year report for the year 2008 to the Head Office here in London and they will never know of this Excess. He has since then, placed this amount of 38.2.Million brithish pounds on an ESCROW ACCOUNT within the same bank.As an officer of the bank, he cannot be directly connected to this money thus he was compelled to request for your assistance to receive this money into your bank account. He intend to part 30% of this fund to you while 70% shall be for him. May I inform you that there is practically no risk involved in this It's going to be a bank-to-bank transfer. All I need from you is to stand as the original depositor of this fund as I will personally obtain all the relevant document on your behalf that will authenticate you as the beneficiary of the fund in question, please if you can assist, please get back to me as soon as possible with your details Vis--vis your telephone numbers and your account details for the purpose of transfer. Further information will be communicated to you as soon as we here from you.Looking forward to your understanding and compliance.From henceforth reply to my private email on bnnajipatrick@hotmail.com Regards,Patrick Armstrong Esq. --0-331891098-1233062854=:27074 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
Tengo nueva direccin de correo!
Ahora puedes escribirme a: patrickarmstrong19@yahoo.es



- Dear Friend,First and foremost the transaction demands absolute confidentiality as the people involved is men of integrity. Therefore, even if you will not be ready to be part of this transaction, I will suggest you still keep it to your self. I am a personal attorney to Dr. James Whitewood who is the Auditor manager of Bacleys Bank London. He has asked me to solicit your assistance to transfer 38.2.Million brithish pounds This fund is the excess of what his branch in which he is the manger made as profit during the last year. He has already submitted an approved End of the Year report for the year 2008 to the Head Office here in London and they will never know of this Excess. He has since then, placed this amount of 38.2.Million brithish pounds on an ESCROW ACCOUNT within the same bank.As an officer of the bank, he cannot be directly connected to this money thus he was compelled to request for your assistance to receive this money into your bank account. He intend to part 30% of this fund to you while 70% shall be for him. May I inform you that there is practically no risk involved in this It's going to be a bank-to-bank transfer. All I need from you is to stand as the original depositor of this fund as I will personally obtain all the relevant document on your behalf that will authenticate you as the beneficiary of the fund in question, please if you can assist, please get back to me as soon as possible with your details Vis--vis your telephone numbers and your account details for the purpose of transfer. Further information will be communicated to you as soon as we here from you.Looking forward to your understanding and compliance.From henceforth reply to my private email on bnnajipatrick@hotmail.com Regards,Patrick Armstrong Esq.
--0-331891098-1233062854=:27074-- From patrickarmstrong19@yahoo.es Tue Jan 27 05:52:00 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FREEMAIL_FROM, FREEMAIL_REPLYTO,FROM_EXCESS_QP,HTML_10_20,HTML_MESSAGE,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_65,PHISH_05,RCVD_IN_BL_SPAMCOP_NET, SUBJ_ALL_CAPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.0 FROM_EXCESS_QP From: quoted-printable encoded unnecessarily * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n27.bullet.mail.ukl.yahoo.com (n27.bullet.mail.ukl.yahoo.com [87.248.110.144]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0RDpuqh019741 for ; Tue, 27 Jan 2009 05:52:00 -0800 Received: from [217.146.182.178] by n27.bullet.mail.ukl.yahoo.com with NNFMP; 27 Jan 2009 13:24:42 -0000 Received: from [87.248.111.151] by t4.bullet.ukl.yahoo.com with NNFMP; 27 Jan 2009 13:24:42 -0000 Received: from [127.0.0.1] by omp208.mail.ukl.yahoo.com with NNFMP; 27 Jan 2009 13:24:42 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 852620.12130.bm@omp208.mail.ukl.yahoo.com Received: (qmail 65874 invoked by uid 60001); 27 Jan 2009 13:24:42 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.es; h=Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=ngK2nZbUj2Bn+Vc/WVka0bsGh4nk2pBcvVB3txVUt9suPZZxIIWnbhpOYuoavkGII/tzCwR/uQ8k1afe4UPHVuPaoVT0lhsE49op9aNKzRwsd6oN/6GevZy/3zXR/C6CbWnHpYnrxoGkJjw5D2hUkarZjYUL19HSF7w5RqSkN1c=; Received: from [212.100.69.25] by web24608.mail.ird.yahoo.com via HTTP; Tue, 27 Jan 2009 05:24:42 PST Date: Tue, 27 Jan 2009 05:24:42 -0800 (PST) From: =?iso-8859-1?q?Patrick=20Armstrong?= Subject: [SPAM] CAN I TRUST YOU? To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1959481378-1233062682=:64011" Content-Transfer-Encoding: 8bit Message-ID: <498891.64011.qm@web24608.mail.ird.yahoo.com> X-Spam-Prev-Subject: CAN I TRUST YOU? Status: R X-Status: X-Keywords: X-UID: 63 Content-Length: 4429 --0-1959481378-1233062682=:64011 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Tengo nueva direccin de correo!Ahora puedes escribirme a: patrickarmstrong19@yahoo.es - Dear Friend,First and foremost the transaction demands absolute confidentiality as the people involved is men of integrity. Therefore, even if you will not be ready to be part of this transaction, I will suggest you still keep it to your self. I am a personal attorney to Dr. James Whitewood who is the Auditor manager of Bacleys Bank London. He has asked me to solicit your assistance to transfer 38.2.Million brithish pounds This fund is the excess of what his branch in which he is the manger made as profit during the last year. He has already submitted an approved End of the Year report for the year 2008 to the Head Office here in London and they will never know of this Excess. He has since then, placed this amount of 38.2.Million brithish pounds on an ESCROW ACCOUNT within the same bank.As an officer of the bank, he cannot be directly connected to this money thus he was compelled to request for your assistance to receive this money into your bank account. He intend to part 30% of this fund to you while 70% shall be for him. May I inform you that there is practically no risk involved in this It's going to be a bank-to-bank transfer. All I need from you is to stand as the original depositor of this fund as I will personally obtain all the relevant document on your behalf that will authenticate you as the beneficiary of the fund in question, please if you can assist, please get back to me as soon as possible with your details Vis--vis your telephone numbers and your account details for the purpose of transfer. Further information will be communicated to you as soon as we here from you.Looking forward to your understanding and compliance.From henceforth reply to my private email on bnnajipatrick@hotmail.con Regards,Patrick Armstrong Esq. --0-1959481378-1233062682=:64011 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
Tengo nueva direccin de correo!
Ahora puedes escribirme a: patrickarmstrong19@yahoo.es



- Dear Friend,First and foremost the transaction demands absolute confidentiality as the people involved is men of integrity. Therefore, even if you will not be ready to be part of this transaction, I will suggest you still keep it to your self. I am a personal attorney to Dr. James Whitewood who is the Auditor manager of Bacleys Bank London. He has asked me to solicit your assistance to transfer 38.2.Million brithish pounds This fund is the excess of what his branch in which he is the manger made as profit during the last year. He has already submitted an approved End of the Year report for the year 2008 to the Head Office here in London and they will never know of this Excess. He has since then, placed this amount of 38.2.Million brithish pounds on an ESCROW ACCOUNT within the same bank.As an officer of the bank, he cannot be directly connected to this money thus he was compelled to request for your assistance to receive this money into your bank account. He intend to part 30% of this fund to you while 70% shall be for him. May I inform you that there is practically no risk involved in this It's going to be a bank-to-bank transfer. All I need from you is to stand as the original depositor of this fund as I will personally obtain all the relevant document on your behalf that will authenticate you as the beneficiary of the fund in question, please if you can assist, please get back to me as soon as possible with your details Vis--vis your telephone numbers and your account details for the purpose of transfer. Further information will be communicated to you as soon as we here from you.Looking forward to your understanding and compliance.From henceforth reply to my private email on bnnajipatrick@hotmail.con Regards,Patrick Armstrong Esq.
--0-1959481378-1233062682=:64011-- From 32324254356346464@earthlink.net Tue Jan 27 10:34:25 2009 Return-Path: <32324254356346464@earthlink.net> X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,DNS_FROM_RFC_ABUSE, FROM_ALL_NUMS,FROM_LOCAL_HEX,FROM_STARTS_WITH_NUMS,J_CHICKENPOX_48, J_CHICKENPOX_73,LOTTO_YOU_WON_03,PHISH_05,SPAMMY_WEBMAIL,SUBJ_ALL_CAPS, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.7 FROM_STARTS_WITH_NUMS From: starts with many numbers * 2.5 FROM_ALL_NUMS From numeric address (except US/Canada phones) * 1.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9994] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from elasmtp-mealy.atl.sa.earthlink.net (elasmtp-mealy.atl.sa.earthlink.net [209.86.89.69]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0RIYM4P027089 for ; Tue, 27 Jan 2009 10:34:25 -0800 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=Jmt6bPBWOedoO40ruQcKaFStVtz7BX+sBwVKeBBY+L9nvVujpTN/zD+rCmB3mYqr; h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-ELNK-Trace:X-Originating-IP; Received: from [209.86.224.24] (helo=mswamui-andean.atl.sa.earthlink.net) by elasmtp-mealy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <32324254356346464@earthlink.net>) id 1LRsQU-0004hh-PQ; Tue, 27 Jan 2009 13:12:42 -0500 Received: from 195.244.131.102 by webmail.earthlink.net with HTTP; Tue, 27 Jan 2009 13:12:40 -0500 Message-ID: <27676473.1233079961515.JavaMail.root@mswamui-andean.atl.sa.earthlink.net> Date: Tue, 27 Jan 2009 10:12:40 -0800 (GMT-08:00) From: MRS THERESA NDU <32324254356346464@earthlink.net> Reply-To: MRS THERESA NDU Subject: [SPAM] 27TH JANUARY 2007 Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Mailer: EarthLink Zoo Mail 1.0 X-ELNK-Trace: a2e915a2cfcfeef771d82387afad1f43f4a2db096a8e397d7e972de0d01da940df65e6f719820aa6fe24007dc2faaf81350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 209.86.224.24 X-Greylist: Delayed for 00:20:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 27 Jan 2009 10:34:25 -0800 (PST) X-Spam-Prev-Subject: 27TH JANUARY 2007 Status: R X-Status: X-Keywords: X-UID: 64 Content-Length: 2477 FROM THE DESK OF; MRS THERESA NDU INTERNATIONAL TRANSFER DEPT. OF THE CENTRAL BANK OF NIGERIA PRIVATE EMAIL:theresandu@hotmail.com Dear Friend, I know that you might be surprise on this mail, but I am here to inform you the truth. I know that it is against my official duty to release confidential issues like this to an outsider, there is nothing I can do but to help you beside this, I am taking this bold step because of my belief as a Christian. What i want to inform you is about your contract payment with the Federal Government of Nigeria,totalling 6.8m EUROS. {SIX MILLION EIGHT HUNDRED THOUSAND EUROS.ONLY},which was willed in your favor by the late original beneficiary. There are lot of forces working against you right from the last CBN Governor Chief Joseph Sanusi and the current Governor Prof. Charles Soludo they have been frustrating you by demanding upfront payment from you constantly, this is to inform you that they are using all these money that you have been sending to them to work against you and your fund have been delayed. You may not believe it, but it is the reality. There is a way I can assist you to get your fund without you paying any charges. it is a risk but one have to take it, I have assisted one woman from Mexico and it worked out though her fund was Us$5,000,000.00.What you have to do is to open another bank account any where, so that once your fund is transfer, and you confirm with your bankkers that it is in your account, then you can re-transfer the funds to this new account you must have opened. I know the reason I want it this way.If you want me to go ahead, let me know as soon as you get this mail, if I make this transfer this week, it might be next month that they will find out and by then, you have re-transferred the fund into another account,Get back to me as soon as you get this email, via my private email:theresandu@hotmail.com with the following informations.so that I will be in a better position to know what to do.You are advice to reconfirm the following information for immediate processing of your fund. 1) Your full names, address and direct phone and mobile numbers. 2) company name,position and address. 3) Age and Marital status. 4) Scan copy of any identification. 5) ACCOUNT NAME, BANK NAME AND ADDRESS. 6) ACCOUNT NUMBER AND ROUTING NUMBER Thanks for your cooperation, MRS THERESA NDU INTERNATIONAL TRANSFER DEPT. OF THE CENTRAL BANK OF NIGERIA PRIVATE EMAIL:theresandu@hotmail.com From danielwest_101@ccb.com Tue Jan 27 16:30:50 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DNS_FROM_RFC_DSN, FORGED_MUA_OUTLOOK,J_CHICKENPOX_61,MILLIONS_01,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,PHISH_05,RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.185.237.86 listed in b.barracudacentral.org] * 2.6 DNS_FROM_RFC_DSN RBL: Envelope sender in dsn.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [64.185.237.86 listed in psbl.surriel.com] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from phoenix.dnsdc.com (phoenix.dnsdc.com [64.185.237.86]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0S0UhC1004807 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 27 Jan 2009 16:30:50 -0800 Message-Id: <200901280030.n0S0UhC1004807@ga.impsec.org> Received: from [82.128.26.83] (helo=User) by phoenix.dnsdc.com with esmtpa (Exim 4.69) (envelope-from ) id 1LRo1l-00050k-K9; Tue, 27 Jan 2009 08:30:55 -0500 Reply-To: From: "DANIEL WEST" Subject: [SPAM] AWAITING URGENT RESPOND Date: Tue, 27 Jan 2009 05:31:08 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - phoenix.dnsdc.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ccb.com X-Source: X-Source-Args: X-Source-Dir: X-Greylist: Delayed for 10:58:16 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 27 Jan 2009 16:30:50 -0800 (PST) X-Spam-Prev-Subject: AWAITING URGENT RESPOND Status: R X-Status: X-Keywords: X-UID: 65 Content-Length: 2284 FROM THE DESK OF MR. DANIEL WEST THE BILL AND EXCHANGE ACCOUNTANT. AUDITING AND ACCOUNTING UNIT. FOREIGN REMITTANCE DEPT. CHASE CHARTER BANK (C.C.B). GUERNSEY CHANNEL ISLANDS. danielwest_101@live.com Dear Partner, I got your contact during my search on the Internet, search for a honest person. My name is Mr. Daniel West, the accountant in charge of auditing and accounting unit foreign remittance department of Chase Charter Bank (C.C.B), Guernsey Channel Islands. I am an Australian by birth, 46 years of age and married with three children.Although i am not comfortable with sending this proposal to you because of the increase in SCAM and FRAUD floating around, but I am too sure that this is not Scam because you have access to confirm, provided you do not let my Bank to know the source of your information. I have packaged a financial transaction that will benefit both of us. As the accountant of the bank, On the course of the year 2007 end of the year's report,i discovered that my bank in which i am an accountant ,made Five Million Four Hundred Thousand Great British Pounds Sterling Only .(5,400,000.00 GBP) of which my head office is not aware and will never be aware of it. I have since then PLACED this fund in an ESCROW CALL ACCOUNT without a beneficiary. As the accountant in charge of auditing of the bank, I cannot be directly connected to this Money thus, I am impelled to request for your assistance to receive this money into your bank account. I intend to part 25% of this fund to you while 75% shall be for me and two officers who will assist me to move the fund to your account. I do need to assure you that there are no risks involved in this Business. All i need from you is to stand as the original depositor of this fund; If you accept this offer, I will appreciate your timely response and then we shall discuss on how you will keep our share. Please if you are satisfy with this proposal due reply me through my most confidential email address;- (danielwest_101@live.com) Regards, Mr.Daniel West NB: Your early reply is highly welcomed and attaches your profiles, such as your name and address, and also your contact telephone number for easy means of communication, and your international passport for self identification. From scottbrown1182@yahoo.com Tue Jan 27 20:37:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_80,DEAR_FRIEND,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS, FORGED_YAHOO_RCVD,FREEMAIL_FROM,FREEMAIL_REPLYTO,RAZOR2_CHECK,SUBJ_ALL_CAPS, THOUS_EMAIL_ADDRS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.9221] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from server.ekon.go.id (server.ekon.go.id [203.135.180.52]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0S4bA3s011192 for ; Tue, 27 Jan 2009 20:37:16 -0800 Received: from www.ekon.go.id (server.ekon.go.id [127.0.0.1]) by server.ekon.go.id (Postfix) with ESMTP id 33C2D8C6987; Tue, 27 Jan 2009 17:54:38 +0700 (WIT) Received: from 127.0.0.1 (proxying for 123.136.101.197) (SquirrelMail authenticated user awahyudi) by www.ekon.go.id with HTTP; Tue, 27 Jan 2009 17:54:38 +0700 (WIT) Message-ID: <57174.127.0.0.1.1233053678.squirrel@www.ekon.go.id> Date: Tue, 27 Jan 2009 17:54:38 +0700 (WIT) Subject: [SPAM] RE:BUSINESS PROPOSAL From: "Dr Scott Brown" Reply-To: scottbrown52@gmail.com User-Agent: SquirrelMail/1.4.8 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal To: undisclosed-recipients:; X-Greylist: Delayed for 13:49:51 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 27 Jan 2009 20:37:16 -0800 (PST) X-Spam-Prev-Subject: RE:BUSINESS PROPOSAL Status: R X-Status: X-Keywords: X-UID: 66 Content-Length: 1926 Dear Friend, My name is DR SCOTT BROWN , I'm a regional purchasing manager of Medivet Veterinary Group Co. Ltd, here in UK before I had a car accident, And I cannot go for this trip because of my present condition. That is why am contacting you. I used to represent my company to several Asian countries to purchase a product called Adequan i.m injection r/x equine, this product is a vaccines use for animal treatments especially horses. As of this proposal, please find the statements below: 1. First, I will introduce you to my company's General Manager as being the main and only supplier of the vaccines. 2. Secondly, per packet of the vaccine costs USD$5,500 in UNITED STATE, but in Asia Malaysia where I have been purchasing, it only costs USD$2,500 per packet. And you will supply to my company for USD$5,000. Per packet. 3. Note, do not disclose the actual cost of the vaccine i.e. USD$2,500 to my company GM as this will affect our profit. 4. My companies directors dont know the seller of this product and the seller doesn't know my company directors, I'll introduce you as the main supplier. My company normally purchase 20, 30-70 packets in each trip I make depending on the product we have left in the company. The distributor of this product is a Malaysian, you will purchase the product from the malaysia dealer and supply to my company, my company will now pay you cash on delivery. Let the above mentioned be in mutual beneficiary for us and an opportunity to embark in future engagements. I need somebody trustworthy to introduce as the main supplier to my company. Finally, if you wish to take up this offer, kindly email me and I will reply you with all the contact details and that of my GM whom you will contact and send you quotation. I also will give you the price to quote; in return my GM will then issue you an LPO (Legal Purchasing Order). Await you response . Regards, Dr Scott Brown From minity55555555555@yahoo.co.jp Wed Jan 28 02:02:28 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************************** X-Spam-Status: Yes, score=30.7 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, FROM_ENDS_IN_NUMS,FROM_LOCAL_HEX,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_BRBL, RCVD_IN_SORBS_WEB,SPF_SOFTFAIL,TO_CC_NONE,UPPERCASE_25_50,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.5 FROM_ENDS_IN_NUMS From: ends in many numbers * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence * 0.5 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=minity55555555555%40yahoo.co.jp&ip=204.251.8.244&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [204.251.8.244 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.73 listed in dnsbl.sorbs.net] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 0.0 UPPERCASE_25_50 message body is 25-50% uppercase * 2.0 TO_CC_NONE No To: or Cc: header * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from notarypublic.com (mail.notarypublic.com [204.251.8.244]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0SA2O31019394 for ; Wed, 28 Jan 2009 02:02:27 -0800 Received: from User [196.3.183.73] by notarypublic.com with ESMTP (SMTPD32-8.15) id A866FC1022A; Wed, 28 Jan 2009 03:41:58 -0600 Reply-To: From: "CONTRACT/INHERITANCE FUNDS" Subject: [SPAM] CONTACT Date: Wed, 28 Jan 2009 01:42:33 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200901280342783.SM07156@User> X-Greylist: Delayed for 00:16:02 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 28 Jan 2009 02:02:28 -0800 (PST) X-Spam-Prev-Subject: CONTACT Status: R X-Status: X-Keywords: X-UID: 67 Attn:Beneficiary It was Agreed upon that your contract/Inheritance Funds would be released to you on a special method of payment which tag Name Reads "SWIFT PAYMENT".You are advice to Re-confirm the following: YOUR NAME ADDRESS OCCUPATION NEXT OF KIN PHONE AND FAX NUMBER Mrs. Victoria Douglas From wilsontour95@yahoo.com Wed Jan 28 04:43:23 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_56, J_CHICKENPOX_66,J_CHICKENPOX_73,MILLIONS_01,NA_DOLLARS,SARE_FRAUD_X3, SARE_FRAUD_X4,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_66 BODY: 6alpha-pock-6alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n77a.bullet.mail.sp1.yahoo.com (n77a.bullet.mail.sp1.yahoo.com [98.136.45.24]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n0SChJuN023733 for ; Wed, 28 Jan 2009 04:43:23 -0800 Received: from [216.252.122.217] by n77.bullet.mail.sp1.yahoo.com with NNFMP; 28 Jan 2009 12:15:43 -0000 Received: from [67.195.9.81] by t2.bullet.sp1.yahoo.com with NNFMP; 28 Jan 2009 12:15:43 -0000 Received: from [67.195.9.109] by t1.bullet.mail.gq1.yahoo.com with NNFMP; 28 Jan 2009 12:15:43 -0000 Received: from [127.0.0.1] by omp113.mail.gq1.yahoo.com with NNFMP; 28 Jan 2009 12:15:43 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 549935.54458.bm@omp113.mail.gq1.yahoo.com Received: (qmail 91203 invoked by uid 60001); 28 Jan 2009 11:31:41 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.com; h=Received:Date:From:Reply-To:Subject:To:Message-ID; b=nSGLtxNfdEfVxfAJqd2xctI/5JyAfasV1bu5cCP7glyaktk6QSQxar+rDYjnwWNPj1C1YzIkmrzZ0f1wKzoz4btavFqoGMGy34r3to+Ff4xRiE5ECV1Alr34m6Nlpj/or36+i059NiwiEwfba58mObWjrld8R8aFbV0grdizpPo=; Received: from [41.207.215.178] by web111001.mail.gq1.yahoo.com via HTTP; Wed, 28 Jan 2009 03:31:40 PST Date: Wed, 28 Jan 2009 03:31:40 -0800 (PST) From: Wilson Tour Reply-To: wilsontoure4208@hotmail.fr Subject: [SPAM] Dear Friend. Peter Wilson Toure To: jhardin@impsec.org Message-ID: <976753.79341.qm@web111001.mail.gq1.yahoo.com> X-Greylist: Delayed for 00:27:33 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 28 Jan 2009 04:43:23 -0800 (PST) X-Spam-Prev-Subject: Dear Friend. Peter Wilson Toure Status: R X-Status: X-Keywords: X-UID: 68 Content-Length: 7732 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-968337369-1233142300=:79341" Content-Transfer-Encoding: 8bit --0-968337369-1233142300=:79341 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: wilsontour95@yahoo.com - Dear Friend Greetings to you and Please permit me to introduce myself. I am Mr. Peter Wilson Toure, a South Africa citizen. I was a Coco Merchant before I was diagnosed with esophageal cancer which has defiled all medical solutions and according to medical experts I only have a few more weeks to live. As you read this you do not have to feel sorry for me as it is a universal truth that we all must die someday, I have particularly not lived my life well in spite of my wealth and possessions as I never really cared for anyone (not even myself) but my business only. Though I was very rich I was never generous, I was never caring about people but only dedicated my time, resources and my business as these were the only thing I cared about. But now I regret all these as I now know that there is more to life than just accumulating all the wealth in the world as I lay helplessly on my sick bed. If I was given a second chance to live again I sure would live my life a different way from how I have lived it owing to what has befallen me now. As my last days alive are drawing closer and closer, I have already willed out most of my properties and assets to my immediate and extended family members as well as a few close friends. I also want my soul to be at peace with God and for him to be merciful on me and accept my soul and to this regard I have resolved to give my remaining funds to charity organizations as I want this to stand as one of the last deeds I indulge in on earth before I die. Though I have already distributed money to some charity organizations, Now that my health has deteriorated so badly I can no longer continue with this myself and also I do not trust my immediate family members or close friends on this as I have once asked them to close one of my accounts and distribute the funds therein to charity organizations around the Globe, But they greedily kept the money to themselves. Presently I am contacting you with this as I have lost confidence in them because it is obvious they are not contempted wit h what I have left for them. The last of my funds which no one knows of is a cash deposit of $ 28 Million Dollars, (Twenty Eight Million U.S Dollars) stashed in 2 metalic trunk boxes and declared as Personal effects of high security value which I have with a finance/Security Company in Abidjan Cote D'ivoire West Africa. All I am asking of you is to assist me in making the collection of this cash deposit and distributing of the funds to any charity of your choice after keeping 20% of the funds for yourself and your family. Please contact me as soon as you get this letter if you are capable and sincere to handle this project on my behalf so I can forward to you all relevant documents necessary for the claims and the name of the security firm where the funds are deposited. Please if you find this mail offensive, Ignor it and accept my appology, I also want you to put me in your daily prayer, asking God to forgive me my sins and accept me back in his Bosom so that i will have part in heaven as my last day is at hand, Thanks for now as i do look forward to hear from you in other to enable me procced and gave you all the required details and informations Which will back you up in getting the Fund retreived out and legal used according to my instruction to you, May God bless you Yours truly Peter Wilson Toure. --0-968337369-1233142300=:79341 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: wilsontour95@yahoo.com



- Dear Friend Greetings to you and Please permit me to introduce myself. I am Mr. Peter Wilson Toure, a South Africa citizen. I was a Coco Merchant before I was diagnosed with esophageal cancer which has defiled all medical solutions and according to medical experts I only have a few more weeks to live. As you read this you do not have to feel sorry for me as it is a universal truth that we all must die someday, I have particularly not lived my life well in spite of my wealth and possessions as I never really cared for anyone (not even myself) but my business only. Though I was very rich I was never generous, I was never caring about people but only dedicated my time, resources and my business as these were the only thing I cared about. But now I regret all these as I now know that there is more to life than just accumulating all the wealth in the world as I lay helplessly on my sick bed. If I was given a second chance to live again I sure would live my life a different way from how I have lived it owing to what has befallen me now. As my last days alive are drawing closer and closer, I have already willed out most of my properties and assets to my immediate and extended family members as well as a few close friends. I also want my soul to be at peace with God and for him to be merciful on me and accept my soul and to this regard I have resolved to give my remaining funds to charity organizations as I want this to stand as one of the last deeds I indulge in on earth before I die. Though I have already distributed money t o some charity organizations, Now that my health has deteriorated so badly I can no longer continue with this myself and also I do not trust my immediate family members or close friends on this as I have once asked them to close one of my accounts and distribute the funds therein to charity organizations around the Globe, But they greedily kept the money to themselves. Presently I am contacting you with this as I have lost confidence in them because it is obvious they are not contempted with what I have left for them. The last of my funds which no one knows of is a cash deposit of $ 28 Million Dollars, (Twenty Eight Million U.S Dollars) stashed in 2 metalic trunk boxes and declared as Personal effects of high security value which I have with a finance/Security Company in Abidjan Cote D'ivoire West Africa. All I am asking of you is to assist me in making the collection of this cash deposit and distributing of the funds to any charity of your choice after keeping 20% of the funds for yourself and your family. Please contact me as soon as you get this letter if you are capable and sincere to handle this project on my behalf so I can forward to you all relevant documents necessary for the claims and the name of the security firm where the funds are deposited. Please if you find this mail offensive, Ignor it and accept my appology, I also want you to put me in your daily prayer, asking God to forgive me my sins and accept me back in his Bosom so that i will have part in heaven as my last day is at hand, Thanks for now as i do look forward to hear from you in other to enable me procced and gave you all the required details and informations Which will back you up in getting the Fund retreived out and legal used according to my instruction to you, May God bless you Yours truly Peter Wilson Toure.
--0-968337369-1233142300=:79341-- From correo@telefonica.net Thu Jan 29 02:47:59 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,LOTTO_YOU_WON_03,L_SOME_STD_PROBS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RCVD_IN_SBL,RCVD_IN_SORBS_WEB,RCVD_NUMERIC_HELO,SARE_FRAUD_X3,SPF_PASS, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.5 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.208.151.199 listed in zen.spamhaus.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [41.208.151.199 listed in dnsbl.sorbs.net] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.208.151.199 listed in dnsbl.sorbs.net] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout3.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0TAlroT026046 for ; Thu, 29 Jan 2009 02:47:59 -0800 Received: from User (212.100.250.217) by ctsmtpout3.frontal.correo (7.2.056.6) (authenticated as aecopa@infonegocio.com) id 497FF9FB000B0FA7; Thu, 29 Jan 2009 11:17:18 +0100 Received: from 41.208.151.199 (godisgood232002@41.208.151.199 [41.208.151.199]) by aluminium.onspeed.com (SlipStream SP Server 6.0.19 built 2007/11/22 15:27:31 -0500 (EST)); Thu, 29 Jan 2009 10:17:18 +0000 (GMT) X-Originating-IP: [41.208.151.199] X-Originating-User: [godisgood232002] Message-ID: Reply-To: From: "Mr. Issac Bailey" To: correo@telefonica.net Subject: [SPAM] INHERITANCE NOTICE.. Date: Thu, 29 Jan 2009 11:17:17 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:28:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 29 Jan 2009 02:47:59 -0800 (PST) X-Spam-Prev-Subject: INHERITANCE NOTICE.. Status: R X-Status: X-Keywords: X-UID: 69 Content-Length: 1045 Hello Friend, This is to notify you again for the last time that you have been listed as an Heir to the total sum of 'Ten Million Six Hundred Thousand Great British Pounds' in the codicil and last testament of the deceased (Name now withheld since this is our second letter to you). Our contact to you is based on the legal fact that you bear the same last name identity with the deceased therefore we can present you as the heir to the inheritance. All legal papers will be processed on your acceptance of this deal. We request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at our high court probate division for the release of this sum of money. Please indicate your interest immediately via my private email for us to proceed. I shall feed you with full details of this transaction upon receipt of your reply towards this proposal. Best Regards, Mr. Issac Bailey Tel: +44-703-596-9152 Email: contact.issac(at)rediffmail.com. From kenneth@telefonica.net Thu Jan 29 12:14:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,LOTTO_YOU_WON_03,L_SOME_STD_PROBS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SPF_PASS,SUBJ_ALL_CAPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [213.4.149.242 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.4.149.242 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [213.4.149.242 listed in psbl.surriel.com] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout2.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0TKEZtA009226 for ; Thu, 29 Jan 2009 12:14:38 -0800 Received: from User (41.214.67.66) by ctsmtpout2.frontal.correo (7.2.056.6) (authenticated as aecopa@infonegocio.com) id 498196F50007D2D6; Thu, 29 Jan 2009 20:41:32 +0100 Message-ID: <498196F50007D2D6@ctsmtpout2.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Dr. Garrett Kenneth" To: kenneth@telefonica.net Subject: [SPAM] INHERITANCE NOTICE Date: Thu, 29 Jan 2009 20:41:28 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:29:32 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 29 Jan 2009 12:14:38 -0800 (PST) X-Spam-Prev-Subject: INHERITANCE NOTICE Status: R X-Status: X-Keywords: X-UID: 70 Hello Friend, This is to notify you again for the last time that you have been listed as an Heir to the total sum of 'Ten Million Six Hundred Thousand Great British Pounds' in the codicil and last testament of the deceased (Name now withheld since this is our second letter to you). Our contact to you is based on the legal fact that you bear the same last name identity with the deceased therefore we can present you as the heir to the inheritance. All legal papers will be processed on your acceptance of this deal. We request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at our high court probate division for the release of this sum of money. Please indicate your interest immediately via my private email for us to proceed. I shall feed you with full details of this transaction upon receipt of your reply towards this proposal. Best Regards, Dr. Garrett Kenneth. Tel: +44-703-596-4009. From correo@telefonica.net Thu Jan 29 12:38:57 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FORGED, JM_SOUGHT_FRAUD_1,LOTTO_YOU_WON_03,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_NUMERIC_HELO,SARE_FRAUD_X3,SPF_PASS,SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.5 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.4.149.242 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [213.4.149.242 listed in psbl.surriel.com] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout3.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0TKcrWe009627 for ; Thu, 29 Jan 2009 12:38:56 -0800 Received: from User (212.100.250.217) by ctsmtpout3.frontal.correo (7.2.056.6) (authenticated as aecopa@infonegocio.com) id 498196E8000A4674; Thu, 29 Jan 2009 21:36:50 +0100 Received: from 41.214.67.66 (godisgood232002@41.214.67.66 [41.214.67.66]) by aluminium.onspeed.com (SlipStream SP Server 6.0.19 built 2007/11/22 15:27:31 -0500 (EST)); Thu, 29 Jan 2009 20:36:50 +0000 (GMT) X-Originating-IP: [41.214.67.66] X-Originating-User: [godisgood232002] Message-ID: Reply-To: From: "Mr. Issac Bailey" To: correo@telefonica.net Subject: [SPAM] INHERITANCE NOTICE.. Date: Thu, 29 Jan 2009 21:36:45 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: INHERITANCE NOTICE.. Status: R X-Status: X-Keywords: X-UID: 71 Content-Length: 1044 Hello Friend, This is to notify you again for the last time that you have been listed as an Heir to the total sum of 'Ten Million Six Hundred Thousand Great British Pounds' in the codicil and last testament of the deceased (Name now withheld since this is our second letter to you). Our contact to you is based on the legal fact that you bear the same last name identity with the deceased therefore we can present you as the heir to the inheritance. All legal papers will be processed on your acceptance of this deal. We request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at our high court probate division for the release of this sum of money. Please indicate your interest immediately via my private email for us to proceed. I shall feed you with full details of this transaction upon receipt of your reply towards this proposal. Best Regards, Mr. Issac Bailey Tel: +44-703-596-9152 Email: bailey.issac(at)rediffmail.com. From louislouis@mweb.co.za Thu Jan 29 12:52:14 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.3 required=5.0 tests=BAYES_99,HTML_50_60, HTML_IMAGE_ONLY_24,HTML_MESSAGE,JM_SOUGHT_FRAUD_3,LOTTO_ADMITS,LOTTO_AGENT, LOTTO_FROM,SARE_LOTTO_SPAM2,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 LOTTO_FROM Admits to being a lottery * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 0.5 LOTTO_AGENT BODY: Claims Agent * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 1.8 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam Received: from seadragon.mweb.co.za (seadragon.mweb.co.za [196.2.45.68]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0TKq9PX009911 for ; Thu, 29 Jan 2009 12:52:13 -0800 Received: from seadragon.mweb.co.za (localhost.localdomain [127.0.0.1]) by pwfilter01.mweb.co.za (Postfix) with ESMTP id E06AAD73BF; Thu, 29 Jan 2009 22:23:07 +0200 (SAST) Received: from MWS40 (unknown [196.2.63.104]) by seadragon.mweb.co.za (Postfix) with SMTP id 44D76D73A0; Thu, 29 Jan 2009 22:23:02 +0200 (SAST) From: "MSN LOTTERY" Date: Thu, 29 Jan 2009 22:23:02 +0200 Subject: [SPAM] Microsoft online lottery program. MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=aspNetEmail=_4302bd0d3831461a9157a067a91371e9" X-Mailer: aspNetEmail ver 3.5.2.59 Message-ID: X-Virus-Scanned: ClamAV using ClamSMTP To: undisclosed-recipients:; X-Greylist: Delayed for 00:28:58 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 29 Jan 2009 12:52:14 -0800 (PST) X-Spam-Prev-Subject: Microsoft online lottery program. Status: R X-Status: X-Keywords: X-UID: 72 Content-Length: 3586 --_=aspNetEmail=_4302bd0d3831461a9157a067a91371e9 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable =0AAttention,=0A=0AYour e-mail id was selected through the computer ballo= t system a winner of our Microsoft online lottery program=2E=0A=0AYou hav= e to contact your claim agent for your payment process and include your p= ersonal information for smooth transfer of your payment=2E=0A=0ACliam Age= nt: Mr=2EJames Zulu=0AEmail: jameszulu7000=40live=2Eco=2Eza=0ATel/fax : += 27 78 555 7877=0A=0AFor verification purpose forward to him your claim de= tails below;=0A=0A(1) Your mailing address:=0A(2) Your Tel(Mobile):=0A(3)= Your Nationality/Country:=0A=7B4=7D Your Full Names:=0A=7B5=7D Your Occu= pation=0A=7B6=7D Your Age=2E=0A=7B7=7D Your Sex=2E=0A=7B8=7D Your Maritia= l Status=2E=0A=0ARef No=2Emicro234kj20080808=0ABatch number: msn222=0ALuc= ky No: 1 8 13 22 27 38 41=0ASecurity code: 676=0AAmount Won: 1 000 000 00= (one million british pounds)=0A=0AYou have to contact him not later than= three working days=2E=0A=0AOne more time congratulations=2E=0A=0AThanks,= =0ADr=2EKhan Louis=2E=0AMsn Lottery Team=2E =0A=C2=A0 --_=aspNetEmail=_4302bd0d3831461a9157a067a91371e9 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Attention,

Your e-ma= il id was selected through the computer ballot system a winner of our Mic= rosoft online lottery program=2E
You have to contact your claim agent for your payment process and inclu= de your personal information for smooth transfer of your payment=2E
Cliam Agent: Mr=2EJames Zulu
Email: jameszul= u7000=40live=2Eco=2Eza
Tel/fax : +27 78 555 7877

For ver= ification purpose forward to him your claim details below;

(1) You= r mailing address:
(2) Your Tel(Mobile):
(3) Your Nationality/Country:
=7B4=7D= Your Full Names:
=7B5=7D Your Occupation
=7B6=7D Your Age=2E
=7B= 7=7D Your Sex=2E
=7B8=7D Your Maritial Status=2E

Ref No=2Emicro= 234kj20080808
Batch number: msn222
Lucky No: 1 8 13 22 27 38 41
= Security code: 676
Amount Won: 1 000 000 00 (one million british pounds)
You have to contact him not later than three working days=2E

One= more time congratulations=2E

Thanks,
Dr=2EKhan Louis=2E
Msn= Lottery Team=2E
=26nbsp;
--_=aspNetEmail=_4302bd0d3831461a9157a067a91371e9-- From correo@telefonica.net Thu Jan 29 23:07:55 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,LOTTO_YOU_WON_03,L_SOME_STD_PROBS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SPF_PASS,SUBJ_ALL_CAPS, THOUS_EMAIL_ADDRS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [213.4.149.242 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.207.236.49 listed in dnsbl.sorbs.net] [213.4.149.242 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [213.4.149.242 listed in psbl.surriel.com] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout2.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0U77o35007944 for ; Thu, 29 Jan 2009 23:07:54 -0800 Received: from User (196.207.236.49) by ctsmtpout2.frontal.correo (7.2.056.6) (authenticated as aecopa@infonegocio.com) id 498196F5000ED658; Fri, 30 Jan 2009 08:05:13 +0100 Message-ID: <498196F5000ED658@ctsmtpout2.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Mr. Issac Bailey" To: correo@telefonica.net Subject: [SPAM] INHERITANCE NOTICE.. Date: Fri, 30 Jan 2009 08:05:07 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: INHERITANCE NOTICE.. Status: R X-Status: X-Keywords: X-UID: 73 Content-Length: 1045 Hello Friend, This is to notify you again for the last time that you have been listed as an Heir to the total sum of 'Ten Million Six Hundred Thousand Great British Pounds' in the codicil and last testament of the deceased (Name now withheld since this is our second letter to you). Our contact to you is based on the legal fact that you bear the same last name identity with the deceased therefore we can present you as the heir to the inheritance. All legal papers will be processed on your acceptance of this deal. We request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at our high court probate division for the release of this sum of money. Please indicate your interest immediately via my private email for us to proceed. I shall feed you with full details of this transaction upon receipt of your reply towards this proposal. Best Regards, Mr. Issac Bailey Tel: +44-703-596-9152 Email: contact.issac(at)rediffmail.com. From correo@telefonica.net Fri Jan 30 06:16:42 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_3,LOTTO_YOU_WON_03, L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,SARE_FRAUD_X3,SPF_PASS,SUBJ_ALL_CAPS, THOUS_EMAIL_ADDRS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.207.236.49 listed in dnsbl.sorbs.net] [213.4.149.242 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout2.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0UEGc7u019604 for ; Fri, 30 Jan 2009 06:16:42 -0800 Received: from User (196.207.236.49) by ctsmtpout2.frontal.correo (7.2.056.6) (authenticated as avacos@infonegocio.com) id 498196F500140BCB; Fri, 30 Jan 2009 15:16:22 +0100 Message-ID: <498196F500140BCB@ctsmtpout2.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Mr. Issac Bailey" To: correo@telefonica.net Subject: [SPAM] INHERITANCE NOTICE.. Date: Fri, 30 Jan 2009 15:16:19 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: INHERITANCE NOTICE.. Status: R X-Status: X-Keywords: X-UID: 74 Content-Length: 1044 Hello Friend, This is to notify you again for the last time that you have been listed as an Heir to the total sum of 'Ten Million Six Hundred Thousand Great British Pounds' in the codicil and last testament of the deceased (Name now withheld since this is our second letter to you). Our contact to you is based on the legal fact that you bear the same last name identity with the deceased therefore we can present you as the heir to the inheritance. All legal papers will be processed on your acceptance of this deal. We request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at our high court probate division for the release of this sum of money. Please indicate your interest immediately via my private email for us to proceed. I shall feed you with full details of this transaction upon receipt of your reply towards this proposal. Best Regards, Mr. Issac Bailey Tel: +44-703-596-9152 Email: bailey.issac(at)rediffmail.com. From tonyaka13@aim.com Fri Jan 30 14:35:21 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.4 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_TW_1,BL_COUNTRY_TW_2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,L_SOME_STD_PROBS,NO_REAL_NAME,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,SPF_NEUTRAL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=tonyaka13%40aim.com&ip=219.87.180.87&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [219.87.180.87 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [219.87.180.87 listed in tw.countries.nerd.dk] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [219.87.180.87 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from cvl.com.tw (mail.cvl.com.tw [219.87.180.87]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0UMZFXV000340 for ; Fri, 30 Jan 2009 14:35:20 -0800 Received: (from root@localhost) by cvl.com.tw Sharetech Mailgateway id n0U7xxC26813; Fri, 30 Jan 2009 15:59:59 +0800 Received: from User (dhcp20139.myzipnet.com [41.202.20.139]) (authenticated bits=0) by cvl.com.tw Sharetech with ESMTP id n0U7wqFJ024451; Fri, 30 Jan 2009 15:58:55 +0800 Message-Id: <200901300758.n0U7wqFJ024451@cvl.com.tw> Reply-To: From: "Anthony" Subject: [SPAM] [Spam-Mail]RE: thur 29/01/2009 Date: Fri, 30 Jan 2009 07:59:49 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 14:27:47 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 30 Jan 2009 14:35:21 -0800 (PST) X-Spam-Prev-Subject: [Spam-Mail]RE: thur 29/01/2009 Status: R X-Status: X-Keywords: X-UID: 75 Content-Length: 1101 Hi, Pardon me for not having the pleasure of knowing your mindset before making you this offer and it is utterly confidential and genuine by virtue of its nature. I write to solicit your assistance in a funds transfer deal involving US$ 3.5M.This fund has been stashed out of the excess profit made last year by my branch office the International Commercial Bank which I am the manager. I have already submitted an approved end of the year report for the year 2005 to my head office here in Accra-Ghana and they will never know of this excess. I have since then, placed this amount on a Non-Investment Account without a beneficiary. Upon your response, I will configure your name on our database as holder of the Non-Investment Account. I will then guide you on how to apply to my head office for the Account Closure/ bank-to-bank remittance of the funds to your designated bank account. If you concur with this proposal, I intend for you to retain 30% of the funds while 70% shall be for me. Kindly forward your response to: tonyaka04@aol.co.uk Mobile: +233-24-4685072 With Regards, Anthony Aka From syrianair@infonegocio.com Fri Jan 30 15:03:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.8 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML, FORGED_OUTLOOK_TAGS,FORGED_RCVD_HELO,HTML_10_20,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,JM_SOUGHT_FRAUD_1,LOTTO_YOU_WON_03,L_SOME_STD_PROBS, MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_PASS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * -0.0 SPF_PASS SPF: sender matches SPF record * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [77.104.239.1 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [77.104.239.1 listed in psbl.surriel.com] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [77.104.239.1 listed in dnsbl.sorbs.net] [213.4.149.242 listed in dnsbl.sorbs.net] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 1.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout1.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n0UN3ZLT000888 for ; Fri, 30 Jan 2009 15:03:39 -0800 Received: from User (77.104.239.1) by ctsmtpout1.frontal.correo (7.2.056.6) (authenticated as avacos@infonegocio.com) id 496219E6008A0026; Fri, 30 Jan 2009 23:38:42 +0100 Message-ID: <496219E6008A0026@ctsmtpout1.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Mr. Ben Mark" To: benmark23231@Rediff.com Subject: [SPAM] Second Notice Date: Fri, 30 Jan 2009 23:38:26 +0100 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:17:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 30 Jan 2009 15:03:39 -0800 (PST) X-Spam-Prev-Subject: Second Notice Status: R X-Status: X-Keywords: X-UID: 76 Content-Length: 1796

Greetings,

 I understand that through Internet is not the best way to link up with you because of the confidentiality which my proposal demands.

However, I have already sent you this same letter one month ago, but I am not sure if it did get to you since I have not heard from you, hence i am constrain to reach you through the Internet which has been abused over the years.

I wish to notify you again that You were listed as a Heir to the total sum of (Three Million Six Hundred Thousand British Pounds) in the codicil and last testament of the deceased.(Name now withheld since this is our second letter to you). I contacted you because you bear the surname identity and therefore can present you as the Heir to the inheritance funds.

I therefore reckoned that you could receive these funds as you are qualified by your name identity. All the legal papers will be processed in your acceptance. In your acceptance of this deal, we request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at our high court probate division for the release of this sum of money.

Please indicate your interest immediately for us to proceed. I shall feed you with full details of this transaction upon receipt of your reply towards this proposal.


I look forward to hearing from you.

Yours Faithfully,
Mr. Ben Mark (Barrister)
Telephone +447024058780.

From marbel.konate@yahoo.com.hk Sun Feb 1 03:23:43 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************* X-Spam-Status: Yes, score=19.2 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, FREEMAIL_FROM,FREEMAIL_REPLYTO,FROM_EXCESS_QP,HTML_10_20,HTML_MESSAGE, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_31,J_CHICKENPOX_33,J_CHICKENPOX_56, J_CHICKENPOX_74,PHISH_05,SARE_FRAUD_X3,SUBJ_ALL_CAPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.0 FROM_EXCESS_QP From: quoted-printable encoded unnecessarily * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n70.bullet.mail.sp1.yahoo.com (n70.bullet.mail.sp1.yahoo.com [98.136.44.38]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n11BNdsU029811 for ; Sun, 1 Feb 2009 03:23:42 -0800 Received: from [69.147.84.145] by n70.bullet.mail.sp1.yahoo.com with NNFMP; 01 Feb 2009 10:43:01 -0000 Received: from [67.195.9.81] by t8.bullet.mail.sp1.yahoo.com with NNFMP; 01 Feb 2009 10:56:14 -0000 Received: from [67.195.9.107] by t1.bullet.mail.gq1.yahoo.com with NNFMP; 01 Feb 2009 10:56:14 -0000 Received: from [127.0.0.1] by omp111.mail.gq1.yahoo.com with NNFMP; 01 Feb 2009 10:56:14 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 677528.59263.bm@omp111.mail.gq1.yahoo.com Received: (qmail 92982 invoked by uid 60001); 1 Feb 2009 10:56:14 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ymail_nen1; d=yahoo.com.hk; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=bxYOjHsjHkIvunQO/gevuAUtjUyfrMXuaklSIE4u7RMO6z1uA1MiTa+f0psnY3jY6dZVFQzPUwQh3JY1+7xFiNum4nQmPf3NZhH9SbC0sGCMFKEhrI38/es+WOkht/2DD/6/Bf4MOTL4X8UX8CC8CdfpmNnQgBNlvlKNIu+UR+g=; Received: from [196.201.89.43] by web112215.mail.gq1.yahoo.com via HTTP; Sun, 01 Feb 2009 02:56:14 PST Date: Sun, 1 Feb 2009 02:56:14 -0800 (PST) From: =?big5?q?Marbel=20Konate?= Reply-To: marbelkonate@yahoo.com.hk Subject: [SPAM] PRIVATE MESSAGE/REPLY To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1691631143-1233485774=:92590" Content-Transfer-Encoding: 8bit Message-ID: <398655.92590.qm@web112215.mail.gq1.yahoo.com> X-Greylist: Delayed for 00:27:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 01 Feb 2009 03:23:43 -0800 (PST) X-Spam-Prev-Subject: PRIVATE MESSAGE/REPLY Status: R X-Status: X-Keywords: X-UID: 77 Content-Length: 5426 --0-1691631143-1233485774=:92590 Content-Type: text/plain; charset=big5 Content-Transfer-Encoding: 8bit ڦsqla}IA{iqlڡGmarbel.konate@yahoo.com.hk - Dearest respectful one,I wish to let you know that my chosen you in this transaction is not carnal but through the direction of God. I was praying and fasting searching for a reliable and honest person who will sincerely help me when i got your contact in a directory.I am Miss.Marbel Konate ,20 years old girl and the only daughter of my late parents Mr.and Mrs.J. Konate.My father was an international highly reputable business merchant ( A Cocoa Merchant ) during his days.It is sad to say that he died mysteriously here after he returned from a business trip from France.He was poisoned by one of his brother who travelled with him during that time.My mother died when I was just 4 years old,and since then my father took me so special. Before the death of my father on the Febuary 12,2007, he called me secretly beside his hospital and told me he deposited the sum of US$23M in a bank here Abidjan, the capital city of Cote d'Ivoire in my name as the next of kin and beneficiary. He told me that nobody in his family knows about this money and told me where he safe kept the deposit certificate which bears my name as the next of kin and beneficiary of the money for my claim of the money for my future survival as his only child and said nobody knows what tomorrow shall be that incase he die,I should confidentially look for a foreigner out side our country Cote d'Ivoire to help me secure the money in his or her bank account and invest it for my into any profit business .I am just 20 years old and a student and really don't know what to do.Now I want your assistance and transfer this money in your bank account on my behalf. I have suffered a lot of set backs as a result of political crisis here in our country.The death of my father actually brought sorrow to my life.I am in a sincere desire of your humble assistance in this regards.Your suggestions and ideas will be highly regarded.Now permit me to ask these few questions:- 1. Can you honestly help me as your daughter or sister? 2. What percentage of the total amount in ques tion will be good for you after you transfer the money in your bank account? 3.Can you help me come over there in your country to live once you secure the money?Please,Consider this and get back to me as soon as possible.My sincere regards,Miss Marbel Konate. --0-1691631143-1233485774=:92590 Content-Type: text/html; charset=big5 Content-Transfer-Encoding: 8bit
ڦsqla}I
A{iqlڡGmarbel.konate@yahoo.com.hk



- Dearest respectful one,I wish to let you know that my chosen you in this transaction is not carnal but through the direction of God. I was praying and fasting searching for a reliable and honest person who will sincerely help me when i got your contact in a directory.I am Miss.Marbel Konate ,20 years old girl and the only daughter of my late parents Mr.and Mrs.J. Konate.My father was an international highly reputable business merchant ( A Cocoa Merchant ) during his days.It is sad to say that he died mysteriously here after he returned from a business trip from France.He was poisoned by one of his brother who travelled with him during that time.My mother died when I was just 4 years old,and since then my father took me so special. Before the death of my father on the Febuary 12,2007, he called me secretly beside his hospital and told me he deposited the sum of US$23M in a bank here Abidjan, the capital city of Cote d'Ivoire in my name as the next of kin and beneficiary. He told me that nobody in his family knows about this money and told me where he safe kept the deposit certificate which bears my name as the next of kin and beneficiary of the money for my claim of the money for my future survival as his only child and said nobody knows what tomorrow shall be that incase he die,I should confidentially look for a foreigner out side our country Cote d'Ivoire to help me secure the money in his or her bank account and invest it for my into any profit business .I am just 20 years old and a student and really don't know what to do.Now I want yo ur assistance and transfer this money in your bank account on my behalf. I have suffered a lot of set backs as a result of political crisis here in our country.The death of my father actually brought sorrow to my life.I am in a sincere desire of your humble assistance in this regards.Your suggestions and ideas will be highly regarded.Now permit me to ask these few questions:- 1. Can you honestly help me as your daughter or sister? 2. What percentage of the total amount in question will be good for you after you transfer the money in your bank account? 3.Can you help me come over there in your country to live once you secure the money?Please,Consider this and get back to me as soon as possible.My sincere regards,Miss Marbel Konate.
--0-1691631143-1233485774=:92590-- From ack@telefonica.net Sun Feb 1 20:21:02 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************* X-Spam-Status: Yes, score=19.3 required=5.0 tests=BAYES_99,DNS_FROM_RFC_ABUSE, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FORGED,J_CHICKENPOX_71, J_CHICKENPOX_83,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_SBL, SPF_PASS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * -0.0 SPF_PASS SPF: sender matches SPF record * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 95] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 95] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.208.139.161 listed in zen.spamhaus.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.4.149.242 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [213.4.149.242 listed in psbl.surriel.com] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout2.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n124KvUM023936 for ; Sun, 1 Feb 2009 20:21:01 -0800 Received: from User (41.208.139.161) by ctsmtpout2.frontal.correo (7.2.056.6) (authenticated as avacos@infonegocio.com) id 498196F5003799E1; Mon, 2 Feb 2009 04:51:41 +0100 Message-ID: <498196F5003799E1@ctsmtpout2.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Mss. Mandy Richard" To: mandy_richard02@yahoo.co.uk Subject: [SPAM] HI Date: Mon, 2 Feb 2009 03:50:57 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:28:08 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 01 Feb 2009 20:21:02 -0800 (PST) X-Spam-Prev-Subject: HI Status: R X-Status: X-Keywords: X-UID: 78 Hello Friend, I bring greettings to you with peace and love... It's my great pleasure to let you know about me My name is Mss. Mandy Richard 25yrs old; single, never married, a Daughter of (Late Chief Dr.Richard Krings) Who lost his life as a result of the civil war that happened in my country. I am presentely living with a harity home organization here in Dakar. However i am writting you for a strong relationship and also for business purpose or partner,I have the mind to transfer some fund and make an investment in your country; any away you will have get back to me first so that we could discuss it better on how its goes. I am waiting to receive from you as soon as possible.bye for now and hope you continue to be blessed. Yours Sincerely, Mss.Mss. Mandy Richard From national.lottery@live.co.uk Sun Feb 1 23:10:51 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.1 required=5.0 tests=BAYES_99,DEAR_WINNER, DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1, LOTTO_ADMITS,LOTTO_FROM,L_SOME_STD_PROBS,RBL_PSBL_01,RCVD_IN_BRBL, SPAMMY_WEBMAIL,SPF_SOFTFAIL,TO_CC_NONE,TO_EMPTY autolearn=disabled version=3.1.8 X-Spam-Report: * 0.3 TO_EMPTY To: is empty * 2.0 LOTTO_FROM Admits to being a lottery * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=national.lottery%40live.co.uk&ip=203.162.130.70&receiver=ga.impsec.org] * 2.0 DEAR_WINNER BODY: DEAR_WINNER * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [203.162.130.70 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [203.162.130.70 listed in psbl.surriel.com] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mailhost.vnpt.com.vn (mail.vnpt.com.vn [203.162.130.70]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n127Aj2S027963 for ; Sun, 1 Feb 2009 23:10:51 -0800 Received: from localhost (unknown [10.1.2.92]) by mailhost.vnpt.com.vn (COSA mail) with ESMTP id 9AA68170262; Sun, 1 Feb 2009 04:27:31 +0700 (ICT) Received: from mailhost.vnpt.com.vn ([127.0.0.1]) by localhost (mailgate.vnpt.com.vn [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 21693-09; Sun, 1 Feb 2009 04:43:05 +0700 (ICT) Received: from vnpt.com.vn (unknown [10.1.2.91]) by mailhost.vnpt.com.vn (COSA-SMTP) with ESMTP id E4ED32AC12E; Sun, 1 Feb 2009 04:40:46 +0700 (ICT) Received: from 123.130.112.17 (proxying for 41.220.75.3) (SquirrelMail authenticated user duongdv) by mail.vnpt.com.vn with HTTP; Sun, 1 Feb 2009 04:38:09 +0700 (ICT) Message-ID: <50284.123.130.112.17.1233437889.squirrel@mail.vnpt.com.vn> Date: Sun, 1 Feb 2009 04:38:09 +0700 (ICT) Subject: [SPAM] Winning Alert...Contact Williams Brown(williamsbrown.unkl99@live.com) From: "Sir. Earl Spencer" To: X-Priority: 3 Importance: Normal Reply-To: williamsbrown.unkl99@live.com X-Mailer: SquirrelMail (version x.x.x) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Virus-Scanned: cosa-scan at vnpt.com.vn X-Greylist: Delayed for 19:22:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 01 Feb 2009 23:10:51 -0800 (PST) X-Spam-Prev-Subject: Winning Alert...Contact Williams Brown(williamsbrown.unkl99@live.com) Status: R X-Status: X-Keywords: X-UID: 79 Content-Length: 1081 National Lottery Promo Office Tel: +44-701-115-1309 Fax: +44-7006-062-478 Ref LSUK/2031/8161/05 Dear Winner, We are pleased to inform you of the final announcement of Our On-line Promo Programme held on Monday 17th of November 2008.The draw was done electronically with several email addresses provided to this office by webmail providers to enhance the utilization of the internet.Your email address attached to Reference Number UK/2031/8161/05 was picked as one of the ten winning email addresses. This has qualified you to claim the total cash prize Of 590,983 Pounds Sterling in cash. To file for your claims and due remittance of funds contact Mr. Willams Brown with the following details: Name;................. Age;.................. Address;.............. Occupation; ........... Telephone;............. via Email;williamsbrown.unkl99@live.com **Note: All replies and queries or questions concerning your claims should be sent to Mr. Williams Brown. Congratulations once more and from all members and staff of this program. Sir. Earl Spencer On-line Co-ordinator. From tonyaka13@aim.com Mon Feb 2 02:47:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.9 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_TW_2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_1,L_SOME_STD_PROBS,NO_REAL_NAME,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,SPF_NEUTRAL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=tonyaka13%40aim.com&ip=219.87.180.87&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [219.87.180.87 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [219.87.180.87 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [219.87.180.87 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from cvl.com.tw (mail.cvl.com.tw [219.87.180.87]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n12AlADk000700 for ; Mon, 2 Feb 2009 02:47:15 -0800 Received: (from root@localhost) by cvl.com.tw Sharetech Mailgateway id n12AhIx29553; Mon, 2 Feb 2009 18:43:18 +0800 Received: from User (dhcp20139.myzipnet.com [41.202.20.139]) (authenticated bits=0) by cvl.com.tw Sharetech with ESMTP id n12AfqxL026613; Mon, 2 Feb 2009 18:41:55 +0800 Message-Id: <200902021041.n12AfqxL026613@cvl.com.tw> Reply-To: From: "Anthony" Subject: [SPAM] [Spam-Mail]RE: sat 31/01/2009 Date: Mon, 2 Feb 2009 10:43:14 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: [Spam-Mail]RE: sat 31/01/2009 Status: R X-Status: X-Keywords: X-UID: 80 Content-Length: 1098 Hi, Pardon me for not having the pleasure of knowing your mindset before making you this offer and it is utterly confidential and genuine by virtue of its nature. I write to solicit your assistance in a funds transfer deal involving US$ 3.5M.This fund has been stashed out of the excess profit made last year by my branch office the International Commercial Bank which I am the manager. I have already submitted an approved end of the year report for the year 2008 to my head office here in Accra-Ghana and they will never know of this excess. I have since then, placed this amount on a Non-Investment Account without a beneficiary. Upon your response, I will configure your name on our database as holder of the Non-Investment Account. I will then guide you on how to apply to my head office for the Account Closure/ bank-to-bank remittance of the funds to your designated bank account. If you concur with this proposal, I intend for you to retain 30% of the funds while 70% shall be for me. Kindly forward your response to: tonicb19@aim.com Mobile: +233-24-4685072 With Regards, Anthony Aka From www@iam.tw Mon Feb 2 07:10:12 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************* X-Spam-Status: Yes, score=20.0 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_TW_2,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,HTML_STOOPID_01, HTML_STOOPID_02,HTML_VERY_STOOPID,INVALID_MSGID,L_MANY_STD_PROBS, MIME_HTML_ONLY,MSGID_NO_HOST,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL,X_PRIORITY_HIGH autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.3 MSGID_NO_HOST Message-Id has no hostname * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9961] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 HTML_STOOPID_02 RAW: stupid HTML: empty STRONG tag * 0.5 HTML_STOOPID_01 RAW: stupid HTML: empty FONT tag * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [211.20.19.60 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [211.20.19.60 listed in psbl.surriel.com] * 2.2 INVALID_MSGID Message-Id is not valid, according to RFC 2822 * 1.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 1.0 HTML_VERY_STOOPID Lots of stupid HTML * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 L_MANY_STD_PROBS Three or more standards-compliance problems Received: from mail.iam.tw ([211.20.19.60]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n12FA60U007722 for ; Mon, 2 Feb 2009 07:10:10 -0800 Received: by mail.iam.tw (Postfix, from userid 80) id E1DD422AC74; Mon, 2 Feb 2009 21:03:07 +0800 (CST) To: jhardin@impsec.org Subject: [SPAM] Treat As Urgent ! From: "Mr. Kofi. A. Annan" MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 Content-Transfer-encoding: 8bit Reply-To: "Mr. Kofi. A. Annan" Message-ID: <4ac4e139b02f16b71ff7324ac8d9cd36@> X-Priority: 1 X-MSmail-Priority: High X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Date: Mon, 2 Feb 2009 21:03:07 +0800 (CST) X-Greylist: Delayed for 02:06:51 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 02 Feb 2009 07:10:11 -0800 (PST) X-Spam-Prev-Subject: Treat As Urgent ! Status: R X-Status: X-Keywords: X-UID: 81 Content-Length: 8274
Main Bodies
Official WEB Site Locator for the UN System of Organizations
UNITED NATIONS (UNITED NATIONS ASSISTED PROGRAMME)
DIRECTORATE OF INTERNATIONAL PAYMENT AND TRANSFERS.
UNITED NATIONS LIASION OFFICE
KOFI A. ANNAN of Ghana , the seventh Secretary-General of the United NationsOCEANIC BANK COMPENSATION UNIT, IN AFFILIATION WITH THE UNITED NATION. Send a copy of your response to official email: mrs.celen@live.co.uk,mrscelenibru@yahoo.dk
Attn: Beneficiary,

How are you today? Hope all is well with you and family? You may not understand why this mail came to you.

We have been having a meeting for the passed 7 months which ended 2 days ago with the with the New secretary to the UNITED NATIONS.

This email is to all the people that have been scammed in any part of the world, the UNITED NATIONS have agreed to compensate them with the sum of US$ 150,000,00 This includes every foriegn contractors that may have not received their contract sum, and people that had an unfinished transaction or international businesses that failed due to Government problems etc.

This method of payment is designed by the Government Bodies of the United Nations to avert fraud perpetration or stoppage of fake Cheques or Bank Draft issued by some Non- accreditted Agencies either through unaccreditted Courier Service.
We have received series of petition from Fraud and compensation victims in this regards so Board of Directors and other Stake holders in the Government,Subcommittees have decide that all compensation fund should be release through Swift Credit Card.

You are advised to contact Dr.Mrs.Celen Ibru of OCEANIC BANK London UK, as she is our representative in London UK, contact her immediately for your International Swift Credit Card of USD$ 150,000,00 This funds are in a Swift Credit Card for security purpose. You gain withdrawal access of your Credit Card through any Atm Machine network in Guatemala your Country of Origin or anywhere in the World.

Therefore, you should send her your full Name and telephone number/your correct mailing address where you want her to send the Swift Credit Card to you.

Conatct Dr.Mrs.Celen Ibru immediately for your Swift Credit Card.:

Person to Contact Dr.Mrs.Celen Ibru
Email: mrs.celen@live.co.uk,mrscelenibru@y ahoo.dk

Thanks and God bless you and your family.
Hoping to hear from you as soon as you make withdrawal from your Card..

Making the world a better place


Regards,
Mr. Kofi .A.Annan
Former Secretary (UNITED NATIONS).
With the New Secretary-General(UN).Dr. Ban Ki-moon

From info.optusb25@optusnet.com.au Mon Feb 2 08:28:20 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=21.4 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, MILLIONS_01,PHISH_05,SPF_PASS,STOX_30,SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 PHISH_05 BODY: Phishing for account information * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail05.syd.optusnet.com.au (mail05.syd.optusnet.com.au [211.29.132.186]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n12GSAw8009871 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 2 Feb 2009 08:28:18 -0800 Received: from User (64-242.vgccl.net [41.220.64.242] (may be forged)) (authenticated sender info.optusb25@optusnet.com.au) by mail05.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id n12GNmbK021331; Tue, 3 Feb 2009 03:24:06 +1100 Message-Id: <200902021624.n12GNmbK021331@mail05.syd.optusnet.com.au> Reply-To: From: "Charles Richard Bean" Subject: [SPAM] CONTRACT PAYMENT...NOTIFICATION Date: Mon, 2 Feb 2009 08:26:41 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: CONTRACT PAYMENT...NOTIFICATION Status: R X-Status: X-Keywords: X-UID: 82 Content-Length: 1859 CONTRACT PAYMENT...NOTIFICATION EXECUTIVE GOVERNOR FROM THE DESK OF: Charles Richard Bean THE EXECUTIVE GOVERNOR OF BANK OF ENGLAND (BOE) HEADOFFICE: THREAD NEEDLE STREET, LONDON EC2R 8AH DIRECT LINE:+44 703 596 5390 Email:dr.charles.richard@live.com CONTRACT PAYMENT APPROVAL ON CONTRACT NO: FGN/ ESOC/022996/CB/2008 We apologies for the delay of your payment and all the inconveniences and inflict that we might have indulge you through. However, we were having some minor problems with our payment system, which is inexplicable and have held us stranded and indolent, not having the aspiration to devote our 100% assiduity in accrediting foreign contract Payments. We apologize once again. From the records of outstanding contractors due for payment with the federal government of England , your name and Company was discovered as next on the list of the outstanding contractors who have not yet received their payments. I wish to inform you now that the square peg is now in square whole and can be voguish for that your payment is being processed and will be released to you as soon as you respond to this letter. Also note that from my record in my file your outstanding contract payment is ?10,700,000.00 (Ten Million seven hundred thousand British Pounds Sterling). Kindly re-confirm to me the followings: 1) Your full name and address 2) Phone, fax and mobile #. 3) Company name, position and address: 4) Profession, age and marital status. 5) Working d/Int'l passport (if any). As soon as this information is received, your payment will be wired to your nominated bank account directly from our onshore bank of settlement. Thanks for your good understanding, hope to have your response shortly. Charles Richard Bean BANK OF ENGLAND (BOE) Yours Sincerely, EXECUTIVE GOVERNOR DIRECT LINE:+44 703 596 5390 Email:dr.charlesrichard1@live.com From ack@telefonica.net Mon Feb 2 14:55:59 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.8 required=5.0 tests=BAYES_99,DNS_FROM_RFC_ABUSE, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FORGED,J_CHICKENPOX_71, J_CHICKENPOX_83,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,SPF_PASS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * -0.0 SPF_PASS SPF: sender matches SPF record * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.4.149.242 listed in dnsbl.sorbs.net] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout4.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n12MtseU019501 for ; Mon, 2 Feb 2009 14:55:58 -0800 Received: from User (41.208.185.97) by ctsmtpout4.frontal.correo (7.2.056.6) (authenticated as teclados3@infonegocio.com) id 49876B4200014074; Mon, 2 Feb 2009 23:54:46 +0100 Message-ID: <49876B4200014074@ctsmtpout4.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Mss. Mandy Richard" To: mandy_ricahrd@Rediffmail.com Subject: [SPAM] HI Date: Mon, 2 Feb 2009 22:53:44 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: HI Status: R X-Status: X-Keywords: X-UID: 83 Hello Friend, I bring greettings to you with peace and love... It's my great pleasure to let you know about me My name is Mss. Mandy Richard 25yrs old; single, never married, a Daughter of (Late Chief Dr.Richard Krings) Who lost his life as a result of the civil war that happened in my country. I am presentely living with a harity home organization here in Dakar. However i am writting you for a strong relationship and also for business purpose or partner,I have the mind to transfer some fund and make an investment in your country; any away you will have get back to me first so that we could discuss it better on how its goes. I am waiting to receive from you as soon as possible.bye for now and hope you continue to be blessed. Yours Sincerely, Mss.Mss. Mandy Richard From me@localhost.com Mon Feb 2 19:44:35 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.0 required=5.0 tests=BAYES_80,BL_COUNTRY_IT_1, DEAR_NOTHING,FORGED_RCVD_HELO,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3,SPF_FAIL autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_IT_1 Mail client in Italy * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=me%40localhost.com&ip=62.149.158.106&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 DEAR_NOTHING BODY: Dear [nothing] * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.9216] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtpsmart1.aruba.it (smtpweb106.aruba.it [62.149.158.106]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n133iUuD026783 for ; Mon, 2 Feb 2009 19:44:34 -0800 Received: (qmail 6892 invoked by uid 89); 3 Feb 2009 03:17:46 -0000 Received: by simscan 1.2.0 ppid: 6785, pid: 6787, t: 1.0775s scanners: clamav: 0.88.4/m:40/d:1945 spam: 3.1.4 Received: from unknown (HELO webs1090.ad.aruba.it) (62.149.131.100) by smtpsmart1.fe.aruba.it with SMTP; 3 Feb 2009 03:17:45 -0000 Received: from webs1090 ([127.0.0.1]) by webs1090.ad.aruba.it with Microsoft SMTPSVC(6.0.3790.3959); Tue, 3 Feb 2009 04:17:48 +0100 Date: Tue, 03 Feb 2009 04:17:48 +0100 Subject: [SPAM] Derecho Humanos Solicitors To: jhardin@impsec.org From: Hernandez Thomas Reply-To: mr.hernandezthomas@gmail.com MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit Message-ID: X-OriginalArrivalTime: 03 Feb 2009 03:17:48.0224 (UTC) FILETIME=[FD4C4400:01C985AD] X-Greylist: Delayed for 00:26:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 02 Feb 2009 19:44:35 -0800 (PST) X-Spam-Prev-Subject: Derecho Humanos Solicitors Status: R X-Status: X-Keywords: X-UID: 84 Dear, My name is Barrister Mr. Hernandez Thomas. I am writing to notify you of the unclaimed inheritance deposit of my Late client, Mr. Kamochkin Sergey, who passed to the Great beyond on Tuesday, August 24, 2004 in the Siberia Airlines Tu-154 Crash. You should browse through the link below to view more information about the Passengers and the incident: http://www.rumormillnews.com/cgi-bin/archive.cgi?read=54591 ). I got your contact address through a web search engine in my quest to get a reliable party who shall work with me to claim a deposit made by my Deceased client with a financial institution in Spain, since all my efforts to get the biological relative has proved abortive. Please revert back to me urgently with your telephone and fax numbers for more information on the amount of inheritance, procedure and legality of this claim via this email address. Thanks. Regards, Barr. Hernandez Thomas. (Attorney At Law) From gftp.net2@earthlink.net Mon Feb 2 22:40:41 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,RBL_POXLAY_01,SARE_FRAUD_X3, SPAMMY_WEBMAIL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.245.46.36 listed in dnsbl.sorbs.net] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from elasmtp-mealy.atl.sa.earthlink.net (elasmtp-mealy.atl.sa.earthlink.net [209.86.89.69]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n136ebck031459 for ; Mon, 2 Feb 2009 22:40:40 -0800 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=OwIt7iMQkdkRsMN5Sk4zYUO+CtEp3CIZj6d9yHmX5SqtDjrQVYzsGdx1M257l+sr; h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Transfer-Encoding:X-Mailer:Content-Type:X-ELNK-Trace:X-Originating-IP; Received: from [209.86.224.36] (helo=elwamui-hybrid.atl.sa.earthlink.net) by elasmtp-mealy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from ) id 1LUEc8-0007FO-I3; Tue, 03 Feb 2009 01:18:28 -0500 Received: from 41.245.46.36 by webmail.earthlink.net with HTTP; Tue, 3 Feb 2009 01:18:28 -0500 Message-ID: <30727278.1233641908297.JavaMail.root@elwamui-hybrid.atl.sa.earthlink.net> Date: Tue, 3 Feb 2009 08:18:28 +0200 (GMT+02:00) From: *** Business Proposal Are U Interested ? Reply-To: *** Business Proposal Are U Interested ? Subject: [SPAM] *** Business Proposal Are U Interested ? Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: EarthLink Zoo Mail 1.0 Content-Type: text/html; charset=UTF-8 X-ELNK-Trace: 203022c4c17f42d966e19d6f8fecf7737e972de0d01da940108f0f3f7348187a8ac1733be37fc0e9350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 209.86.224.36 X-Greylist: Delayed for 00:19:49 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 02 Feb 2009 22:40:40 -0800 (PST) X-Spam-Prev-Subject: *** Business Proposal Are U Interested ? Status: R X-Status: X-Keywords: X-UID: 85 Content-Length: 1245

 From: Mr. David Moyo.

 

I am Mr. David Moyo, Director of Project South Africa Department of Minerals and Energy. I am making this contact with you based on the Committee need for an individual/company who is willing to assist us with a solution to a money transfer.

 

This amount $28m represents the balance of the total contract Value Executed on behalf of Department mineral resources and Energy by a foreign contracting firm, which we the officials over-invoiced deliberately, of which the actual sum has been paid.

Should you be willing to assist us in the transaction? Your share of the sum will be 25% of the $28million, 70% for us and 5% for taxation and miscellaneous expenses. To enable us commence, provide your personal telephone/fax number.

 

Contact me through my alternative e-mail address: davidmoyosa@live.co.za

 

Best Regards,
Mr. David Moyo
+27 73 093 9070

From mrjimbk1@jmail.co.za Tue Feb 3 06:11:04 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************************** X-Spam-Status: Yes, score=41.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_BOGUSMX,DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_2,MILLIONS_01,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_BY_IP,RCVD_NUMERIC_HELO, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SPAMMY_WEBMAIL, TO_CC_NONE,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.0 RCVD_BY_IP Received by mail server with no name * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.5 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 51] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 51] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.9 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from poseidon.fox-hosting.nl (poseidon.fox-hosting.nl [83.98.154.13] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n13EAvba010611 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 3 Feb 2009 06:11:03 -0800 Received: from localhost ([127.0.0.1] helo=83.98.154.13) by poseidon.fox-hosting.nl with esmtpa (Exim 4.60) (envelope-from ) id 1LUAXT-00057Z-70; Tue, 03 Feb 2009 02:57:23 +0100 Received: from 41.223.251.105 (SquirrelMail authenticated user bako@miva-bj.nl) by 83.98.154.13 with HTTP; Tue, 3 Feb 2009 02:57:23 +0100 (CET) Message-ID: <83df2bc43dc3b4aad197d068d18e62aa.squirrel@83.98.154.13> Date: Tue, 3 Feb 2009 02:57:23 +0100 (CET) Subject: [SPAM] Reply For More Details From: "MR JIM BAKO" Reply-To: jimbako1@hotmail.fr User-Agent: SquirrelMail/1.4.15 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Greylist: Delayed for 11:57:54 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 03 Feb 2009 06:11:03 -0800 (PST) X-Spam-Prev-Subject: Reply For More Details Status: R X-Status: X-Keywords: X-UID: 86 Content-Length: 1469 FROM THE DESK OF MR JIM BAKO, BANK OF AFRICA (B.O.A) COTONOU REPULIC OF BENIN. WEST AFRICA Dear Friend, I am Mr Jim Bako.The director of Auditing and Accounting Department of BANK OF AFRICA BENIN I know that this mail will come to you as a surprise as we never met before. I need your urgent assistance in transferring the sum of ($18.5 million dollars United States ) to your account. Base on my security report, these funds can be claimed without any hitches as no one is aware of the funds and its closing balance except me, my colleagues at the bank and the customer (Now Deceased) therefore, I can present you as the Next of Kin and we will workout the modalities for the claiming of the funds in accordance with the law, after hearing from you I will give you more details about the transaction, and application which you will forward to the bank, and I agree that 40% of this money will be for you as a respect to the provision of a foreign account , and 50% would be for me and my colleagues while 10% will be for the necessary expenses that might occur along the line. Thereafter, I will visit your country for disbursement according to the percentage indicated my phone Number is (+22993705966) or REPLY TO THIS EMAL: jimbako02@yahoo.fr Thank you, Sincerely, Jim Bako N/B. In other for you to believe me honestly try and go through this (website) before you start with me. http://www.cnn.com/2003/WORLD/africa/12/26/benin.crash/index.html124/12/2008 From ack@telefonica.net Wed Feb 4 14:30:58 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.3 required=5.0 tests=BAYES_99,DNS_FROM_RFC_ABUSE, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FORGED,J_CHICKENPOX_71, J_CHICKENPOX_83,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_SBL,SPF_PASS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * -0.0 SPF_PASS SPF: sender matches SPF record * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9971] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.208.139.71 listed in zen.spamhaus.org] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout2.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n14MUrfo030171 for ; Wed, 4 Feb 2009 14:30:58 -0800 Received: from User (41.208.139.71) by ctsmtpout2.frontal.correo (7.2.056.6) (authenticated as teclados3@infonegocio.com) id 498968D300094605; Wed, 4 Feb 2009 23:27:26 +0100 Message-ID: <498968D300094605@ctsmtpout2.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Luzann Ray" To: luzannray@sify.com Subject: [SPAM] HI Date: Wed, 4 Feb 2009 22:27:22 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: HI Status: R X-Status: X-Keywords: X-UID: 87 Hello Friend, I bring greettings to you with peace and love... It's my great pleasure to let you know about me My name is Mss. Luzann Ray 25yrs old; single, never married, a Daughter of (Late Chief Dr.Raymond Fomba) Who lost his life as a result of the civil war that happened in my country. I am presentely living with a harity home organization here in Dakar. However i am writting you for a strong relationship and also for business purpose or partner,I have the mind to transfer some fund and make an investment in your country; any away you will have get back to me first so that we could discuss it better on how its goes. I am waiting to receive from you as soon as possible.bye for now and hope you continue to be blessed. Yours Sincerely, Luzann Ray From bosemanrhodes16@yahoo.in Thu Feb 5 08:46:50 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************ X-Spam-Status: Yes, score=48.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_KR_2,BL_COUNTRY_NG_2, BL_COUNTRY_TW_2,FREEMAIL_FROM,FREEMAIL_REPLYTO,FROM_EXCESS_QP,HTML_10_20, HTML_MESSAGE,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_21,J_CHICKENPOX_31,J_CHICKENPOX_41,J_CHICKENPOX_42, J_CHICKENPOX_43,J_CHICKENPOX_44,J_CHICKENPOX_51,J_CHICKENPOX_54, J_CHICKENPOX_61,J_CHICKENPOX_72,J_CHICKENPOX_73,J_CHICKENPOX_81, J_CHICKENPOX_92,MILLIONS_01,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SARE_FRAUD_X3,SARE_FRAUD_X4,SUB_HELLO,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.6 J_CHICKENPOX_92 BODY: 9alpha-pock-2alpha * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_51 BODY: 5alpha-pock-1alpha * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 0.6 J_CHICKENPOX_81 BODY: 8alpha-pock-1alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 0.0 FROM_EXCESS_QP From: quoted-printable encoded unnecessarily * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n1b.bullet.tw1.yahoo.com (n1b.bullet.tw1.yahoo.com [119.160.244.196]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n15GkkkY026596 for ; Thu, 5 Feb 2009 08:46:49 -0800 Received: from [119.160.244.76] by n1.bullet.tw1.yahoo.com with NNFMP; 05 Feb 2009 16:19:12 -0000 Received: from [203.212.168.60] by t1.bullet.tw1.yahoo.com with NNFMP; 05 Feb 2009 16:19:12 -0000 Received: from [203.104.18.95] by t1.bullet.kr1.yahoo.com with NNFMP; 05 Feb 2009 16:19:05 -0000 Received: from [127.0.0.1] by omp109.mail.in2.yahoo.com with NNFMP; 05 Feb 2009 16:19:04 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 744858.8506.bm@omp109.mail.in2.yahoo.com Received: (qmail 29249 invoked by uid 60001); 5 Feb 2009 16:19:04 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.in; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=oIkEKGvITOZz7KwANVyNjWjUzO0B0z6nsLYXXmvP6bOtZzh22hBHaN98CwKB2f98I+B3FbbPJJr+K2a1cXPlSoaF+olurJETweGBbohc1UvA15ZC1bFBzjQMWDmMSpIxYq65xH9TkQKHWiyqlvSb13V006/bZ0X6g2Tn1vabrGA= ; Received: from [82.128.3.171] by web95003.mail.in2.yahoo.com via HTTP; Thu, 05 Feb 2009 21:49:04 IST Date: Thu, 5 Feb 2009 21:49:04 +0530 (IST) From: =?utf-8?q?Boseman=20Rhodes?= Reply-To: bosemanrhodes009@yahoo.com.hk Subject: [SPAM] Hello dear, To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-737169508-1233850744=:17234" Content-Transfer-Encoding: 8bit Message-ID: <653008.17234.qm@web95003.mail.in2.yahoo.com> X-Greylist: Delayed for 00:27:30 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Feb 2009 08:46:50 -0800 (PST) X-Spam-Prev-Subject: Hello dear, Status: R X-Status: X-Keywords: X-UID: 88 Content-Length: 5887 --0-737169508-1233850744=:17234 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: bosemanrhodes16@yahoo.in - Hello dear,This mail may meet you as a surprise but i have to start by introducing myself toyou,i am Boseman Rhodes,a merchant in Dubai,Arab Emirate.I have been diagnosed with Cancer which was discovered very late,due to my laxity in careing for my health.It has defiled all forms of medicine,Right now I have only about a few months to live,according to my Medical Doctor.I have not particularly lived my life so well,as I never really cared for myself but the oil business.Though I am very rich,I was never generous,I only focused on my business as that was the only thing I cared for.But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world.I believe when God gives me a second chance and heal me I would live my life a different way from how I have lived it.I have sowed a seed for my healing I have willed and given most of my properties and assets to my immediate and extended family members and as well as a few close friends.I want God to be merciful to me and accept my soul and so,I have decided to give arms to charity organizations and give succour and comfort to the less priviledged of the Tsunami Victims and the Hurricane victims,as I want this to be one of the last good deeds I do on earth.So far,I have distributed money to some charity organizations in India and Malaysia.Now that my health has deteriorated so badly,I cannot do this my self anymore.I once asked members of my family to close one of my accounts in Saudi Bank and distribute the money which I have there to charity ganization and to the less priviledged in Bulgaria and Sudan Africa They cashed the money but kept it only to themselves.Hence,I do not trust them anymore,as they seem not to be contended with what I have left for them already.The last of my money which no one knows of is the huge cash deposit of twenty two million dollars that I have in the Vault of a Financial company in europe for safe keeping.I want you to collect this deposit on my behalf and disburse it to the T sunami EarthQuake victims in Asia and hurricane victms in America for the less priviledged.I will set aside 20% for you for your time and efforts.I need your urgent reply so that I will not have to go on sourcing for another credible person to handle this project.If you are okey with the condition,do not hesitate to send me mail(bosemanrhodes009@yahoo.com.hk} so that i can furnish you up with all the informations needed.I wish to hear from you soon.God bless you.Rhodes. --0-737169508-1233850744=:17234 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: bosemanrhodes16@yahoo.in



- Hello dear,This mail may meet you as a surprise but i have to start by introducing myself toyou,i am Boseman Rhodes,a merchant in Dubai,Arab Emirate.I have been diagnosed with Cancer which was discovered very late,due to my laxity in careing for my health.It has defiled all forms of medicine,Right now I have only about a few months to live,according to my Medical Doctor.I have not particularly lived my life so well,as I never really cared for myself but the oil business.Though I am very rich,I was never generous,I only focused on my business as that was the only thing I cared for.But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world.I believe when God gives me a second chance and heal me I would live my life a different way from how I have lived it.I have sowed a seed for my healing I have willed and given most of my properties and assets to my immediate and extended family members and as well as a few close friends.I want God to be merciful to me and accept my soul and so,I have decided to give arms to charity organizations and give succour and comfort to the less priviledged of the Tsunami Victims and the Hurricane victims,as I want this to be one of the last good deeds I do on earth.So far,I have distributed money to some charity organizations in India and Malaysia.Now that my health has deteriorated so badly,I cannot do this my self anymore.I once asked members of my family to close one of my accounts in Saudi Bank and distribute the money which I have there to charity ganization and to the less priviledged in Bulgaria and Sudan Africa They cashed the money but kept it only to themselves.Hence,I do not trust them anymore,as they seem not to be contended with what I have left for them already.The last of my money which no one knows of is the huge cash deposit of twenty two million dollars that I have in the Vault of a Financial company in europe for safe keeping.I want you to collect this deposit on my behalf and disburse it to the Tsunami EarthQuake victims in Asia and hurricane victms in America for the less priviledged.I will set aside 20% for you for your time and efforts.I need your urgent reply so that I will not have to go on sourcing for another credible person to handle this project.If you are okey with the condition,do not hesitate to send me mail(bosemanrhodes009@yahoo.com.hk} so that i can furnish you up with all the informations needed.I wish to hear from you soon.God bless you.Rhodes.
--0-737169508-1233850744=:17234-- From huruna33@gmail.com Thu Feb 5 10:59:14 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************************** X-Spam-Status: Yes, score=41.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_80,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3, L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,NO_REAL_NAME,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_TOWRITE,SPF_NEUTRAL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=huruna33%40gmail.com&ip=70.103.229.194&receiver=ga.impsec.org] * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.1 SARE_TOWRITE BODY: Contains phrasing used by spammers * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8908] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [70.103.229.194 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from citweb1.CIT.LLC (mail.lakequip.com [70.103.229.194] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n15IxBcR030114 for ; Thu, 5 Feb 2009 10:59:14 -0800 Message-Id: <200902051859.n15IxBcR030114@ga.impsec.org> Received: from adsl-41.207.197.251.aviso.ci [41.207.197.251] by citweb1.CIT.LLC with SMTP; Tue, 3 Feb 2009 09:15:57 -0700 Reply-To: From: "Ford" Subject: [SPAM] Nice To Hear From You Date: Tue, 3 Feb 2009 16:15:54 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 090203-0, 03/02/2009), Outbound message X-Antivirus-Status: Clean X-Greylist: Delayed for 00:40:02 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Feb 2009 10:59:14 -0800 (PST) X-Spam-Prev-Subject: Nice To Hear From You Status: R X-Status: X-Keywords: X-UID: 89 Content-Length: 2700 NICE TO HEAR FROM YOU FROM FRANK FORD My name is Mr. Frank Ford, the only son of Mr. Terry Ford of Zimbabwe. It might be a surprise to you where I got your address from, it is through network on online and internet search hence I decided to write you. Don't be worried because I am contacting you in good faith and my transaction is 100% risk free and genuine. During the government crisis against the farmers in Zimbabwe by the supporters of our President Robert Mugabe to claim all the white owned farms in our country, he ordered all the white farmers to surrender their farms to his party members and their followers. Then my later father Terry Ford was one of the best farmers in the country and knowing that he did not support the President political ideology, the president supporters invaded my fathers farm and burnt down everything, killed him and my mother and confiscated all his investments. Please view web site: http://www.newsweek.com/id/144093 http://www.timesonline.co.uk/tol/news/world/africa/article4116638.ece Before this unpleasant incident, my mother and my father Terry Ford had already visited Abidjan Cote D Ivoire formally called Ivory Coast to deposit the sum of (Ten Million United States Dollars) in the safe vault of a Security and financial company here in Abidjan Cote D Ivoire . This action was taken because My late father felt the growing tension on the farm issue but I guess he never anticipated the tragedy that brought his brutal and sudden death. At the time of deposition, the real content was not disclosed to the security officials; instead, it was deposited as Family Valuables Valued for the real content in the consignment. After the bloody incident, we all had to escape out of our country for the safety of our lives. We seek refuge in Abidjan Cote D Ivoire and we were permitted to reside here as Political Refugees under section (5.9) Because of our present and unpleasant status, my little sister and I are seriously looking forward to having an overseas partner who is genuine and honest that will assist us with the convenient and legal transfer of the funds out of Abidjan Cote D Ivoire for investment. If my proposition is considered, for assisting us to transfer this money to your country, we will offer you 20% of the total fund, and 5% of the total will be set aside to cover any expenses incurred during this transaction. 75% will be for my family to buy shares and invest in your country under your supervision. I would appreciate confidentiality and honesty in our correspondence. Your immediate response will be highly welcomed. I wait to hear from you. Best Wishes, Mr. Frank/ Beatrice Ford EMAIL: frankford@live.co.uk From tskchambers@yahoo.com.hk Thu Feb 5 19:44:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************* X-Spam-Status: Yes, score=13.6 required=5.0 tests=BAYES_95,BL_COUNTRY_BR_1, DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_RCVD_HELO,FREEMAIL_FROM, FREEMAIL_REPLYTO,J_CHICKENPOX_32,L_SOME_STD_PROBS,MILLIONS_01,NA_DOLLARS, PHISH_05,RCVD_IN_BRBL,SARE_SXLIFE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.1 SARE_SXLIFE BODY: Talks about your sex life * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9835] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [201.20.23.211 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.redejovem.net (static.201.20.23.211.datacenter1.com.br [201.20.23.211]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n163iYWD011746 for ; Thu, 5 Feb 2009 19:44:38 -0800 Received: from localhost (redejovem.rits.org.br [127.0.0.1]) by mail.redejovem.net (Postfix) with ESMTP id 8016D2CFCD86; Thu, 5 Feb 2009 06:44:16 -0200 (BRST) X-Virus-Scanned: by amavisd at redejovem.rits.org.br Received: from mail.redejovem.net ([127.0.0.1]) by localhost (redejovem.rits.org.br [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 5GItwPrUWGEE; Thu, 5 Feb 2009 06:44:16 -0200 (BRST) Received: from localhost (static.201.20.23.210.datacenter1.com.br [201.20.23.210]) by mail.redejovem.net (Postfix) with ESMTP id AB30A2CFCD7F; Thu, 5 Feb 2009 06:44:13 -0200 (BRST) MIME-Version: 1.0 Date: Thu, 5 Feb 2009 6:44:13 -0200 From: "Professor John W. Cairns" To: tskchamber@yahoo.com.hk Subject: [SPAM] FROM: Professor John W. Cairns Reply-To: tskchambers@yahoo.com.hk Message-ID: X-Sender: tskchambers@yahoo.com.hk User-Agent: RedeJovem Webmail Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 17:17:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Feb 2009 19:44:38 -0800 (PST) X-Spam-Prev-Subject: FROM: Professor John W. Cairns Status: R X-Status: X-Keywords: X-UID: 90 Content-Length: 2562 FROM: Professor John W. Cairns LL.B., Ph.D., F.R.S.E. REPLY ONLY TO MY PERSONAL/PRIVATE EMAILL ADDRESS PLEASE= tskchamber@yahoo.com.hk Letter Of Introduction This absolutely an unofficial request for partnership, therefore, I ask that you permit me to have used this means in contacting you. However, I am compelled to do so as Internet is the fastest way of communication of today, besides, it offers a reasonable degree of confidentiality. My name is John W. Cairns I am a Professor of Law. Obviously this letter will be a surprise to you. The reason is not far from the fact that we have not met before now, more with much Spam on the Internet it becomes difficult for one to convey genuine and profitable intent to another. It has become inevitable for me to contact you by another means other than Internet as I still do consider email as the fastest and reasonably safe means . My intention of writing you this mail is to solicit your partnership with funds left by my deceased client by name: Benzion Dunner in an account exclusive of his wil. Mr Benzion Dunner is a Jewish Briton that died in an auto crash months back with so much at his credit in terms of resources. He had maintained an account worth Millions of Dollars The funds are proposed for charity when he becomes 50 years but unfortunately he dead at forty. Though he has wife and 9 children, the family is not privileged to this account as I have maintained the account for him,he has in the account Twenty-Nine Million six Hundred Thounds US Dollars, I have over the past months of his death administered other estate of his to his family and according to his Wil but this is exclusive and I do wish that the two of us go into partnership to: A --Get all relevant legal documents in your favor and transfer the money to your Account or preferable on agreement between two of us open an account in another Bank and have the found transferred into B. --After the successful transfer we will use 20% of the money for charity as Benzion Dunner had proposed to me. C. --After the transfer 80% of the money shall be shared between you and I on equall bases It is needless to ask that you keep this as a confidential matter, I presume that you now you should and equal to this responsibility and will not indulge in blackmail or passing of this information to a third party. Kindly let me know if your intersted in the transaction by mailling me. REPLY ONLY TO MY PERSONAL/PRIVATE EMAILL ADDRESS PLEASE= tskchamber@yahoo.com.hk Best Regards Professor John W. Cairns From colin.alderman01@yahoo.com.hk Fri Feb 6 06:24:59 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_95,DATE_IN_FUTURE_06_12,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_2,L_SOME_STD_PROBS,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.7 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9503] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [71.177.64.180 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from montclairwood.com (static-71-177-64-180.lsanca.dsl-w.verizon.net [71.177.64.180]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n16EOs47028944 for ; Fri, 6 Feb 2009 06:24:59 -0800 Received: from User ([41.5.205.99]) by montclairwood.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 4 Feb 2009 08:12:33 -0800 Reply-To: From: "Mr. Colin Alderman" Subject: [SPAM] Personal Email ( 4th Feb.2009) Date: Wed, 4 Feb 2009 18:11:18 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 04 Feb 2009 16:12:34.0398 (UTC) FILETIME=[63A13FE0:01C986E3] X-Greylist: Delayed for 21:06:59 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 06 Feb 2009 06:24:59 -0800 (PST) X-Spam-Prev-Subject: Personal Email ( 4th Feb.2009) Status: R X-Status: X-Keywords: X-UID: 91 Content-Length: 2538 Colin Alderman Partner Barlow Robbins LLP 55 Quarry Street, Merseyside Liverpool, L25 6EZ. Direct Tel: +44 703 180 6846 Good Day , This is a personal email directed to you and I request that it be treated as such. I am Barrister Colin Alderman, a solicitor at law. I am the personal attorney/sole executor to the late Mr. Dickson, hereinafter referred to as my client' who worked as an independent oil magnate in my country and who died in a car crash with his immediate family on the 4th of oct,1998. Since the death of my client in Oct, 1998, I have written several letters to the embassy with intent to locate any of his extended relatives whom shall be claimants/beneficiaries of his abandoned personal estate and all such efforts have been to no avail. Moreover, I have received official letters in the last few weeks suggesting a likely proceeding for confiscation of his abandoned personal assets in line with existing laws by the bank in which my client deposited the sum of 30 million pounds. On this note I decided to search for a credible person and finding that you bear a similar last name, I was urged to contact you, that I may, with your consent, present you to the "trustee" bank as my late client's surviving family member so as to enable you put up a claim to the bank in that capacity as a next of kin of my client. I find this possible for the fuller reasons that you bear a similar last name with my client making it a lot easier for you to put up a claim in that capacity. I propose that 50% of the net sum will accrue to you at the conclusion of this deal in so far as I do not incur further expenses. Therefore, to facilitate the immediate transfer of this fund, you need, first to contact me via email signifying your interest and as soon as I obtain your confidence, I will immediately appraise you with the complete details as well as fax you the documents, with which you are to proceed and i shall direct on how to put up an application to the bank. HOWEVER, you will have to assent to an express agreement which I will forward to you in order to bind us in this transaction. Upon the receipt of your reply, I will send you by fax or E-mail the next step to take. I will not fail to bring to your notice that this proposal is hitch-free and that you should not entertain any fears as the required arrangements have been made for the completion of this transfer. Like I said, I require only a solemn confidentiality on this. Best regards, Colin Alderman. From alderman.colin@gmail.com Fri Feb 6 07:17:50 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_60,DATE_IN_FUTURE_06_12,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,RCVD_IN_BRBL,SARE_FRAUD_X3, SARE_FRAUD_X4,SPF_NEUTRAL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=alderman.colin%40gmail.com&ip=212.76.68.51&receiver=ga.impsec.org] * 1.7 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.6159] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [212.76.68.51 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from vhost5.sahara.com.sa (vhost5.sahara.com.sa [212.76.68.51]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n16FHhks030469 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 6 Feb 2009 07:17:50 -0800 Received: from User ([41.4.223.190]) (authenticated bits=0) by vhost5.sahara.com.sa (8.13.8/8.13.8) with ESMTP id n138RMG0013511; Tue, 3 Feb 2009 11:27:28 +0300 Message-Id: <200902030827.n138RMG0013511@vhost5.sahara.com.sa> Reply-To: From: "Mr. Colin Alderman" Subject: [SPAM] Personal Email ( 3rd Feb.2009) Date: Tue, 3 Feb 2009 10:42:06 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 78:32:25 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 06 Feb 2009 07:17:50 -0800 (PST) X-Spam-Prev-Subject: Personal Email ( 3rd Feb.2009) Status: R X-Status: X-Keywords: X-UID: 92 Content-Length: 2538 Colin Alderman Partner Barlow Robbins LLP 55 Quarry Street, Merseyside Liverpool, L25 6EZ. Direct Tel: +44 703 180 6846 Good Day , This is a personal email directed to you and I request that it be treated as such. I am Barrister Colin Alderman, a solicitor at law. I am the personal attorney/sole executor to the late Mr. Dickson, hereinafter referred to as my client' who worked as an independent oil magnate in my country and who died in a car crash with his immediate family on the 4th of oct,1998. Since the death of my client in Oct, 1998, I have written several letters to the embassy with intent to locate any of his extended relatives whom shall be claimants/beneficiaries of his abandoned personal estate and all such efforts have been to no avail. Moreover, I have received official letters in the last few weeks suggesting a likely proceeding for confiscation of his abandoned personal assets in line with existing laws by the bank in which my client deposited the sum of 30 million pounds. On this note I decided to search for a credible person and finding that you bear a similar last name, I was urged to contact you, that I may, with your consent, present you to the "trustee" bank as my late client's surviving family member so as to enable you put up a claim to the bank in that capacity as a next of kin of my client. I find this possible for the fuller reasons that you bear a similar last name with my client making it a lot easier for you to put up a claim in that capacity. I propose that 50% of the net sum will accrue to you at the conclusion of this deal in so far as I do not incur further expenses. Therefore, to facilitate the immediate transfer of this fund, you need, first to contact me via email signifying your interest and as soon as I obtain your confidence, I will immediately appraise you with the complete details as well as fax you the documents, with which you are to proceed and i shall direct on how to put up an application to the bank. HOWEVER, you will have to assent to an express agreement which I will forward to you in order to bind us in this transaction. Upon the receipt of your reply, I will send you by fax or E-mail the next step to take. I will not fail to bring to your notice that this proposal is hitch-free and that you should not entertain any fears as the required arrangements have been made for the completion of this transfer. Like I said, I require only a solemn confidentiality on this. Best regards, Colin Alderman. From bosemanrhodes15@yahoo.in Fri Feb 6 10:26:44 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************* X-Spam-Status: Yes, score=49.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FREEMAIL_FROM, FREEMAIL_REPLYTO,FROM_EXCESS_QP,HTML_10_20,HTML_MESSAGE,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_21,J_CHICKENPOX_31, J_CHICKENPOX_41,J_CHICKENPOX_42,J_CHICKENPOX_43,J_CHICKENPOX_44, J_CHICKENPOX_51,J_CHICKENPOX_54,J_CHICKENPOX_61,J_CHICKENPOX_72, J_CHICKENPOX_73,J_CHICKENPOX_81,J_CHICKENPOX_92,MILLIONS_01, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01, RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SUB_HELLO,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.6 J_CHICKENPOX_92 BODY: 9alpha-pock-2alpha * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_51 BODY: 5alpha-pock-1alpha * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 0.6 J_CHICKENPOX_81 BODY: 8alpha-pock-1alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [202.86.4.130 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [202.86.4.130 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 0.0 FROM_EXCESS_QP From: quoted-printable encoded unnecessarily * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from n5-vm1.bullet.mail.in.yahoo.com (n5-vm1.bullet.mail.in.yahoo.com [202.86.4.130]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n16IQd4t003061 for ; Fri, 6 Feb 2009 10:26:43 -0800 Received: from [202.86.4.171] by n5.bullet.mail.in.yahoo.com with NNFMP; 06 Feb 2009 17:58:55 -0000 Received: from [203.104.18.49] by t2.bullet.in.yahoo.com with NNFMP; 06 Feb 2009 17:58:55 -0000 Received: from [127.0.0.1] by omp110.mail.in2.yahoo.com with NNFMP; 06 Feb 2009 17:58:55 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: 153326.53115.bm@omp110.mail.in2.yahoo.com Received: (qmail 23557 invoked by uid 60001); 6 Feb 2009 17:58:55 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.in; h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=v3mOjy5t335B0KnBCp3Y1aQQZzKwFFoPypa2SXZ28/n90hTxjtlSnp72rd4QuR7NMUZSJbWuZaUC3jdUucOMSPm21grgy8OE9nbA6bghHRPoBVbIVvB4UqBFgBDctaleMsoUuDI/ziWTt8SZWqzJPgOKTWwFXP+Exads5ZYRxrg= ; Received: from [82.128.32.88] by web95015.mail.in2.yahoo.com via HTTP; Fri, 06 Feb 2009 23:28:54 IST Date: Fri, 6 Feb 2009 23:28:54 +0530 (IST) From: =?utf-8?q?Boseman=20Rhodes?= Reply-To: bosemanrhodes009@yahoo.com.hk Subject: [SPAM] Hello dear, To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-916620202-1233943134=:88166" Content-Transfer-Encoding: 8bit Message-ID: <985976.88166.qm@web95015.mail.in2.yahoo.com> X-Greylist: Delayed for 00:27:42 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 06 Feb 2009 10:26:44 -0800 (PST) X-Spam-Prev-Subject: Hello dear, Status: R X-Status: X-Keywords: X-UID: 93 Content-Length: 5887 --0-916620202-1233943134=:88166 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit I have a new email address!You can now email me at: bosemanrhodes15@yahoo.in - Hello dear,This mail may meet you as a surprise but i have to start by introducing myself toyou,i am Boseman Rhodes,a merchant in Dubai,Arab Emirate.I have been diagnosed with Cancer which was discovered very late,due to my laxity in careing for my health.It has defiled all forms of medicine,Right now I have only about a few months to live,according to my Medical Doctor.I have not particularly lived my life so well,as I never really cared for myself but the oil business.Though I am very rich,I was never generous,I only focused on my business as that was the only thing I cared for.But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world.I believe when God gives me a second chance and heal me I would live my life a different way from how I have lived it.I have sowed a seed for my healing I have willed and given most of my properties and assets to my immediate and extended family members and as well as a few close friends.I want God to be merciful to me and accept my soul and so,I have decided to give arms to charity organizations and give succour and comfort to the less priviledged of the Tsunami Victims and the Hurricane victims,as I want this to be one of the last good deeds I do on earth.So far,I have distributed money to some charity organizations in India and Malaysia.Now that my health has deteriorated so badly,I cannot do this my self anymore.I once asked members of my family to close one of my accounts in Saudi Bank and distribute the money which I have there to charity ganization and to the less priviledged in Bulgaria and Sudan Africa They cashed the money but kept it only to themselves.Hence,I do not trust them anymore,as they seem not to be contended with what I have left for them already.The last of my money which no one knows of is the huge cash deposit of twenty two million dollars that I have in the Vault of a Financial company in europe for safe keeping.I want you to collect this deposit on my behalf and disburse it to the T sunami EarthQuake victims in Asia and hurricane victms in America for the less priviledged.I will set aside 20% for you for your time and efforts.I need your urgent reply so that I will not have to go on sourcing for another credible person to handle this project.If you are okey with the condition,do not hesitate to send me mail(bosemanrhodes009@yahoo.com.hk} so that i can furnish you up with all the informations needed.I wish to hear from you soon.God bless you.Rhodes. --0-916620202-1233943134=:88166 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
I have a new email address!
You can now email me at: bosemanrhodes15@yahoo.in



- Hello dear,This mail may meet you as a surprise but i have to start by introducing myself toyou,i am Boseman Rhodes,a merchant in Dubai,Arab Emirate.I have been diagnosed with Cancer which was discovered very late,due to my laxity in careing for my health.It has defiled all forms of medicine,Right now I have only about a few months to live,according to my Medical Doctor.I have not particularly lived my life so well,as I never really cared for myself but the oil business.Though I am very rich,I was never generous,I only focused on my business as that was the only thing I cared for.But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world.I believe when God gives me a second chance and heal me I would live my life a different way from how I have lived it.I have sowed a seed for my healing I have willed and given most of my properties and assets to my immediate and extended family members and as well as a few close friends.I want God to be merciful to me and accept my soul and so,I have decided to give arms to charity organizations and give succour and comfort to the less priviledged of the Tsunami Victims and the Hurricane victims,as I want this to be one of the last good deeds I do on earth.So far,I have distributed money to some charity organizations in India and Malaysia.Now that my health has deteriorated so badly,I cannot do this my self anymore.I once asked members of my family to close one of my accounts in Saudi Bank and distribute the money which I have there to charity ganization and to the less priviledged in Bulgaria and Sudan Africa They cashed the money but kept it only to themselves.Hence,I do not trust them anymore,as they seem not to be contended with what I have left for them already.The last of my money which no one knows of is the huge cash deposit of twenty two million dollars that I have in the Vault of a Financial company in europe for safe keeping.I want you to collect this deposit on my behalf and disburse it to the Tsunami EarthQuake victims in Asia and hurricane victms in America for the less priviledged.I will set aside 20% for you for your time and efforts.I need your urgent reply so that I will not have to go on sourcing for another credible person to handle this project.If you are okey with the condition,do not hesitate to send me mail(bosemanrhodes009@yahoo.com.hk} so that i can furnish you up with all the informations needed.I wish to hear from you soon.God bless you.Rhodes.
--0-916620202-1233943134=:88166-- From genesend@gmail.com Fri Feb 6 11:44:12 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML, FORGED_OUTLOOK_TAGS,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_50_60,HTML_MESSAGE, HTML_TITLE_EMPTY,J_CHICKENPOX_45,MIME_HTML_ONLY,SPF_NEUTRAL,SUBJ_ALL_CAPS, TO_CC_NONE,UPPERCASE_25_50 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=genesend%40gmail.com&ip=211.29.132.191&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 0.0 UPPERCASE_25_50 message body is 25-50% uppercase * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail10.syd.optusnet.com.au (mail10.syd.optusnet.com.au [211.29.132.191]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n16Ji4RS004880 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 6 Feb 2009 11:44:12 -0800 Received: from User (ip-250-84.static.darkstarx.net [203.153.250.84] (may be forged)) (authenticated sender t_e_k@optusnet.com.au) by mail10.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id n16Jf8Te019540; Sat, 7 Feb 2009 06:41:16 +1100 Message-Id: <200902061941.n16Jf8Te019540@mail10.syd.optusnet.com.au> Reply-To: From: "FEDERAL MINISTRY OF FINANCE" Subject: [SPAM] CONTACT FEDEX IMMEDIATELY FOR YOUR PAYMENT. Date: Fri, 6 Feb 2009 11:42:27 -0800 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: CONTACT FEDEX IMMEDIATELY FOR YOUR PAYMENT. Status: R X-Status: X-Keywords: X-UID: 94 Content-Length: 3722
Hello Dear,
I have Paid the fee for your Cheque Draft but the manager of Eko Bank Benin told me that before the check will get to you that it will expire. So I told him to cash $1.500,000.00 all the necessary arrangement of delivering the $1.500,000.00 in cash was made with FEDEX DELIVERY COURIER COMPANY.This is the information they need to deliver your package to you With FEDEX DELIVERY COURIER COMPANY, contact them now.
BELOW IS THE FEDEX DELIVERY COURIER COMPANY INFORMATION'S.
NAME:FEDEX COURIER DELIVERING COMPANY.
ATTANTION: PERSON: ENGR.. ETHEL EMESIM
POSITION: FOREIGN DELIVERY DEPARTMENT.
ADDRESS: COTONOU BENIN REPUBLIC
E-MAIL: ( infodeskgfedex@sify.com ) OR ( ethelsimfedex@sify.com )
Please, Send them your contacts information to enable them locate you immediately they arrived in your country with your BOX Below are the information they need from you.
1.YOUR FULL NAME
2.YOUR HOME ADDRESS.
3.YOUR CURRENT HOME TELEPHONE NUMBER.
4.YOUR CURRENT OFFICE TELEPHONE.
5. YOUR CURRENT HOME TELEPHONE NUMBER.
6.A COPY OF YOUR PICTURE, that is your identity
You are advice to contact them on their email contact below;
( infodeskgfedex@sify.com ) OR ( ethelsimfedex@sify.com )
Please make sure you send this needed infos to the Director general of FEDEX DELIVERY COURIER COMPANY BENIN REPUBLIC, ENGR. ETHEL EMESIM to the address given to you.
Note; The Fedex Delivery Courier Company don't know the contents of the Box. I registered it as a Box of an Africa cloths. They don't know that it's content is money. This is to avoid them delaying with the Box. Don't let them know that is money that is in that Box.
Thanks and Remain Blessed.
CONTACT FEDEX EXPRESS COURIER COMPANY.
Yours Faithfully,
Dr. Joyce Fashola.
Director minstry of finance.
 From andb1000@yahoo.com.hk Fri Feb 6 18:24:46 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.3 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_CN_2,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,MILLIONS_01,PHISH_05,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_RECV_IP_222064,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 1.7 SARE_RECV_IP_222064 Spam passed through possible spammer relay * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [222.66.142.187 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.jqgnq.gov.cn ([222.66.142.187]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n172OeLv016051 for ; Fri, 6 Feb 2009 18:24:45 -0800 Received: from User [10.10.10.2] by mail.jqgnq.gov.cn with ESMTP (SMTPD32-7.12 ) id A58B4001D6; Mon, 02 Feb 2009 21:30:51 +0800 Reply-To: From: "Anderson Baker" Subject: [SPAM] Happy New Year . Date: Mon, 2 Feb 2009 14:44:45 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200902022134609.SM01808@User> X-Greylist: Delayed for 01:41:13 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 06 Feb 2009 18:24:46 -0800 (PST) X-Spam-Prev-Subject: Happy New Year . Status: R X-Status: X-Keywords: X-UID: 95 Content-Length: 1913 From: Anderson Baker , Auditor: Alpha Bank Uk, London - UK. Attention: Sir, This letter might surprise you, because we have never met either in person or by correspondence. But I believe it is one day that you got to know someone either physical or through correspondence. Please accept my sincere apologies if my email does not meet your business or personal ethics. I will first introduce myself as Anderson Baker, an auditor with a bank in United Kingdom. One of our accounts, with holding balance of 15,000 000.00 GBP (Fifteen Million Great Britain Pounds Sterling) has been dormant, and last operated many years ago. Nobody has done anything as regards to the claiming of this money, because the account owner has no family member or friends that have any knowledge, as to the existence of either the account or the funds; I have decided to find a reliable foreign partner to deal with. My proposition to you, is to seek your consent to present you as the Next of kin and beneficiary of this late client, that the proceeds of this account valued a huge sum shall be paid to you, and then we can share the amount on a mutually agreed percentage. This transaction is totally free of risk and troubles, as the fund is legitimate, and does not originate from drug, money laundry, terrorism or any other illegal act. The funds will be released to you after necessary processes have been followed. As an officer of the bank I cannot be directly connected to this money, that prompted my contacting you, to receive this money into your bank account . The proceeds will be shared 60/40 %. I assure you that , we will have this funds within seven working days, all things been equal . Alternatively, you can write me back with my private email address (andersonbaker1@googlemail.com). As soon as I receive your response I will details you on how we can achieve it successfully . Mr Anderson Baker . From contractaward@sctvnews.com Sat Feb 7 05:29:50 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=28.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, SARE_PROLOSTOCK_SYM3,UNDISC_RECIPS,X_PRIORITY_HIGH autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 0.2 PHISH_05 BODY: Phishing for account information * 1.6 SARE_PROLOSTOCK_SYM3 BODY: Last week's hot stock scam * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [64.32.225.77 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [64.32.225.77 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.ebdcsolutions.com (ip-64-32-225-77.nyc.megapath.net [64.32.225.77]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n17DTlem001209 for ; Sat, 7 Feb 2009 05:29:50 -0800 Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.ebdcsolutions.com (Postfix) with ESMTP id 29DC01301B87; Sat, 7 Feb 2009 07:31:12 -0500 (EST) X-Virus-Scanned: amavisd-new at Received: from mail.ebdcsolutions.com ([127.0.0.1]) by localhost (mail.ebdcsolutions.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7cPFSTFLMjxS; Sat, 7 Feb 2009 07:31:09 -0500 (EST) Received: from User (unknown [195.166.239.229]) by mail.ebdcsolutions.com (Postfix) with ESMTP id B4A24130184D; Sat, 7 Feb 2009 07:29:40 -0500 (EST) Reply-To: From: "Adams Stmichael Idioma" Subject: [SPAM] [SPAM]Re: transfer for investment in your country Date: Sat, 7 Feb 2009 13:35:15 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090207122941.B4A24130184D@mail.ebdcsolutions.com> To: undisclosed-recipients:; X-Greylist: Delayed for 00:41:54 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 07 Feb 2009 05:29:50 -0800 (PST) X-Spam-Prev-Subject: [SPAM]Re: transfer for investment in your country Status: R X-Status: X-Keywords: X-UID: 96 Hello my friend, I am Mr. Adams St.Michael, chairman contract dept NNPC-Nigeria. We Have an over invoiced USD28.6M to be transfered to your account.Shares, 30% for you and 70% for us If you are interested kindly get back to us via e-mail. Thanks, Yours Sincerly, Adams St.Michael From hernandez55@rediff.com Sat Feb 7 11:02:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=34.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_BR_1,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_DSN, DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, JM_SOUGHT_FRAUD_3,LOTTO_FROM,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,RBL_POXLAY_01, RBL_PSBL_01,SUBJ_ALL_CAPS,Spoof_Port_URL,THOUS_EMAIL_ADDRS,TO_CC_NONE, UPPERCASE_25_50 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 2.0 LOTTO_FROM Admits to being a lottery * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.6 DNS_FROM_RFC_DSN RBL: Envelope sender in dsn.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [201.63.246.70 listed in psbl.surriel.com] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [81.202.116.104 listed in dnsbl.sorbs.net] * 0.0 UPPERCASE_25_50 message body is 25-50% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 0.5 Spoof_Port_URL URI with malformed port * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from cetsp.com.br (brma.cetsp.com.br [201.63.246.70]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n17J22P8009749 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 7 Feb 2009 11:02:07 -0800 BrmaOutput: 81.202.116.104.dyn.user.ono.com [81.202.116.104] Received: from User (81.202.116.104.dyn.user.ono.com [81.202.116.104]) (authenticated bits=0) by cetsp.com.br (8.12.11.20060308/8.12.11) with ESMTP id n17FZcMR027573; Sat, 7 Feb 2009 13:35:41 -0200 Message-Id: <200902071535.n17FZcMR027573@cetsp.com.br> Reply-To: From: "EURO BONO LOTTERY AWARD 2009" Subject: [SPAM] EURO BONO LOTTERY AWARD 2009 Date: Sat, 7 Feb 2009 16:39:40 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:15:45 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 07 Feb 2009 11:02:07 -0800 (PST) X-Spam-Prev-Subject: EURO BONO LOTTERY AWARD 2009 Status: R X-Status: X-Keywords: X-UID: 97 Content-Length: 1142 EURO BONO LOTTERY AWARD 2009 25 AVD. DE RADU C.P.28500 MADRID SPAIN . FROM THE DESK OF THE MANAGING DIRECTOR INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPT. AWARD NOTIFICATION/FINAL NOTICE(ENGLISH TRANSLATION) Batch.No:EULO/2907/444/908/09. Ticket No:WRNM/SMI/5990 Ref. No:ESM/WIN/008/05/10/ We wish to congratulate you over your email success in our computer balloting sweepstake held on 6th febuary, 2009. This is a millennium scientific computer game in which email addresses were used. It is a promotional program aimed at encouraging internet users;therefore you do not need to buy ticket to enter for it. Your email just won 850,281. 00 EUR (Eight Hundred Fifty Thousand Two Hundred and Eight one Euros).Please contact the APOINTED PAYING BANK AGENT for the claim of your winning amount With your Full Name And Full Telphone No. DON. MACO LABERT FOREIGN OPERATION DEPARTMENT THE EXECUTIVE DIRECTOR OF LA CAIXA SECURITY & FINANCE S.L Tel: +34 634 185 373 fax: +34 917 905 006 Email: sfinance55@ozu.es Claim Expiration Date.20-02-2009 Mrs Susana Ray (Lottery coordinator) Congratulation!! once again from all staff and board members From fidelishouse@ns.aliantzinc.ca Mon Feb 9 10:00:06 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n19I05at024035 for ; Mon, 9 Feb 2009 10:00:05 -0800 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***** X-Spam-Status: Yes, score=5.6 required=5.0 tests=BAYES_99,FORGED_RCVD_HELO, L_SOME_STD_PROBS autolearn=disabled version=3.1.8 X-Spam-Report: Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Mon, 09 Feb 2009 10:00:05 -0800 (PST) * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9929] * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from simmts12-srv.bellnexxia.net (simmts12-qfe0.srvr.bell.ca [206.47.199.141]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n19Hwt6u017989 for ; Mon, 9 Feb 2009 09:59:00 -0800 Received: from simip9-ac.srvr.bell.ca ([206.47.199.87]) by simmts12-srv.bellnexxia.net (InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP id <20090209162125.VDJX1599.simmts12-srv.bellnexxia.net@simip9-ac.srvr.bell.ca> for ; Mon, 9 Feb 2009 11:21:25 -0500 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AvcLAB3aj0nOL8cR/2dsb2JhbACBSSWJKoF/t0GPJAY Received: from simfep4-srv.bellnexxia.net (HELO smtpacout.sympatico.ca) ([206.47.199.17]) by simip9-ac.srvr.bell.ca with SMTP; 09 Feb 2009 11:28:55 -0500 X-Mailer: Openwave WebEngine, version 2.8.10 (webedge20-101-191-20030113) X-Originating-IP: [200.201.187.250] From: "Sir.George Harris" Reply-To: mr.thomaswright01@btinternet.com To: Subject: [SPAM] Contact Mr.Thomas Wright Date: Mon, 9 Feb 2009 11:21:25 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Message-Id: <20090209162125.VDJX1599.simmts12-srv.bellnexxia.net@simip9-ac.srvr.bell.ca> X-Greylist: Delayed for 01:37:29 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 09 Feb 2009 09:59:00 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n19Hwt6u017989 X-Spam-Prev-Subject: Contact Mr.Thomas Wright Status: R X-Status: X-Keywords: X-UID: 98 Email: Mr.Thomas Wright (mr.thomaswright02@btinternet.com) for the claims of 1,532,720.00 Pounds Uk Award 2009 Claims.Requirement,Names,phone number,Country and Occupation. Regards Sir.George Harris, Co-ordinator From eurmesp@lycos.es Sun Feb 8 18:43:46 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.8 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,LOTTO_AGENT,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,NO_REAL_NAME,SPF_NEUTRAL,UNDISC_RECIPS,X_PRIORITY_HIGH autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=eurmesp%40lycos.es&ip=80.32.48.197&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9975] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from server.autronik.com (197.Red-80-32-48.staticIP.rima-tde.net [80.32.48.197]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n192helD027010 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 8 Feb 2009 18:43:45 -0800 Received: from User (unknown [77.208.35.22]) by server.autronik.com (Postfix) with ESMTP id 9A087538A9A; Mon, 9 Feb 2009 03:12:47 +0100 (CET) Reply-To: From: "Euro-Millions" Subject: [SPAM] NOTICE Date: Mon, 9 Feb 2009 03:13:17 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090209021247.9A087538A9A@server.autronik.com> To: undisclosed-recipients:; X-Greylist: Delayed for 00:30:08 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 08 Feb 2009 18:43:46 -0800 (PST) X-Spam-Prev-Subject: NOTICE Status: R X-Status: X-Keywords: X-UID: 99 Euro-Millions Madrid, Spain. BATCH: 98/5121/11DH REF NO: GIL/57-14/17527 SERIAL NO: 1709-27 LUCKY NO: 10 We wish to congratulate you over your email success in our computer balloting sweepstake held 2nd February 2009. This is a millennium scientific computer game in which email addresses were picked randomly. It is a promotional program aimed at encouraging internet users around the world. Therefore you do not need to buy a ticket to enter for this promotional lottery program. Your email just won 1,000,000.00 EUR (One Million Euro). Please contact your claim agent for the claims of your winning amount as soon as possible. Mr. Tony Stevens F.L.K. CONSULTANT SA. Calle Doctor Vicente Zaragoza 27, 46020 Valencia, Spain. E-mail: flkespana@ozu.es Tel: +34-634-177842 Claim Expiration Date.10-03-2009 Sincerely, Mr. Gomez Fernando Blanco (Lottery coordinator) From donald.morss@ymail.com Mon Feb 9 07:21:28 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.3 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_40_50,HTML_MESSAGE,HTML_TITLE_EMPTY,J_CHICKENPOX_66, L_SOME_STD_PROBS,MIME_HTML_ONLY,PHISH_05,SUBJ_ALL_CAPS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_66 BODY: 6alpha-pock-6alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 HTML_40_50 BODY: Message is 40% to 50% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9976] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from barscarves.com (mail.barscarves.com [65.206.10.68]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n19FLPpZ014170 for ; Mon, 9 Feb 2009 07:21:28 -0800 Received: from User [82.128.47.192] by barscarves.com with ESMTP (SMTPD32-8.10) id A5616310080; Mon, 09 Feb 2009 10:01:53 -0500 Reply-To: From: "Donald Morss" Subject: [SPAM] PART TIME JOB OFFER Date: Mon, 9 Feb 2009 22:02:24 +0700 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200902091002159.SM01032@User> X-Greylist: Delayed for 00:15:20 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 09 Feb 2009 07:21:28 -0800 (PST) X-Spam-Prev-Subject: PART TIME JOB OFFER Status: R X-Status: X-Keywords: X-UID: 100 Content-Length: 4392
Good Day Sir/Madam
 
I hope this email meets you in good health. I feel quite safe dealing with you
in this mutual transaction. Though, this medium of Internet has
been greatly abused, I choose to reach you through it because it still remains
the fastest way to connect with people around the globe.
 
I am Dr. Donald Morss and i'm an artist, I am 42 years old and paint for a
living, and i've been painting for the past 18 years. I am married with a wife
and 2 lovely kids. I have a vacancy opening available in my studio. I am expanding
my business to the USA, EUROPE, AUSTRALIA and part of ASIA and will be needing a
Representative to work on a part time basis for me.
 
I sell Art works all over the world and have sold to both galleries and private
collectors. I am always facing serious difficulties selling my art works to my
AMERICAN & EUROPEAN CLIENTS; most times they offer to pay with either Money
Orders, Official Checks or Travellers Checks which are difficult for me to cash here
in the United Kingdom.
 
I need someone in the United states or Europe to work as my representative and assist
me in processing these payments and I will be willing to pay 10% for every
transaction made.
 
First step in this job is for you to wait at home for checks sent by my clients
via courier to get to you. For this to be possible I need your Basic personal info
such as:
 
1. Full Name:
2. Full Contact Address {P.O BOXES ARE NOT APPLICABLE}:
3. Occupation:
4. SEX:
5. Phone Number:
 
I will never ask you for anything more than that. No bank name, bank account
number,credit card, social security number etc. 
If anyone asks for those on my behalf please do not give out this info. This is
to ensure that you're not a victim of identity theft. After you
receive the checks you will have to go to the bank to cash them, this will
happen of course after the bank clears them. The time it takes for the checks to
clear depends on your bank, I need you to be trustworthy and honest with me for
I am ready to employ you for 6 months until I am fully established.
If you are interested in working for me, please kindly send the needed
information to my email: donald.morss@gmail.com
 
I await your reply.
   
Regards
Dr.Donald Morss
 From mary_10000clement@yahoo.co.jp Mon Feb 9 11:34:33 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_JP_1,DNS_FROM_RFC_POST, FREEMAIL_FROM,FREEMAIL_REPLYTO,FROM_HAS_ULINE_NUMS,HTML_10_20,HTML_MESSAGE, J_CHICKENPOX_21,J_CHICKENPOX_32,J_CHICKENPOX_42,J_CHICKENPOX_81, J_CHICKENPOX_82,MILLION_USD,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RCVD_IN_SBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_PASS,SUBJ_ALL_CAPS, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 0.3 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 1.8 MILLION_USD BODY: Talks about millions of dollars * 0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha * 0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 0.6 J_CHICKENPOX_81 BODY: 8alpha-pock-1alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.207.0.181 listed in zen.spamhaus.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from web3006.mail.tnz.yahoo.co.jp (web3006.mail.tnz.yahoo.co.jp [203.216.249.206]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n19JYTiq020798 for ; Mon, 9 Feb 2009 11:34:33 -0800 Received: (qmail 16027 invoked by uid 60001); 9 Feb 2009 19:07:46 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=yj20050223; d=yahoo.co.jp; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=cDUHinTYAFVxrcF1YmZXbWVKxc81sMjG4V/Yyk5UVRpjp5o9nHYd8uPAcFDlfYE6ZpS5OFtwobqARcf7YNg9amH0n8IHqeymE7b/lxCf0NGq/HV5LXWY1STfLCsqV5xN ; Message-ID: <20090209190746.16025.qmail@web3006.mail.tnz.yahoo.co.jp> Received: from [41.207.0.181] by web3006.mail.tnz.yahoo.co.jp via HTTP; Tue, 10 Feb 2009 04:07:46 JST Date: Tue, 10 Feb 2009 04:07:46 +0900 (JST) From: From Mary Clement Reply-To: clementmmy@yahoo.co.jp Subject: [SPAM] FROM MISS MARY To: mary_10000clement@yahoo.co.jp MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-632883468-1234206466=:15421" X-Greylist: Delayed for 00:26:41 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 09 Feb 2009 11:34:33 -0800 (PST) X-Spam-Prev-Subject: FROM MISS MARY Status: R X-Status: X-Keywords: X-UID: 101 Content-Length: 5505 --0-632883468-1234206466=:15421 Content-Type: text/plain; charset=iso-2022-jp Dearest One, Based on your profile, the trust and God's divine guidance that I have this great oppoutunity linking up to you, though we have not meet before but I believe that one have to risk in confiding his secret to succeed sometimes in life. My name is Miss Mary Clement, a 22 years old undergraduate.I am only daughter of chief/Mrs Johnson Clement a major cocoa exporter cum politician.I am native of Lorma in western part of liberia,Africa. I was born out of tragic fate.my mother died from cancer when I was only 4 years old,my father nurtured me with great care and love before he met his own untimely death on the way coming back from business trip from overseas,on his arrival to the airport his driver went to drove him back home on the way they have a fatal car accident which killied his driver at spot while my father spent 3 painful days at hospital before dying. my uncle seized all my father's companies and properties because of our traditionl believe that i'm a woman. I was left with nothing and dropped out of school because of finacial difficulties and my uncle's wicked attitude. My father told me a deep secret on his sick bed which I want to share with you in a full confidentiality.He deposited a huge sum of $7 million Dollers ($7,OOO,OOO USD)in one of reputable private security company in Ivory Coast because of polictical instability in our country Liberia without the knowledge of my uncle.presently I'm in ivory coast since the civil war broke out in liberia as a refugee in one of missionary home while my uncle flew to the london with his children.although I have contacted the security company they comfirmed the logdement. Dearest all I want you to do for me is to step forward as my foreign partner to the security company so that the money will be retrieve,I have all the neccesary information to back you up.i will sincerely give you 10% out of the money,5% for any expenses incurred during the transaction and the rest will be used for any investement preferred by you in your country. I am pleading to you with the name of Almighty God to help me out of this problem.coincidentally Ivory coast is now having it's own political unrest too, I am kindly waiting for your soonest response. MAY GOD BLESS YOU. All my love, Miss Mary Clement. --------------------------------- Power up the Internet with Yahoo! Toolbar. --0-632883468-1234206466=:15421 Content-Type: text/html; charset=iso-2022-jp Dearest One,
                       
Based on your profile, the trust and  God's divine guidance that I have this great oppoutunity linking up to you, though we have not meet before but I believe that one have to risk in confiding his secret to succeed sometimes in life.
 
 My name is Miss Mary Clement, a 22 years old undergraduate.I am only daughter of chief/Mrs Johnson Clement a major cocoa exporter cum politician.I am native of Lorma in western part of liberia,Africa.
  
I was born out of tragic fate.my mother died from cancer when I was only 4 years old,my father nurtured me with great care and love before he met his own untimely death on  the way coming back from business trip from overseas,on his arrival to the airport his driver went to drove him back home on the way they have a fatal car accident which killied his driver at spot while my father spent 3 painful days at hospital before dying. my uncle seized all my father's companies and properties because of our traditionl believe that i'm a woman. I was left with nothing and dropped out of school because of finacial difficulties and my uncle's wicked attitude.
 
My father told me a deep secret on his sick bed which I want to  share with you in a full confidentiality.He deposited a huge sum of $7 million Dollers ($7,OOO,OOO USD)in one of reputable private security company in Ivory Coast because of polictical instability in our country Liberia without the knowledge of my uncle.presently I'm in ivory coast since the civil war broke out in liberia as a refugee in one of missionary home while my uncle flew to the london with his children.although I have contacted the security company they comfirmed the logdement.
 
Dearest all I want you to do for me is to step forward as my foreign partner to the security company so that the money will be retrieve,I have all the neccesary information to back you up.i will sincerely give you 10% out of the money,5% for any expenses incurred during the transaction and the rest will be used for any investement preferred by you in your country. 
 
I am pleading to you with the name of Almighty God to help me out of this problem.coincidentally Ivory coast is now having it's own political unrest too,
I am kindly waiting for your soonest response.
MAY GOD BLESS YOU.
All my love,
Miss Mary Clement.
 
 

Power up the Internet with Yahoo! Toolbar.
--0-632883468-1234206466=:15421-- From Jantaman_h@un.org Mon Feb 9 21:36:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.4 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_FR_2,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_21,L_SOME_STD_PROBS,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3,SPF_FAIL,UNDISC_RECIPS, URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=jantaman_h%40un.org&ip=80.12.242.30&receiver=ga.impsec.org] * 0.4 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp-out.orange.net (smtp59.orange.fr [80.12.242.30]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1A5a4L3003861 for ; Mon, 9 Feb 2009 21:36:08 -0800 Received: from smtp-out.orange.net (mwinf5901 [10.232.8.23]) by mwinf5905.orange.net (SMTP Server) with ESMTP id 9F66D1C020F3 for ; Tue, 10 Feb 2009 06:18:20 +0100 (CET) Received: from User (unknown [10.163.121.146]) by mwinf5901.orange.net (SMTP Server) with ESMTP id 3B74F2000210; Tue, 10 Feb 2009 06:18:06 +0100 (CET) X-ME-UUID: 20090210051806243.3B74F2000210@mwinf5901.orange.net Reply-To: From: "H. Jantamanta" Subject: [SPAM] From Harry & Partners Date: Tue, 10 Feb 2009 06:18:07 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090210051806.3B74F2000210@mwinf5901.orange.net> To: undisclosed-recipients: ; X-Greylist: Delayed for 00:17:48 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 09 Feb 2009 21:36:08 -0800 (PST) X-Spam-Prev-Subject: From Harry & Partners Status: R X-Status: X-Keywords: X-UID: 102 Content-Length: 1303 From: Harry Jantamanta 3 Whitehall Court, London, SW1A 2EL London Private Mobile: 44 704 576 2068 My name is Harry Jantamanta, UN humanitarian abuse reporter here in UN Independent Station United Kingdom. I got your contact through cross border business information centre situated here in London as an online investor. On behalf of my partners, I seek your assistance to accommodate and invest for us the sum of USD22.6M. The money in question is sourced to us by a particular head of states as a gesture for appreciation of a good work rendered to their country, but In line with the moral principal of our services, we are not required to accept gift of any kind nor own more than 10,000 USD in our respective bank account, hence our plea to be represented by a trust worthy person to accommodate and invest the sum for us. Please note that this request is not a hoax. We count on your ability to accommodate and invest the funds for us until we are able to process our resignation successfully. If you are interested please provide me with the following in return email: YOUR NAME IN FULL YOUR OFFICE OR RESIDENTIAL ADDRESS TEL AND FAX NUMBER As soon as I hear from you, further details regarding the transaction will be unveiled to you. I look forward for your urgent response. From tgfde@eircom.net Tue Feb 10 04:22:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,DEAR_FRIEND,DNS_FROM_RFC_ABUSE,FREEMAIL_FORGED, J_CHICKENPOX_48,J_CHICKENPOX_72,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID, SARE_FRAUD_X3,SARE_SUB_NEED_REPLY,SPAMMY_WEBMAIL,STOX_30,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 0.4 URG_BIZ BODY: Contains urgent matter * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from mail08.svc.cra.dublin.eircom.net (mail08.svc.cra.dublin.eircom.net [159.134.118.24]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1ACMCQt014555 for ; Tue, 10 Feb 2009 04:22:16 -0800 Message-Id: <200902101222.n1ACMCQt014555@ga.impsec.org> Received: (qmail 56027 messnum 12980141 invoked from network[86.43.60.100/webmail00.webmail.cra.eircom.net]); 10 Feb 2009 11:55:32 -0000 Received: from webmail00.webmail.cra.eircom.net (HELO webmailclassic.eircom.net) (86.43.60.100) by mail08.svc.cra.dublin.eircom.net (qp 56027) with SMTP; 10 Feb 2009 11:55:32 -0000 From: "usen ibro" Reply-To: To: .@ga.impsec.org Subject: [SPAM] I am expecting your urgent response Date: Tue, 10 Feb 2009 11:55:59 +0000 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit X-Originating-IP: 140.113.156.245 X-Mailer: Eircom Net CRC Webmail (http://www.eircom.net/) Organization: Eircom Net (http://www.eircom.net/) X-Greylist: Delayed for 00:26:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 10 Feb 2009 04:22:16 -0800 (PST) X-Spam-Prev-Subject: I am expecting your urgent response Status: R X-Status: X-Keywords: X-UID: 103 Content-Length: 1599 FROM MR USEN IBRO.AUDITING AND ACCOUNTING SECTION, BANK OF AFRICA(BOA), OUAGADOUGOU BURKINA-FASO. Dear Friend, This message might meet you in utmost surprisea, however,it's just my urgent need for foreign partner that made me to contact you for this transaction. I am a banker by profession from Burkina faso in west Africa and currently holding the post of Director Auditing and Accounting unit of the bank.I have the opportunity transferring the left over funds (USD $7.5M) SEVEN MILLION FIVE HUNDRED THOUSAND UNITED STATES of one of my bank CUSTOMER who died along with his entire family on 26TH DECEMBER 2003 in a plane crash AT BENIN REPUBLIC . You can confirm the genuine of the deceased death by clicking on this website: http://www.cnn.com/2003/WORLD/africa/12/26/benin.crash/index.html Hence,i am inviting you for a business deal where this money can be shared between OF us in the ratio of 60/40 percentage.If you agree to my business proposal.further details of the transfer will be forwarded to you as soon as i receive your return mail, further details and information should be forwarded to you, try to send your responds with your telephone number so that I will call you for more clarifications. You contact me through this my alternative email address: usen_ibro03@yahoo.fr I am waiting for your urgent responds. Have a great day, With Best Regards. USEN IBRO. ----------------------------------------------------------------- Find the home of your dreams with eircom net property Sign up for email alerts now http://www.eircom.net/propertyalerts From info@mmail.com Tue Feb 10 04:53:30 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_35, J_CHICKENPOX_41,LOTTO_YOU_WON_02,MILLIONS_01,NA_DOLLARS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RCVD_IN_BRBL,SARE_FRAUD_X3,SUB_HELLO,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 J_CHICKENPOX_35 BODY: 3alpha-pock-5alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 91] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 91] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.79.199.173 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [74.70.59.59 listed in dnsbl.sorbs.net] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from chad.parry.org (chad.parry.org [64.79.199.173]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1ACrN1L015013 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 10 Feb 2009 04:53:30 -0800 Received: by chad.parry.org (Postfix, from userid 100) id 50553AA9645; Mon, 9 Feb 2009 23:55:04 -0800 (PST) Received: from User (cpe-74-70-59-59.nycap.res.rr.com [74.70.59.59]) by chad.parry.org (Postfix) with ESMTP id 303DAAA9647; Mon, 9 Feb 2009 23:54:17 -0800 (PST) Reply-To: From: "Nina Mayer" Subject: [SPAM] hello Date: Tue, 10 Feb 2009 08:54:56 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090210075418.303DAAA9647@chad.parry.org> To: undisclosed-recipients:; X-Greylist: Delayed for 02:50:35 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 10 Feb 2009 04:53:30 -0800 (PST) X-Spam-Prev-Subject: hello Status: R X-Status: X-Keywords: X-UID: 104 Content-Length: 2389 Hello Friend, My name is Mrs. Nina Mayers. I am a dying woman who has decided to donate what I have to charity through you.You may be wondering why I chose you. But someone has to be chosen.I am 59 years old and was diagnosed for cancer about 2 years ago,years after the death of my husband who had left me everything he worked for.I have decided to donate from what I have inherited from my late husband to charity through you for the good work of humanity,rather than allow my relatives to use my husbands hard earned funds inappropriately. I am presently in London waiting for an operation and praying that I survive. I have decided to WILL/Donate the sum of US$10.5 Million (Ten Million five hundred US Dollars) of my husband investment in to charity through you for the good work of humanity, and to help the motherless,less privileged and also for the assistance of the widows. At the moment I cannot take any telephone calls, due to the fact that I have been restricted by my doctor from taking telephone calls because I deserve all the rest I can get before the operation. Presently,I have informed my lawyer about my decision in WILLING this fund to charity through you. I wish you all the best of luck, and please use the funds well as I want it to be a seed i have sown and always extend the good work to others.If you are interested in carrying out this task,i will inform my Family Lawyer so that he can arrange the release of the funds to you. You may wonder, why dont i call the the many charity group and donate the fund to them, that is the more reason i have contacted you, there is a little logistic work to be done, and it involves direct dealing with the bank and providing the necessary logistics for the transfer of the fund before the final donation, for this reason and owning to the fact that my health is bad to carry out all this i have deceided to contact you, in reward, you shall take 20% of the fund while the rest will be donated to various charities. NB: I will appreciate your utmost confidentiality in this matter until the task is accomplished,as I dont want anything that will Jeopardize my last wish, due to the fact that I do not want relatives or family members standing in the way of my last wish. If you are wiling to help in this course kindly reply to this email to enable my lawyer contact you. Love, Nina Mayers mrsme59@gmail.com From mail34@dodo.com.au Tue Feb 10 07:05:01 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,FREEMAIL_FORGED, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_21, J_CHICKENPOX_23,J_CHICKENPOX_31,J_CHICKENPOX_33,J_CHICKENPOX_53, J_CHICKENPOX_61,J_CHICKENPOX_64,J_CHICKENPOX_71,MILLIONS_01,MILLION_USD, RAZOR2_CHECK,SARE_FRAUD_X3,SPAMMY_WEBMAIL,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 0.6 J_CHICKENPOX_23 BODY: 2alpha-pock-3alpha * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from relay01.mail-hub.dodo.com.au (relay01.mail-hub.dodo.com.au [203.220.32.149]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1AF4pNZ018658 for ; Tue, 10 Feb 2009 07:04:55 -0800 Received: from mail02.mail-hub.dodo.com.au ([123.2.6.232]) by relay01.mail-hub.dodo.com.au with esmtp (Exim 4.66) (envelope-from ) id 1LVO7b-0004SK-Th; Fri, 06 Feb 2009 21:39:44 +1100 Received: from [127.0.0.1] (helo=webmail.dodo.com.au) by mail02.mail-hub.dodo.com.au with smtp (Exim 4.66) (envelope-from ) id 1LVO7b-0004zS-NI; Fri, 06 Feb 2009 21:39:43 +1100 Recieved: from [219.239.90.85] with HTTP; Fri, 6 Feb 2009 21:39:43 +1100 Message-ID: <20090206213943.19057.498C115745DFD-498C@webmail.dodo.com.au> Date: Fri, 6 Feb 2009 21:39:43 +1100 From: "Mr. Song Li Le" Reply-to: "Mr. Song Li Le" Subject: [SPAM] Dear Friend X-Priority: 3 X-Mailer: Dodo Internet Webmail Server X-Original-IP: 219.239.90.85 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="iso-8859-1"; MIME-Version: 1.0 X-Greylist: Delayed for 100:23:03 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 10 Feb 2009 07:05:01 -0800 (PST) X-Spam-Prev-Subject: Dear Friend Status: R X-Status: X-Keywords: X-UID: 105 Content-Length: 6219 -- Dear Friend, I am Mr.Song LiLe Executive Director of the Hang Seng Bank Ltd,Sai Wan Ho Branch,171 Shaukiwan Road Hong Kong. An Iraqi named Haider Hanoon,a business man made a numbered fixed deposit of (346,736,899.68 HKD) for 18 calendar months;this is valued to Forty Million Five Hundred Thousand United State Dollars only in my branch.Upon maturity several notices was sent to him, even during the war, two years ago (2007).Again after the war another notification was sent and still no responsecame from him. We later found out that Haider Hanoon and his family had been killed during the war in Gunfire that hit theirhome at Mukaradeeb where his personal oil well was. After further investigation it was also discovered that Haider Hanoon did not declare any next of kin in his official papers including the paper work of his bank deposit. And he also confided in me the last time he was at my office that no one except me knew of his deposit in my bank.So Forty Four million Five Hundred Thousand United State Dollars is still lying in my bank and no one will ever come forward to claim it.What bothers me is that according to the laws of my country at the expiration five years six months the funds will revert to the ownership of the Hong Kong Government if nobody applies to claim the funds. My proposal, I am prepared to place you as the next of kin in a position to instruct HANG SENG BANK to release the deposit to you as the closest surviving relation. Upon receipt of the deposit, I am prepared to share the money with you in half.That is:I will simply nominate you as the next of kin and have them release the deposit to you. We share the percentage 50/50.I would have gone ahead to ask the funds be released to me,but that would have drawn a straight line in my involvement in claiming the deposit.I assure you that I could have the deposit released to you within a few days. I will simply inform the bank of the final closing of the file relating to Haider Hanoon I will then officially communicate with my Bank and instruct them to release the deposit to you.With these:all is done. I am aware of the consequences of this proposal. I ask that if you find no interest in this project that you should discard this mail. I ask that you do not be vindictive and destructive. If my offer is of no appeal to you, delete this message and forget I ever contacted you. Do not destroy my career because you do not approve of my proposal.You may not know this but people like myself who have made tidy sums out of comparable situations run the whole private banking sector.I am not a criminal and what I do,I do not find against good conscience,this may be hard for you to understand, but the dynamics of my industry dictates that I make this move.Such opportunities only come ones way once in a lifetime. I cannot let this chance pass me by, for once I find myself in total control of my destiny. These chances wont pass me by. I ask that you do not destroy my chance, if you will not work with me let me know and let me move on with my life but do not destroy me. I am a family man and this is an opportunity to provide them with new opportunities. There is a reward for this project and it is a task well worth undertaking.I have evaluated the risks and the only risk I have here is from you refusing to work with me and alerting my bank.I am the only one who knows of this situation, good fortune has blessed you with a name that has planted you into the center of relevance in my life. Lets share the blessing. If you give me positive signals,I will initiate this process towards a conclusion.I wish to inform you that should you contact me via official channels; I will deny knowing you and about this project. I repeat, I do not want you contacting me through my official phone lines nor do I want you contacting me through my official email account.Contact me only through the email account that i will provide there in this email. Further more be informed that the fact that you are a foreigner give you the privilege to stand in as my deceased client beneficiary as my Deceased client had no relation all his family died with him during the war and I can not use my relation because its not accepted here in Hong Kong. Also I am very confident that we will be able to establish the trust that is needed to complete this deal and all that I need from the time been is your willingness and commitment so that we can end this in the next one week. What you need to understand about this transaction is that I will make sure that it passes through all international banking laws regards to this I will take care of all the expenses and the cost of retaining the service of my Attorney to give the transaction the proper documentation that is required to perfect the finishing. Your only obligation in this transaction will be opening of offshore accounts that can accommodatthese funds and I will give you more lightly later once you agree to partner with me. Like I said before there is no risk involve as it will pass through international banking laws and all documents related to this transaction will be sent to you by post for your perusal and trust.I do not want any direct link between you and me. My official lines are not secure lines as they are periodically monitored to assess our level of customer care in line with our Total Quality Management Policy. Please observe this instruction religiously. Please, again, note I am a family man,I have wife and children. I send you this mail not without a measure of fear as to what the consequences,but I know within me that nothing ventured is nothing gained and that success and riches never come easy or on a platter of gold. This is the one truth I have learned from my private banking clients. Do not betray my confidence. If we can be of one accord, we should plan a meeting, soon. Should you be interested I will prefer you to reach me on the emailaddressbelow.E-mail:hana_lile23@yahoo.cn Your earliest response to this letter will be appreciated. I await your response. Mr. Song Li Le hana_lile23@yahoo.cn ________________________________________________ This message was sent using Dodo Webmail - www.dodo.com.au From richardsclark3@sify.com Tue Feb 10 07:10:52 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************** X-Spam-Status: Yes, score=55.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_BR_1,BL_COUNTRY_NG_2, DEAR_SOMETHING,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_55, MILLIONS_01,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SARE_FRAUD_X4, SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_FREE_WEBM_ZCom01,STOX_30,TO_CC_NONE,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.6 SARE_FREE_WEBM_ZCom01 Sender used free email account - may be * spammer * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_55 BODY: 5alpha-pock-5alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [189.14.96.212 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.72 listed in zen.spamhaus.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.72 listed in dnsbl.sorbs.net] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.72 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from colocation-mail.saoluis.org (colocation-mail.saoluis.org [189.14.96.212]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1AFAk7T019131 for ; Tue, 10 Feb 2009 07:10:51 -0800 Message-Id: <200902101510.n1AFAk7T019131@ga.impsec.org> Received: (qmail 10147 invoked by uid 0); 10 Feb 2009 12:55:07 -0000 Received: from unknown (HELO User) (william.ribeiro@saoluis.org@196.3.183.72) by smtp.saoluis.org with SMTP; 10 Feb 2009 12:54:51 -0000 Reply-To: From: "Richards Clark" Subject: [SPAM] Re: This is very Urgent. Please Reply Date: Tue, 10 Feb 2009 05:47:01 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-Greylist: Delayed for 01:22:53 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 10 Feb 2009 07:10:51 -0800 (PST) X-Spam-Prev-Subject: Re: This is very Urgent. Please Reply Status: R X-Status: X-Keywords: X-UID: 106 Content-Length: 2710 >From Barrister Richard Clark And Associate Chambers Ikoyi,Lagos. Dear Sir Greetings with good faith. I am Barrister Richards Clark, a solicitor at law. I am the personal attorney to Mr. Mack (CEO) a national of your country, who used to work with Shell Petroleum Development Company (SPDC) in Nigeria. Here in after shall be referred to as my client. On Sunday, 2 February, 2003, my client, his wife and their three children were involved in Ikeja bomb blast here in my country. My client and his family unfortunately lost their lives. Since then I have made several enquiries to your embassy to locate any of my clients extended relatives but all to no avail. After these several unsuccessful attempts, I decided to track his last name over the Internet, to locate any member of his family hence I contacted you. I have contacted you to assist in repatriating the money and property left behind by my client before they get confiscated or declared unserviceable by the bank where these huge deposits were lodged. Particularly, the finance company where the deceased had an account valued at about USD$30.95 million dollars has issued me a notice to provide the next of kin or have the account confiscated within the next few weeks. Since I have been unsuccessful in locating the relatives for over two years now. I seek your consent to present you as the next of kin of the deceased since you have the same last name so that the proceeds of this account valued at USD30.95 million dollars can be paid to you and then you and I can share the money in the following ration: 60% to me and 40% to you. I have all necessary legal documents that can be used to back up any claim we may make. I have worked out the modalities of this transaction. All I require is your sincere cooperation to enable us seeing this deal through. I guarantee that this will be executed under a legitimate arrangement that will protect you from any breach of the law. Please if you are interested to work with me with good faith and honesty, All you have to do is to send me Your company name and address if any, Your telephone and fax numbers which I will use to process and procure all the legal papers/documents that backs you up as the true next of kin to my client and I will submit it to the Finance house for proper Claim of the fund. I hope to hear further response from you regards the successful conclusion of this great success. God bless you. Please view these websites below to confirm what I am telling you. http://news.bbc.co.uk/1/hi/world/africa/2718295.stm Respectfully, Barrister Richards Clark. From info@infonegocio.com Wed Feb 11 03:28:29 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************* X-Spam-Status: Yes, score=19.6 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, LOTTO_YOU_WON_03,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SPF_PASS,SUBJ_ALL_CAPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout3.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1BBSOgs017772 for ; Wed, 11 Feb 2009 03:28:27 -0800 Received: from User (98.222.47.229) by ctsmtpout3.frontal.correo (7.2.056.6) (authenticated as euroka@infonegocio.com) id 498D4046003FC28B; Wed, 11 Feb 2009 12:11:10 +0100 Message-ID: <498D4046003FC28B@ctsmtpout3.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "JOHN MILES" To: info@infonegocio.com Subject: [SPAM] << NOTIFICATION >> Date: Wed, 11 Feb 2009 12:10:48 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:16:53 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 11 Feb 2009 03:28:28 -0800 (PST) X-Spam-Prev-Subject: << NOTIFICATION >> Status: R X-Status: X-Keywords: X-UID: 107 We wish to notify you again that you were listed as a beneficiary to the total sum of Twelve Million Pounds in the codicil and last testament of the deceased, Name now withheld since this is our second letter to you. All the legal papers will be processed in your name. In your acceptance of this deal, we request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at the probate registry for the claim. Please indicate your interest immediately via email for us to proceed. I shall feed you with full details on the procedure upon receipt of your reply towards this notice. Wishing you a happy New Year Yours faithfully, JOHN MILES From mailer@un.org Wed Feb 11 13:00:03 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.9 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,J_CHICKENPOX_33, J_CHICKENPOX_34,J_CHICKENPOX_46,J_CHICKENPOX_53,J_CHICKENPOX_63, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, SPF_FAIL,SUBJ_ALL_CAPS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.1 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=mailer%40un.org&ip=64.34.179.91&receiver=ga.impsec.org] * 0.6 J_CHICKENPOX_46 BODY: 4alpha-pock-6alpha * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 96] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 96] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.34.179.91 listed in b.barracudacentral.org] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from zimbra.ummsc.com (zimbra.ummsc.com [64.34.179.91]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1BKxuMj032607 for ; Wed, 11 Feb 2009 13:00:01 -0800 Received: from localhost (localhost.localdomain [127.0.0.1]) by zimbra.ummsc.com (Postfix) with ESMTP id 613E517F831D; Tue, 10 Feb 2009 10:19:53 -0600 (CST) X-Virus-Scanned: amavisd-new at Received: from zimbra.ummsc.com ([127.0.0.1]) by localhost (zimbra.ummsc.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MQKL4iqc0hkJ; Tue, 10 Feb 2009 10:19:50 -0600 (CST) Received: from User (unknown [41.211.250.63]) by zimbra.ummsc.com (Postfix) with ESMTP id 2F6CF1709081; Tue, 10 Feb 2009 10:10:59 -0600 (CST) Reply-To: From: "United Nations" Subject: [SPAM] UN GOOD NEWS. Date: Tue, 10 Feb 2009 07:08:41 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090210161100.2F6CF1709081@zimbra.ummsc.com> To: undisclosed-recipients:; X-Greylist: Delayed for 20:06:44 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 11 Feb 2009 13:00:01 -0800 (PST) X-Spam-Prev-Subject: UN GOOD NEWS. Status: R X-Status: X-Keywords: X-UID: 108 Content-Length: 1621 Attn:Sir/ma. How are you today and hope all is well with you and family?You may not understand why this mail came to you,but i will implore you to take your time to carefully go through this mail. We have been having a meeting for the pass 7 months which ended 4 days ago at our office head quarters New York(UNITED NATIONS). This email is to all the people that feel they have been scammed in any part of the world,the UNITED NATION have agreed to compensate them with the sum of US$ 100,000. This includes every foreign contractors that may have not received their contract sum, and people that have had an unfinished transaction or international businesses that failed due to Government problems etc. We found your name in our list and that is why we are contacting you,this have been agreed upon and has been signed. You are advised to contact Mr. Jim Ovia of ZENITH BANK NIGERIA PLC, as he is our representative in Nigeria, contact him immediately for your Cheque/International Bank Draft of USD$ 100,000. This funds are in a Bank Draft for security purpose OK? so he will send it to you and you can clear it at any bank of your choice. Therefore, you should send him your full Name and telephone number/your correct mailing address where you want him to send the Draft to you. Contact:Mr. Jim Ovia immediately for your Cheque: Person to Contact Mr. Jim Ovia Email: mrjimovia1968@gmail.com Thanks and God bless you and your family.Hoping to hear from you as soon as you cash your Bank Draft. Making the world a better place. Regards, Mr. Kofi Anann Former Secretary (UNITED NATIONS). From emillyjackoju@googlemail.com Wed Feb 11 15:08:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.2 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_MX_1,FREEMAIL_FROM,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_71,J_CHICKENPOX_91,L_SOME_STD_PROBS,SPF_NEUTRAL, THOUS_EMAIL_ADDRS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_MX_1 Mail client in Mexico * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=emillyjackoju%40googlemail.com&ip=201.134.127.1&receiver=ga.impsec.org] * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 0.6 J_CHICKENPOX_91 BODY: 9alpha-pock-1alpha * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9988] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from masred.com.mx (www.masred.com.mx [201.134.127.1] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1BN7ovt003845; Wed, 11 Feb 2009 15:07:56 -0800 Received: from masred.com.mx (localhost [127.0.0.1]) by masred.com.mx (Postfix) with ESMTP id E3B3CF76C1; Wed, 11 Feb 2009 13:53:07 -0600 (CST) From: "Emilly Olivier" Reply-To: emillyjackoju@googlemail.com Subject: [SPAM] Contact Mr. Mark Robbin Immediately .. Date: Wed, 11 Feb 2009 19:53:06 +0000 Message-Id: <20090211192751.M76900@gmail.com> X-Mailer: Open WebMail 2.30 20040131 X-OriginatingIP: 41.217.2.8 (ventas) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 To: undisclosed-recipients:; X-Greylist: Delayed for 02:36:44 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 11 Feb 2009 15:08:06 -0800 (PST) X-Spam-Prev-Subject: Contact Mr. Mark Robbin Immediately .. Status: R X-Status: X-Keywords: X-UID: 109 Content-Length: 4901 I am sure this mail would be coming to you as a surprise since we have never met before and you would also be asking why I have decided to chose you amongs the numerous internet users in the world, precisely I cannot say why I have chosen you but do not be worried for I come in peace and something very positive is about to happen to your life right now and to the lives of others through you if only you can carefully read and digest the message below. The internet has made the world a global village where you can reach anybody you have not met before. Before I move further, permit me to give you a little of my biography,I am Mother Emilly Olivier, 87 Years old woman and the wife of Late Sir Jackman Olivier who died in a Plane crash on Monday the 7th of September 1998 GMT 14:22 UK while they were flying from New York to Geneva.Please see site below for more information. http://www.cnn.com/WORLD/9809/swissair.victims.list/index.html After the death of my husband I became the Head of his investment and now that I am old and weak I have decided to spend the rest of my life with my family and loved ones whom I never had time for during the course of my business life, but before the death of my husband we had a plan to use the last days of our lives to donate half of what we have worked for to the less privilege and charity homes and the other half for ourselves, family members and close friends, and it is so unfortunate that my husband is not alive today to do this with me and I am very weak and old now, hence I have decided to do this philanthropic work on behalf of my late husband and I. Presently, I have willed out almost half of our assets to several charity homes and to some of the less privilege in different countries. Despite the agreement between my late husband and I to give aid to the deprived, we also agreed to render support to an individual we have not meet before in life due to the fact when we were still young in life we receive an anonymous help from an individual we did not know and which we have not being able to know till date, the impact we got from such gesture made us to do same. I am sorry to inform you that you will never have the chance to know me because I have just concluded the assignment which my husband and I have agreed upon before his sudden death and you happened to be the beneficiary of our last WILL, irrespective of your previous financial status, hence I need you to do me a favor by accepting our offer that will cost you nothing. I have presently deposited a Cheque in the sum of 5,800,000.00 British Pound with FedEx express to deliver to you, what you have to do now is to contact the FedEx COURIER SERVICE as soon as possible to know when they will deliver your package to you because of the expiring date. For your information, I have paid for the delivering Charge,Insurance premium and Clearance Certificate Fee of the Cheque showing that it is not a Drug Money or meant to sponsor Terrorist attack in your Country. You have to contact the FedEx COURIER SERVICE now for the delivery of your cheque with this information bellow; Contact Person: Mr. Mark Robbins Email Address:fedexunitedkingdom@live.co.uk Again, you are not to pay for the delivering Charge, the Insurance premium and the Clearance Certificate Fee of the Cheque because I have already paid for them, the only money you are expected to pay is 185.34 British Pounds for the security keeping of the cheque so far. I would have paid the fee but the company insisted that I should not because they don't know when you will be contacting them and to avoid demurrage or further cost. You are to reconfirm the below information to them to avoid any mistake on the Delivery . Postal address; Full Names: Direct telephone number; Below is the security keeping code: (SCT/0433/F) of you draft, you are to also present it to them for verification before delivery. Let me repeat again, try to contact them as soon as you receive this mail to avoid any further delay and remember to ask them to provide you with the method they wish to use in receiving their security keeping fee of 185.34 British Pounds for their immediate action. Note: Please I do not want you to thank me or my husband all I need you to do is to invest wisely with it and do the same good to someone?s life someday as this is the only way this world would be a better community if we render selfless services to one another. Be also notified that I will no longer be reading my emails or surfing the internet as I have retired completely from the outside world to my ranch, at this moment I have nothing to do with cars, emails and other luxuries, all further correspondence should be forwarded to the courier company for the delivery of your cheque to you.. Yours Faithfully, Emilly Olivier Jackman From mrtailin555@yahoo.com.cn Thu Feb 12 14:53:55 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.7 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_31,J_CHICKENPOX_39,MILLIONS_01, MILLION_USD,RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET,TO_CC_NONE,X_PRIORITY_HIGH, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.6 J_CHICKENPOX_39 BODY: 3alpha-pock-9alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [58.172.97.224 listed in dnsbl.sorbs.net] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail05.syd.optusnet.com.au (mail05.syd.optusnet.com.au [211.29.132.186]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1CMrmXR008740 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 12 Feb 2009 14:53:54 -0800 Received: from User ([58.172.97.224]) (authenticated sender annbush@optusnet.com.au) by mail05.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id n1CMeMIm005637; Fri, 13 Feb 2009 09:40:43 +1100 Message-Id: <200902122240.n1CMeMIm005637@mail05.syd.optusnet.com.au> Reply-To: From: "Mr Tai Lin" Subject: [SPAM] Let Me Know Date: Thu, 12 Feb 2009 14:43:27 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: Let Me Know Status: R X-Status: X-Keywords: X-UID: 110 Content-Length: 2339 Dear Friend, I am Mr Tai Lin ,branch manager in one of the leadingbanks here in shanghai china. I respectfully seek your sincere conscent in this profitable proposal that i will explain to you.Six(6) years ago,precisely on tuesday Nov 6, 2002,a british oil consultant/contractor with the chinese mineral cooperation, deposited a numbered sum of Thirty million united states dollars(30,000,000 USD) in my branch valid for twelve calender months. On maturity, notification was sent to him umpteently but no response was forth coming. Thorough investigations were made and it was revealed by his contract employees; that the chinese solid mineral cooperation that he died from an unfortunate mishap.All paper works in my bank revealed that he did not declare any next of kin or relations.No one will ever come for this money.The law in place here in the republic of China stipulates that after six(6) years such monies are reverted to the chinese government.I want the money moved out of my bank as soon as possible before this long standing banking law is implemented and the money getting to top corrupt chinese government officials. Consequently, my demand from you is your conscent to stand as the next of kin to this late man's funds which I have total control over; be urgently transferred to any account provided by you in any part of the world.This transfer will go through several legal stages that will undoubtdly put you in place as the next of kin and eliminate any form of risk. A hired attorney will prepare the necessary documents that will legalize the procedures leading to the final transfer of the funds.My position here will speed up the legal procedures.Upon successful transfer into the account, we will share the money in the ratio 80% for me and 20% for you.For futher correspondences with you,I will like you would provide to me: Your Names in Full: Age: Occupation: Your Permanent Home Address: confidential Tel and Fax no: Please keep this confidential and lets do our best to see the end of this rewarding proposal.I will like to build a high level of trust with you and would require your assistance in investing my share in your country. ATTN:please Reply me via my office box:mrtailin555@yahoo.cn, for personal/security reasons. I urgently await your conscent. Thanks and regards. Mr. Tai Lin From daemon@web01.kbench.com Thu Feb 12 23:38:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=24.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_50,BL_COUNTRY_KR_2,FREEMAIL_FROM, FREEMAIL_REPLYTO,J_CHICKENPOX_33,J_CHICKENPOX_37,J_CHICKENPOX_54, J_CHICKENPOX_57,J_CHICKENPOX_62,J_CHICKENPOX_65,LOTTO_YOU_WON_03, L_SOME_STD_PROBS,MILLION_USD,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 1.8 MILLION_USD BODY: Talks about millions of dollars * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5000] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from web01.kbench.com ([219.240.16.91]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1D7c2wS022041 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 12 Feb 2009 23:38:08 -0800 Received: from web01.kbench.com (web01 [127.0.0.1]) by web01.kbench.com (8.13.8/8.13.8) with ESMTP id n1D7bvVk016871 for ; Fri, 13 Feb 2009 16:37:58 +0900 Received: (from daemon@localhost) by web01.kbench.com (8.13.8/8.13.8/Submit) id n1D7buaJ016863; Fri, 13 Feb 2009 16:37:56 +0900 Date: Fri, 13 Feb 2009 16:37:56 +0900 Message-Id: <200902130737.n1D7buaJ016863@web01.kbench.com> To: jhardin@impsec.org Subject: [SPAM] OFFICE OF THE VICE PRESIDENT/Respond To Me Now For Directions. From: "Mr. Goodluck Jonathan." Reply-To: officeofthe.vicepresidentng@gmail.com MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 17:49:23 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 12 Feb 2009 23:38:09 -0800 (PST) X-Spam-Prev-Subject: OFFICE OF THE VICE PRESIDENT/Respond To Me Now For Directions. Status: R X-Status: X-Keywords: X-UID: 111 Content-Length: 5847 OFFICE OF THE VICE PRESIDENT ASO-ROCK ABUJA,NIGERIA Payment Office E-mail: jonathangoodlucknigr@presidency.com Official E-mail: officeofthe.vicepresidentng@gmail.com Date: 13/02/2009. Attention: Beneficiary . REF: SECTION 201 IV/FEB/2009/PAYMENT/USD$36.6MILLION THE TRUTH ABOUT YOUR INHERITANCE . I, Mr. Goodluck Jonathan ( Vice President Federal Republic Of Nigeria ), I came across your file which was marked X and your released disk painted RED, I took time to study it and found out that you have paid VIRTUALLY all fees but the fund was not released to you.All your details are in my desk and will leave it untouch because you need to respond and clearify all i am seeking from you legally or else there is no way you can be compensated to receive these fund. The most annoying thing is that they won't tell you the truth that on no account will they ever release the fund to you,instead they allow you spend money unnecessarily,I do not intend to work here all the days of my life, I can release this fund to you if you can certify me of an assurance and clearly state how much you have spent paying fees to any of the below names and you are to kindly forward any emails you have been receiveing from any of the below person name which is listed below. I needed to do this because you need to know the status of your Funds and the cause for the delay,this is like a Mafia setting in Nigeria, you may not understand it because you are not a Nigerian. The only thing needed to release this fund is for you to tell me the TRUTH on how much you have lost and you are to tell me whom and who you sent money to because all the below names listed below are now unders probe and i have found out that most of the names stated below have never contacted you one day,its all these CROOKS that are using their names to write to you. One more thing and for you not to go through wrong hands,officials of BANKS and the wrong people claiming to be Federal Ministry Of Finance ( FMF) , you must beware and make sure you do not contact anyone,these is the main cause of you going through wrong hands by wasting your hard earned income just to receive the fund.Note that the actual funds is valued at USD$36.6 MILLION USD and its now safe for final transfer to you if only you will take to my advise. Listed below are the people and organization's behind the non release of your funds: 1) Prof. Charles soludo 2) Senator David Mark 3) Chief Joseph Sanusi 4) Dr. R. Rasheed 5) Barrister Awele Ugorji 6) Mr Roland Ngwa 7) Barrister Ucheuzo Williams 8) Mr. Ernest Chukwudi Obi 9) Dr. Patrick Aziza Deputy Governor - Policy / Board Member 10) Mr. Tunde Lemo Deputy Governor - Financial Sector Surveillance / Board Member 11) Mrs. W. D. A. Mshelia Deputy Governor - Corporate Services / Board Members 12) Mrs. Okonjo Iweala 13) Mrs. Rita Ekwesili 14) Barr Jacob Onyema 15) Dr. Godwin Oboh: Director Union Bank Of Nigeria. 16) Mr John Collins: Global Diplomat Director. 17) Foreign fund diplomatic courier 18) Barr. Becky Owens 19)Rev. Steven Jones 20) bank of Africa 21)Mrs. Debbie Hargrove 22)Mr. Micheal Wagner 23)Barr. Isa Farid 24)Dr. Raymond Faye 25)Ibraheem Fashola 26)Dr. Leslie Fawaz 27)Mercy Fajaroo 28)Walter K. Falana 29)Azeez Fatou 30)Ibrahim Fabumi 31)Daniel Faras 32)Micheal Faras 33)Minassa Fernandez 34)Viresh Fernando 35)Deacon Diende Fernandez 36)Ben Felix 37)Dr. Ige Femi 38)Chen Hsiu Fei 39)Gloria Festus 40)Lopez Fernando 41)Aloye Fidelis 42)Augusto Fish 43)Dr. Raymond Fingesi 44)Dr. Martin Fibu 45)Joseph Finn 46)Ogom Fidelis 47)Jennifer H. Fiedler 48)Dr. Jimmy Fowler 49)Robert Fortin 50)Dr. Sharon Forrest 51)Prince Michael Fofano 52)Sarah Fofano 53)Tony Foster 54)Dr. Koman Fofar 55)Samuel Fona 56)Grace Fona 57)Funmi Folorunso 58)Mike Franklin 59)Egbo Francois 60)George Freeman 61)Senator Jude Fred 62)Paul Frank 63)Dr. Francis Fregere 64)Walter Freer 65)Olu-Segun Fredrick 66)Justice Philip Francis 67)Raul Franco 68)Desmond Fred 69)Madu Frank 70)Rita Frank 71)Godwin Frank 72)Dr. J. Frances 73)Frank Francis 74)Derrick Frans 75)Kingsley Fred 76)Dr. Carlos Frederico 77)Dr Ola Funmilowo 78)Alan Fumbi 79)Vincent Fuso 80)Dr. John Fugar 81)William Funsho 82)Michael Funsho 83)Shahla Ghasemi 84)Ali-Reza Ghasemi 85)Martins Gambari 86)Jim Gallo 87)Paulo Gato 88)Ben Gafhar 89)Byron Gate 90)Arthur Gai 91)Shinder Gangar 92)Lopez Garvin 93)Abdul Gafah 94)Dr. Rufus Gaba 95)Alhaji Garba 96)Dr. Frank Gani 97)Brigadier Williams Gal 98)Egonna Duru Gal 99)Lucky Garbi 100)Sadique Gadaffi 101)Federick Ike Ganziri 102)Dr. Dennis Gavey 103)Jose Sanchez Garcia 104)Ahmed Gana 105)Jose A. Garcia 106)Major Archie Gates 107)Bavolleni Gallilo 108)Musa Galadima 109)Shehu Galadima 110)Barr. Imam Galadima 111)Barr. Jerry Galadima 112)Mustapha Gambo 113)Dr. Isah Gambo 114)Usman Gambo 115)Engr. Isaac Garuba 116)Alhani Azeez Garuba 117)Engr. Sule Garuba 118)Idris Garuba 119)Mustaph Garuba 120) ADB Bank Ouagadougou Burkinafaso 121) FSA UK 122) NATWEST BANK 123) ECO Bank 124) Credit Bank 125)Barr Greg Thompson 126)Mercy Gloria I have contacted the Federal Bureau Of Investigation Located at 601 4th Street,NW Washington, D.C. 20535 in person of Mr. Joseph Persichini ( Assistant Director In Charge Of The FBI ),and i will make sure you are highly protected and also do all i can just to make sure whosoever is found guilty is prosecuted,because the LAW must stand by and JUSTICE must prevail. Do get in touch with me to conclude this final transaction immediately,and also send to me your convenient tel/fax numbers for easy communications,and please you must use these CODE (PRIVATE2009) when responding to me. Regards, Mr. Goodluck Jonathan.(GCFR,FRN). Vice President Fed. Rep. Of Nigeria. From daemon@web01.kbench.com Thu Feb 12 23:46:42 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_50,BL_COUNTRY_KR_1,BL_COUNTRY_KR_2, DNS_FROM_RFC_ABUSE,FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_33, J_CHICKENPOX_37,J_CHICKENPOX_54,J_CHICKENPOX_57,J_CHICKENPOX_62, J_CHICKENPOX_65,LOTTO_YOU_WON_03,L_SOME_STD_PROBS,MILLION_USD,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 1.8 MILLION_USD BODY: Talks about millions of dollars * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 BL_COUNTRY_KR_1 RBL: Mail client in Korea * [219.240.16.91 listed in kr.countries.nerd.dk] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [219.240.16.91 listed in b.barracudacentral.org] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from web01.kbench.com ([219.240.16.91]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1D7kZor022179 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 12 Feb 2009 23:46:41 -0800 Received: from web01.kbench.com (web01 [127.0.0.1]) by web01.kbench.com (8.13.8/8.13.8) with ESMTP id n1D7kUgm001880 for ; Fri, 13 Feb 2009 16:46:30 +0900 Received: (from daemon@localhost) by web01.kbench.com (8.13.8/8.13.8/Submit) id n1D7kUJl001866; Fri, 13 Feb 2009 16:46:30 +0900 Date: Fri, 13 Feb 2009 16:46:30 +0900 Message-Id: <200902130746.n1D7kUJl001866@web01.kbench.com> To: jhardin@impsec.org Subject: [SPAM] OFFICE OF THE VICE PRESIDENT/Respond To Me Now For Directions. From: "Mr. Goodluck Jonathan." Reply-To: officeofthe.vicepresidentng@gmail.com MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit X-Spam-Prev-Subject: OFFICE OF THE VICE PRESIDENT/Respond To Me Now For Directions. Status: R X-Status: X-Keywords: X-UID: 112 Content-Length: 5847 OFFICE OF THE VICE PRESIDENT ASO-ROCK ABUJA,NIGERIA Payment Office E-mail: jonathangoodlucknigr@presidency.com Official E-mail: officeofthe.vicepresidentng@gmail.com Date: 13/02/2009. Attention: Beneficiary . REF: SECTION 201 IV/FEB/2009/PAYMENT/USD$36.6MILLION THE TRUTH ABOUT YOUR INHERITANCE . I, Mr. Goodluck Jonathan ( Vice President Federal Republic Of Nigeria ), I came across your file which was marked X and your released disk painted RED, I took time to study it and found out that you have paid VIRTUALLY all fees but the fund was not released to you.All your details are in my desk and will leave it untouch because you need to respond and clearify all i am seeking from you legally or else there is no way you can be compensated to receive these fund. The most annoying thing is that they won't tell you the truth that on no account will they ever release the fund to you,instead they allow you spend money unnecessarily,I do not intend to work here all the days of my life, I can release this fund to you if you can certify me of an assurance and clearly state how much you have spent paying fees to any of the below names and you are to kindly forward any emails you have been receiveing from any of the below person name which is listed below. I needed to do this because you need to know the status of your Funds and the cause for the delay,this is like a Mafia setting in Nigeria, you may not understand it because you are not a Nigerian. The only thing needed to release this fund is for you to tell me the TRUTH on how much you have lost and you are to tell me whom and who you sent money to because all the below names listed below are now unders probe and i have found out that most of the names stated below have never contacted you one day,its all these CROOKS that are using their names to write to you. One more thing and for you not to go through wrong hands,officials of BANKS and the wrong people claiming to be Federal Ministry Of Finance ( FMF) , you must beware and make sure you do not contact anyone,these is the main cause of you going through wrong hands by wasting your hard earned income just to receive the fund.Note that the actual funds is valued at USD$36.6 MILLION USD and its now safe for final transfer to you if only you will take to my advise. Listed below are the people and organization's behind the non release of your funds: 1) Prof. Charles soludo 2) Senator David Mark 3) Chief Joseph Sanusi 4) Dr. R. Rasheed 5) Barrister Awele Ugorji 6) Mr Roland Ngwa 7) Barrister Ucheuzo Williams 8) Mr. Ernest Chukwudi Obi 9) Dr. Patrick Aziza Deputy Governor - Policy / Board Member 10) Mr. Tunde Lemo Deputy Governor - Financial Sector Surveillance / Board Member 11) Mrs. W. D. A. Mshelia Deputy Governor - Corporate Services / Board Members 12) Mrs. Okonjo Iweala 13) Mrs. Rita Ekwesili 14) Barr Jacob Onyema 15) Dr. Godwin Oboh: Director Union Bank Of Nigeria. 16) Mr John Collins: Global Diplomat Director. 17) Foreign fund diplomatic courier 18) Barr. Becky Owens 19)Rev. Steven Jones 20) bank of Africa 21)Mrs. Debbie Hargrove 22)Mr. Micheal Wagner 23)Barr. Isa Farid 24)Dr. Raymond Faye 25)Ibraheem Fashola 26)Dr. Leslie Fawaz 27)Mercy Fajaroo 28)Walter K. Falana 29)Azeez Fatou 30)Ibrahim Fabumi 31)Daniel Faras 32)Micheal Faras 33)Minassa Fernandez 34)Viresh Fernando 35)Deacon Diende Fernandez 36)Ben Felix 37)Dr. Ige Femi 38)Chen Hsiu Fei 39)Gloria Festus 40)Lopez Fernando 41)Aloye Fidelis 42)Augusto Fish 43)Dr. Raymond Fingesi 44)Dr. Martin Fibu 45)Joseph Finn 46)Ogom Fidelis 47)Jennifer H. Fiedler 48)Dr. Jimmy Fowler 49)Robert Fortin 50)Dr. Sharon Forrest 51)Prince Michael Fofano 52)Sarah Fofano 53)Tony Foster 54)Dr. Koman Fofar 55)Samuel Fona 56)Grace Fona 57)Funmi Folorunso 58)Mike Franklin 59)Egbo Francois 60)George Freeman 61)Senator Jude Fred 62)Paul Frank 63)Dr. Francis Fregere 64)Walter Freer 65)Olu-Segun Fredrick 66)Justice Philip Francis 67)Raul Franco 68)Desmond Fred 69)Madu Frank 70)Rita Frank 71)Godwin Frank 72)Dr. J. Frances 73)Frank Francis 74)Derrick Frans 75)Kingsley Fred 76)Dr. Carlos Frederico 77)Dr Ola Funmilowo 78)Alan Fumbi 79)Vincent Fuso 80)Dr. John Fugar 81)William Funsho 82)Michael Funsho 83)Shahla Ghasemi 84)Ali-Reza Ghasemi 85)Martins Gambari 86)Jim Gallo 87)Paulo Gato 88)Ben Gafhar 89)Byron Gate 90)Arthur Gai 91)Shinder Gangar 92)Lopez Garvin 93)Abdul Gafah 94)Dr. Rufus Gaba 95)Alhaji Garba 96)Dr. Frank Gani 97)Brigadier Williams Gal 98)Egonna Duru Gal 99)Lucky Garbi 100)Sadique Gadaffi 101)Federick Ike Ganziri 102)Dr. Dennis Gavey 103)Jose Sanchez Garcia 104)Ahmed Gana 105)Jose A. Garcia 106)Major Archie Gates 107)Bavolleni Gallilo 108)Musa Galadima 109)Shehu Galadima 110)Barr. Imam Galadima 111)Barr. Jerry Galadima 112)Mustapha Gambo 113)Dr. Isah Gambo 114)Usman Gambo 115)Engr. Isaac Garuba 116)Alhani Azeez Garuba 117)Engr. Sule Garuba 118)Idris Garuba 119)Mustaph Garuba 120) ADB Bank Ouagadougou Burkinafaso 121) FSA UK 122) NATWEST BANK 123) ECO Bank 124) Credit Bank 125)Barr Greg Thompson 126)Mercy Gloria I have contacted the Federal Bureau Of Investigation Located at 601 4th Street,NW Washington, D.C. 20535 in person of Mr. Joseph Persichini ( Assistant Director In Charge Of The FBI ),and i will make sure you are highly protected and also do all i can just to make sure whosoever is found guilty is prosecuted,because the LAW must stand by and JUSTICE must prevail. Do get in touch with me to conclude this final transaction immediately,and also send to me your convenient tel/fax numbers for easy communications,and please you must use these CODE (PRIVATE2009) when responding to me. Regards, Mr. Goodluck Jonathan.(GCFR,FRN). Vice President Fed. Rep. Of Nigeria. From smithfrederick_20078@yahoo.com.cn Sat Feb 14 03:43:48 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.8 required=5.0 tests=ADDR_NUMS_AT_BIGSITE, ADVANCE_FEE_1,ADVANCE_FEE_2,BAYES_99,BL_COUNTRY_TR_1,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM, JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,RCVD_IN_BL_SPAMCOP_NET,TO_CC_NONE, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TR_1 Mail client in Turkey * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADDR_NUMS_AT_BIGSITE Has an address with lots of numbers at a big * ISP * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from yaklasim.com (asy2.asy26.tellcom.com.tr [212.57.26.2] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1EBheN5000454 for ; Sat, 14 Feb 2009 03:43:47 -0800 Received: from User [193.120.116.182] by yaklasim.com with ESMTP (SMTPD32-8.04) id A2898D0088; Sat, 14 Feb 2009 04:55:05 +0200 Reply-To: From: "Smith Frederick" Subject: [SPAM] Smith Frederick Date: Sat, 14 Feb 2009 02:45:33 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200902140455843.SM00548@User> X-Greylist: Delayed for 01:41:49 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 14 Feb 2009 03:43:48 -0800 (PST) X-Spam-Prev-Subject: Smith Frederick Status: R X-Status: X-Keywords: X-UID: 113 Private and Personal Please Good day, I am a senior Auditor and Heading-computing department here in a leading bank in the United Kingdom, in my Bank I discovered an abandoned large sum of money 35Million pounds belonging to one of our late Foreign Customer, since 2000. The owner of this account is late Mr. Thomas Stockley, an American National, a businessman, who involved in air crash along with his family. You can confirm from the website below. http://www.cnn.com/2000/US/02/01/alaska.airlines.list/ No other person knows about this account. The Strategy is to use our influence as a senior Auditor and Heading-computing department to approve the funds to you. If you are interested, please get back to me on my private email address below: Email: smithfrederick_20078@yahoo.com.cn Yours faithfully Smith Frederick From info@infonegocio.com Sat Feb 14 10:36:30 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.4 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_CN_2,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,LOTTO_YOU_WON_03, L_SOME_STD_PROBS,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,SPF_PASS,SUBJ_ALL_CAPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [221.2.196.4 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout3.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1EIaOwX011413 for ; Sat, 14 Feb 2009 10:36:29 -0800 Received: from User (221.2.196.4) by ctsmtpout3.frontal.correo (7.2.056.6) (authenticated as topeflor@telefonica.net) id 49950437000E7BCC; Sat, 14 Feb 2009 19:32:37 +0100 Message-ID: <49950437000E7BCC@ctsmtpout3.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "John Miles" To: info@infonegocio.com Subject: [SPAM] MESSAGE FOR YOU. Date: Sat, 14 Feb 2009 19:32:30 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: MESSAGE FOR YOU. Status: R X-Status: X-Keywords: X-UID: 114 Hello Friend, We wish to notify you again that you were listed as a beneficiary to the total sum of (Twelve Million British Pounds) in the codicil and last testament of the deceased, Name now withheld since this is our second letter to you. All the legal papers will be processed in your name. On your acceptance of this deal, we request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at the probate registry for the claim. Please indicate your interest immediately via email for us to proceed. I shall feed you with full details on the procedure upon receipt of your reply towards this notice. Wishing you a happy New Year Yours faithfully, Mr. John Miles From deputygovernorcenbanknig200919@yahoo.co.jp Tue Feb 17 03:52:51 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_JP_1,BL_COUNTRY_NG_2,DEAR_SOMETHING, DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_40_50,HTML_MESSAGE, JM_SOUGHT_FRAUD_3,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SPF_PASS,SUBJ_ALL_CAPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.5 HTML_40_50 BODY: Message is 40% to 50% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from web2808.mail.bbt.yahoo.co.jp (web2808.mail.bbt.yahoo.co.jp [202.93.80.86]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1HBqlN8013990 for ; Tue, 17 Feb 2009 03:52:51 -0800 Received: (qmail 20907 invoked by uid 60001); 17 Feb 2009 11:24:43 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=yj20050223; d=yahoo.co.jp; h=Message-ID:Received:X-RocketDSI:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=qVLhPH28OIg1ZKYd1K2lB5XEgaNL+5cWQIjtdyy34QYZG89czYWqoG7VKOSz9S2L9bsvns6KwNatTiBHOX4NSyfFXGizw+DblZSGtP0q1wwk8CI7xTdVjkSLXRYW/kD7 ; Message-ID: <20090217112443.20905.qmail@web2808.mail.bbt.yahoo.co.jp> Received: from [62.173.48.184] by web2808.mail.bbt.yahoo.co.jp via HTTP; Tue, 17 Feb 2009 20:24:43 JST X-RocketDSI: i=202.93.80.86;s=w Date: Tue, 17 Feb 2009 20:24:43 +0900 (JST) From: Deputy Governor Central Bank of Nigeria Reply-To: deputygov_cenbank206@o2.pl Subject: [SPAM] CALL ME +234 7083 213633 FOR YOUR PAYMENT $10.5M IS READY To: jhardin@impsec.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-444278685-1234869883=:20728" X-Greylist: Delayed for 00:27:59 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 17 Feb 2009 03:52:51 -0800 (PST) X-Spam-Prev-Subject: CALL ME +234 7083 213633 FOR YOUR PAYMENT $10.5M IS READY Status: R X-Status: X-Keywords: X-UID: 115 Content-Length: 1476 --0-444278685-1234869883=:20728 Content-Type: text/plain; charset=iso-2022-jp $B?7$7$$%a!<%k%"%I%l%9$r$*CN$i$;$7$^$9?7$7$$%a!<%k%"%I%l%9!'(B deputygovernorcenbanknig200919@yahoo.co.jp DEAR SIR/MADAM,THIS IS TO INFORM YOU OFFICIALLY THAT WE HAVE VERIFIED YOUR CONTRACT/INHERITANCE FILE AND FOUND OUT THAT WHY YOU HAVE NOT RECEIVED YOUR FUND $10.5M, YOU WILL RECEIVE IT THRU ATM CARD, YOUR NAME, ADDRESS AND CELL/PHONE FOR IMMEDIATE ACTION.,DR TUNDE LEMO, - Deputy Governor Central Bank of Nigeria --0-444278685-1234869883=:20728 Content-Type: text/html; charset=iso-2022-jp
$B?7$7$$%a!<%k%"%I%l%9$r$*CN$i$;$7$^$9(B
$B?7$7$$%a!<%k%"%I%l%9!'(B deputygovernorcenbanknig200919@yahoo.co.jp

DEAR SIR/MADAM,THIS IS TO INFORM YOU OFFICIALLY THAT WE HAVE VERIFIED YOUR CONTRACT/INHERITANCE FILE AND FOUND OUT THAT WHY YOU HAVE NOT RECEIVED YOUR FUND $10.5M, YOU WILL RECEIVE IT THRU ATM CARD, YOUR NAME, ADDRESS AND CELL/PHONE FOR IMMEDIATE ACTION.,DR TUNDE LEMO,

- Deputy Governor Central Bank of Nigeria
--0-444278685-1234869883=:20728-- From barristertimhamilton54@gmail.com Tue Feb 17 13:37:40 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.7 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_80,DATE_IN_PAST_06_12,DNS_FROM_RFC_POST, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, L_SOME_STD_PROBS,MILLION_USD,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RCVD_BY_IP,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_PASS, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.0 RCVD_BY_IP Received by mail server with no name * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.8 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.9428] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from qb-out-0506.google.com (qb-out-0506.google.com [72.14.204.232]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1HLbaG6029731 for ; Tue, 17 Feb 2009 13:37:40 -0800 Received: by qb-out-0506.google.com with SMTP id f30so2487664qba.9 for ; Tue, 17 Feb 2009 13:37:35 -0800 (PST) MIME-Version: 1.0 Received: by 10.142.108.9 with HTTP; Tue, 17 Feb 2009 04:26:34 -0800 (PST) Reply-To: timhamiltonlaws@hotmail.com Date: Tue, 17 Feb 2009 13:26:34 +0100 Message-ID: <4feee54c0902170426p3423afa2hf2d5ef1f71b2155d@mail.gmail.com> Subject: [SPAM] Write back please. From: tim hamilton Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Delayed for 09:09:44 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 17 Feb 2009 13:37:40 -0800 (PST) X-Spam-Prev-Subject: Write back please. Status: R X-Status: X-Keywords: X-UID: 116 Content-Length: 1560 Hello, I write to seek your cooperation and assistance in this project. I am Mr.Tim Hamilton, A lawyer. I am the personal attorney to Mr. Neal Walker, An American, who was a businessman. On the 31st of Oct 1999, he lost his life in a plane crash. My client deposited as family belongings in the sum of $30 Million USD here in London with the hope of transferring it to his country as soon as his contract expires. Since his death I have made several enquiries to his embassy to locate any of his extended relatives, but this attempt so far has been unsuccessful. After these several unsuccessful attempts, I decided to look for a foreigner who will be willing to help claim this fund, hence I contacted you. The intention right now is for you to stand in as his Next of Kin to get this funds released to you. This becomes imperative as the bank has just given me a deadline to provide one, or the money will be declared dormant in accordance with the bank's policy. I will provide all legal documents to back up your claim as the beneficiary to this fund and your help will be appreciated with 30% of the total sum. All I require is your honest co-operation and I guarantee that this will be executed under a legitimate arrangement that will protect you from any breach of the law. Please accept my apologies, keep my confidence and disregard this email if you do not appreciate this proposition I have offered you. However, if you wish to help me actualize this, write me back so I will let you know what is required of you. Best Regards, Tim Hamilton. From Harry_Janta@un.org Tue Feb 17 20:27:49 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.9 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_FR_2,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_21,L_SOME_STD_PROBS,PHISH_05,SARE_FRAUD_X3,SPF_FAIL, UNDISC_RECIPS,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=harry_janta%40un.org&ip=80.12.242.30&receiver=ga.impsec.org] * 0.4 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp-out.orange.net (smtp59.orange.fr [80.12.242.30]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1I4RkHn007981 for ; Tue, 17 Feb 2009 20:27:49 -0800 Received: from smtp-out.orange.net (mwinf5904 [10.232.8.26]) by mwinf5905.orange.net (SMTP Server) with ESMTP id C17431C00906 for ; Wed, 18 Feb 2009 05:10:31 +0100 (CET) Received: from User (unknown [10.163.121.146]) by mwinf5904.orange.net (SMTP Server) with ESMTP id 078CD280008B; Wed, 18 Feb 2009 05:10:19 +0100 (CET) X-ME-UUID: 20090218041020310.078CD280008B@mwinf5904.orange.net Reply-To: From: "H. Jantamanta" Subject: [SPAM] From Harry & Partners Date: Wed, 18 Feb 2009 05:10:10 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090218041019.078CD280008B@mwinf5904.orange.net> To: undisclosed-recipients: ; X-Greylist: Delayed for 00:17:18 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 17 Feb 2009 20:27:49 -0800 (PST) X-Spam-Prev-Subject: From Harry & Partners Status: R X-Status: X-Keywords: X-UID: 117 Content-Length: 1303 From: Harry Jantamanta 3 Whitehall Court, London, SW1A 2EL London Private Mobile: 44 704 576 2068 My name is Harry Jantamanta, UN humanitarian abuse reporter here in UN Independent Station United Kingdom. I got your contact through cross border business information centre situated here in London as an online investor. On behalf of my partners, I seek your assistance to accommodate and invest for us the sum of USD22.6M. The money in question is sourced to us by a particular head of states as a gesture for appreciation of a good work rendered to their country, but In line with the moral principal of our services, we are not required to accept gift of any kind nor own more than 10,000 USD in our respective bank account, hence our plea to be represented by a trust worthy person to accommodate and invest the sum for us. Please note that this request is not a hoax. We count on your ability to accommodate and invest the funds for us until we are able to process our resignation successfully. If you are interested please provide me with the following in return email: YOUR NAME IN FULL YOUR OFFICE OR RESIDENTIAL ADDRESS TEL AND FAX NUMBER As soon as I hear from you, further details regarding the transaction will be unveiled to you. I look forward for your urgent response. From jj1965jjj9@msn.com Wed Feb 18 01:30:58 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************ X-Spam-Status: Yes, score=36.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_10_20,HTML_MESSAGE,HTML_STOOPID_02,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_56,MILLIONS_01,MILLION_USD, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_PASS,SUBJ_ALL_CAPS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.5 HTML_STOOPID_02 RAW: stupid HTML: empty STRONG tag * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from blu0-omc3-s15.blu0.hotmail.com (blu0-omc3-s15.blu0.hotmail.com [65.55.116.90]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1I9UtOK015449 for ; Wed, 18 Feb 2009 01:30:58 -0800 Received: from BLU132-W36 ([65.55.116.72]) by blu0-omc3-s15.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 18 Feb 2009 01:13:27 -0800 Message-ID: Content-Type: multipart/alternative; boundary="_ece8b270-0c8c-43c5-9c81-edbabbae245b_" X-Originating-IP: [41.211.227.174] Reply-To: From: Mrs Juliet Egwu Subject: [SPAM] MAY GOD BLESS AS YOU READ AND ACCEPT Date: Wed, 18 Feb 2009 09:13:27 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 18 Feb 2009 09:13:27.0804 (UTC) FILETIME=[28E003C0:01C991A9] X-Greylist: Delayed for 00:17:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 18 Feb 2009 01:30:58 -0800 (PST) X-Spam-Prev-Subject: MAY GOD BLESS AS YOU READ AND ACCEPT Status: R X-Status: X-Keywords: X-UID: 118 Content-Length: 7527 --_ece8b270-0c8c-43c5-9c81-edbabbae245b_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable >From Mrs. Juliet Egwu. Email =3D jj1965jjj@rediffmail.com=20 Email =3D jj1965jjj@sify.com =20 In Lordship. I am the above named person but now undergoing medical treatme= nt. I was married to Dr.Jim Egwu who worked with oil Firm Shell Petroleum N= igeria Plc in Nigeria for fifteen years=2C before he died in the year 2007.= We were both married for twenty-one years without a child. =20 He died after a brief illness that lasted for only four days. Before his de= ath. We were both very close as husband and wife and since his death I deci= ded not to re-marry. When my late husband was alive he deposited the sum of= USD10=2C 000=2C000.00 (Ten Million United States Dollars) with an Oceanic = Bank International Nig Plc=2C I will send you details as soon as you indica= te your Interest. =20 Recently=2C my Doctor told me that I would not last for the next Six months= due to my cancer illness. Having known my condition and believing the doct= or I have decided to donate this fund to avoid total loss to Less privilege= =2C or better still an individual that will utilize this money the way I am= going to Instruct here in. =20 I want interested firm=2C or individual that will receive and use this mone= y to help orphanages=2C widows and propagating the word of God and to ensur= e that the house of God is maintained. =20 Please do not fail to spread the funds across the globe especially AFRICA a= s soon as you receive the money. it is more blessed to give than to receive= . I took this decision because I don't have any child that will inherit thi= s money and my husband relatives are fighting over the properties and I don= 't want my husband's hard earned money to be misused by their greedy attitu= de. I don't want a situation where this money will be used in an UNGODLY manner= =2C hence the reason for taking this bold decision. I am not afraid of deat= h since I am a good person. =20 I shall hold my peace. I don't need any telephone communication in this reg= ard because of my health and because of the presence of my husband's relati= ves around me always. I don't want them to know about this development. Wit= h God all things are possible. As soon as I receive your reply=2C I shall g= ive you the contact information of the bank and other details that will ena= ble you claim the funds.please=2CI want you to be aware that according to m= y attorney there are some important document that will be required by the b= ank for the transfer this is where i will need your little assistance befor= e the fund can be transfer with the help of my attorney. =20 I will also issue you a letter of authority/Power of Attorney that will mak= e you the beneficiary of this fund. I want you to always pray for me becaus= e the lord is my shepherd. My happiness is that I lived a life of a worthy = Christian. Whoever that wants to serve the GOD must serve him in spirit and= truth. Please always be prayerful all through your life. =20 I sent you this mail under severe pains. Any delay in your reply will be de= trimental. Please assure me that you will act accordingly. Hoping to hear from you immediately. =20 Remain blessed in the name of the Lord. =20 Yours in Christ=2C =20 Mrs. Juliet Egwu. = --_ece8b270-0c8c-43c5-9c81-edbabbae245b_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
From Mrs. Juliet Egwu.
Email =3D =3B =3Bjj1965jjj@rediffmail.com =3B
Email =3D =3B =3Bjj1965jjj@sify.com
 =3B
In Lo= rdship. I am the above named person but now undergoing medical treatment. I= was married to Dr.Jim Egwu who worked with oil Firm Shell Petroleum Nigeri= a Plc in Nigeria for fifteen years=2C before he died in the year 2007. We w= ere both married for twenty-one years without a child.
 =3B
He di= ed after a brief illness that lasted for only four days. Before his death. = We were both very close as husband and wife and since his death I decided n= ot to re-marry. When my late husband was alive he deposited the sum of USD1= 0=2C 000=2C000.00 (Ten Million United States Dollars) with an Oceanic Bank = International Nig Plc=2C I will send you details as soon as you indicate yo= ur Interest.
 =3B
Recently=2C my Doctor told me that I would not = last for the next Six months due to my cancer illness. Having known my cond= ition and believing the doctor I have decided to donate this fund to avoid = total loss to Less privilege=2C or better still an individual that will uti= lize this money the way I am going to Instruct here in.
 =3B
I wa= nt interested firm=2C or individual that will receive and use this money to= help orphanages=2C widows and propagating the word of God and to ensure th= at the house of God is maintained.
 =3B
Please do not fail to spr= ead the funds across the globe especially AFRICA as soon as you receive the= money. it is more blessed to give than to receive. I took this decision be= cause I don't have any child that will inherit this money and my husband re= latives are fighting over the properties and I don't want my husband's hard= earned money to be misused by their greedy attitude.
I don't want a sit= uation where this money will be used in an UNGODLY manner=2C hence the reas= on for taking this bold decision. I am not afraid of death since I am a goo= d person.
 =3B
I shall hold my peace. I don't need any telephone = communication in this regard because of my health and because of the presen= ce of my husband's relatives around me always. I don't want them to know ab= out this development. With God all things are possible. As soon as I receiv= e your reply=2C I shall give you the contact information of the bank and ot= her details that will enable you claim the funds.please=2CI want you to be = aware that according to my attorney there are some important document that = will be required by the bank for the transfer this is where i will need you= r little assistance before the fund can be transfer with the help of my att= orney.
 =3B
I will also issue you a letter of authority/Power of = Attorney that will make you the beneficiary of this fund. I want you to alw= ays pray for me because the lord is my shepherd. My happiness is that I liv= ed a life of a worthy Christian. Whoever that wants to serve the GOD must s= erve him in spirit and truth. Please always be prayerful all through your l= ife.
 =3B
I sent you this mail under severe pains. Any delay in y= our reply will be detrimental. Please assure me that you will act according= ly.

Hoping to hear from you immediately.
 =3B
Remain blessed in the name of the Lord.
 =3B
Yours i= n Christ=2C
 =3B
Mrs. Juliet Egwu.
 =3B
= --_ece8b270-0c8c-43c5-9c81-edbabbae245b_-- From jporte@servycomm.com Thu Feb 19 03:07:35 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.2 required=5.0 tests=ADDR_NUMS_AT_BIGSITE, ADVANCE_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,BAYES_95,BL_COUNTRY_NG_2, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,J_CHICKENPOX_34,L_SOME_STD_PROBS, MILLION_USD,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RBL_POXLAY_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SPF_SOFTFAIL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=jporte%40servycomm.com&ip=207.99.40.126&receiver=ga.impsec.org] * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 1.8 MILLION_USD BODY: Talks about millions of dollars * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9730] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 95] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 95] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [207.99.40.126 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [207.99.40.126 listed in dnsbl.sorbs.net] * 1.4 ADDR_NUMS_AT_BIGSITE Has an address with lots of numbers at a big * ISP * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from pcplusltd.com (www.pcplusltd.com [207.99.40.126]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1JB7Uv5022950 for ; Thu, 19 Feb 2009 03:07:35 -0800 Received: from User [82.128.27.145] by pcplusltd.com with ESMTP (SMTPD32-8.10) id A087C17A00AA; Mon, 16 Feb 2009 23:43:51 -0500 Reply-To: From: "Mr. Gordon Adams" Subject: [SPAM] Beneficiary: Payment Verification. Date: Tue, 17 Feb 2009 05:42:55 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200902162345254.SM01808@User> X-Greylist: Delayed for 13:54:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 19 Feb 2009 03:07:35 -0800 (PST) X-Spam-Prev-Subject: Beneficiary: Payment Verification. Status: R X-Status: X-Keywords: X-UID: 119 Content-Length: 2114 Beneficiary, Payment Verification This is to acknowledge the receipt of Information received from the Nigeria Home Inheritance Department and Ministry of Internal Affair on the 18th of August, 2008.This was the result of inability to Claim your Funds, Ministry of Internal Affair mapped out $8.3Million USD As part payment for the Past Contract you had with the Nigerian Government in the years with respect to the Provision Section 17 of Decree 114 of the 1999 Constitution. I am directed to inform you that your Payment Verification and Confirmations is correct, therefore, we are happy to inform you that Arrangements has been concluded to effect your Payment as soon as possible. We hereby officially notifying you about the present arrangement to pay you, your over due contract/inheritance fund which you could not complete the process of the released of your transfer pin code through the Digitalized Payment System. We have decided to pay your funds without any requested fee but through (ATM International Debit Card) This arrangement was initiated/constituted by the World Bank and Paris Club, due to fraudulent activities going on within the African Region and in conjunction with the Present Administration of Alhaji Umaru Musa Yar'Adua, President and Commander-Chief of the Armed Forces of the Federal Republic of Nigeria in his Crusade Against Corruption in Nigeria with other African Leaders. Re-confirm your details as below to avoid diversion of your (ATM International Debit Card) 1) YOUR FULL NAME 2) YOUR RECEIVING ADDRESS. 3) YOUR TELEPHONE NUMBER 4) YOUR PROFESSION 5) YOUR NATIONALITY Upon the receipt of this mail we are going to load your funds into the ATM International Debit Card and you are required to provide to us your nominated home address so you absolutely have nothing to worry about all we need is your Prompt Response and Co-operation by Gods Grace we will have a successful Transaction. Congratulations in Advance. Best Regards. Contact Person: Dr.Gordon Adams. Director, Atm Operations Dept, Oceanic Bank of Nigeria Plc From john_ez15@msn.com Thu Feb 19 03:47:18 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FREEMAIL_FROM,FREEMAIL_REPLYTO,FROM_HAS_ULINE_NUMS,HTML_50_60, HTML_ATTR_UNIQUE,HTML_MESSAGE,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,MILLIONS_01,MILLION_USD,PHISH_05,SPF_PASS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.3 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 HTML_ATTR_UNIQUE BODY: HTML appears to have random attributes in * tags * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from blu0-omc4-s34.blu0.hotmail.com (blu0-omc4-s34.blu0.hotmail.com [65.55.111.173]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1JBlFva023880 for ; Thu, 19 Feb 2009 03:47:18 -0800 Received: from BLU116-W10 ([65.55.111.137]) by blu0-omc4-s34.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 19 Feb 2009 03:30:52 -0800 Message-ID: Content-Type: multipart/alternative; boundary="_ebbab439-dda2-4a18-acb3-82dfe0aa1821_" X-Originating-IP: [41.210.6.250] Reply-To: From: "Mr.John Ezra" Subject: [SPAM] Ghana Commercial Bank Ltd Date: Thu, 19 Feb 2009 11:30:52 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 19 Feb 2009 11:30:52.0541 (UTC) FILETIME=[8588CAD0:01C99285] X-Greylist: Delayed for 00:16:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 19 Feb 2009 03:47:18 -0800 (PST) X-Spam-Prev-Subject: Ghana Commercial Bank Ltd Status: R X-Status: X-Keywords: X-UID: 120 Content-Length: 5843 --_ebbab439-dda2-4a18-acb3-82dfe0aa1821_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable From: The Manager=2C=20 Ghana Commercial Bank Ltd. Accra=2C=20 Ghana. =20 Sir=2C=20 =20 I got your contact during my search for a reliable=2C=20 trust worthy and honest person to introduce this transfer project with. My = name=20 is Mr. John Ezra. I am the manager of the Ghana Commercial Bank Ghana=2C Br= anch=20 Accra. I am a Ghanaian married with one kids. =20 I am writing to solicit=20 your assistance in the noble transfer of US$5.500.000.00. This fund is the= =20 excess of what my branch in which I am the manager made as profit during th= e=20 last year. I have already submitted an approved End of the last Year report= for=20 the year 2006 to my Head Office here in Accra and they will never know of t= his=20 Excess. I have since then=2C placed this amount of US$5.500.000.00 (Five Mi= llion=20 Five hundred Thousand United States Dollars) on a SUSPENCE ACCOUNT without = a=20 beneficiary.=20 =20 As an officer of the bank=2C I cannot be directly connected=20 to this money thus I am impelled to request for your assistance to receive = this=20 money into your bank account. I intend to part 30% of this fund to you whil= e 70%=20 shall be for me. I do need to stress that there are practically no risk inv= olved=20 in this. It is going to be a bank-to-bank transfer to your nominated bank=20 account anywhere you feel safer. All I need from you is to stand as the ori= ginal=20 depositor of this fund.=20 =20 If you accept this offer=2C I will appreciate=20 your timely response.=20 =20 With regards=2C=20 =20 Mr. John=20 Ezra. Tel: +233 241 183 772=20 =20 CONTACT=20 E MAIL=3B mrjohnezra06@gmail.com= --_ebbab439-dda2-4a18-acb3-82dfe0aa1821_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
From: The Manager=2C
Ghana Commercial Bank Ltd.
Accra= =2C=20 Ghana.
 =3B
Sir=2C
 =3B
I got your contact during my s= earch for a reliable=2C=20 trust worthy and honest person to introduce this transfer project with. My = name=20 is Mr. John Ezra. I am the manager of the Ghana Commercial Bank Ghana=2C Br= anch=20 Accra. I am a Ghanaian married with one kids.
 =3B
I am writing t= o solicit=20 your assistance in the noble transfer of US$5.500.000.00. This fund is the= =20 excess of what my branch in which I am the manager made as profit during th= e=20 last year. I have already submitted an approved End of the last Year report= for=20 the year 2006 to my Head Office here in Accra and they will never know of t= his=20 Excess. I have since then=2C placed this amount of US$5.500.000.00 (Five Mi= llion=20 Five hundred Thousand United States Dollars) on a SUSPENCE ACCOUNT without = a=20 beneficiary.
 =3B
As an officer of the bank=2C I cannot be direc= tly connected=20 to this money thus I am impelled to request for your assistance to receive = this=20 money into your bank account. I intend to part 30% of this fund to you whil= e 70%=20 shall be for me. I do need to stress that there are practically no risk inv= olved=20 in this. It is going to be a bank-to-bank transfer to your nominated bank=20 account anywhere you feel safer. All I need from you is to stand as the ori= ginal=20 depositor of this fund.
 =3B
If you accept this offer=2C I will = appreciate=20 your timely response.
 =3B
With regards=2C
 =3B
Mr. J= ohn=20 Ezra.
Tel:=  =3B+233 =3B241 =3B183 =3B772 =3B=
 =3B
CONTACT=20 E MAIL=3B mrjohnezra06@gmail.= com
= --_ebbab439-dda2-4a18-acb3-82dfe0aa1821_-- From webexes@yahoo.com Thu Feb 19 08:26:45 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS, FORGED_RCVD_HELO,FORGED_YAHOO_RCVD,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_45,LOTTO_WINNINGS,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MILLIONS_01,RBL_PSBL_01,SPAMMY_WEBMAIL,UNDISC_RECIPS, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [200.40.210.179 listed in psbl.surriel.com] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.mtss.gub.uy (r200-40-210-179.static.adinet.com.uy [200.40.210.179]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1JGQe44031505 for ; Thu, 19 Feb 2009 08:26:45 -0800 Received: from mail.mtss.gub.uy (localhost [127.0.0.1]) by mail.mtss.gub.uy (Postfix) with ESMTP id 032975DCDB8; Wed, 18 Feb 2009 13:04:42 -0200 (UYST) Received: by mail.mtss.gub.uy (Postfix, from userid 1001) id 0FBEA5DCCE1; Wed, 18 Feb 2009 12:48:51 -0200 (UYST) Received: from mail.mtss.gub.uy (localhost [127.0.0.1]) by mail.mtss.gub.uy (Postfix) with ESMTP id 11C155DC5CB; Wed, 18 Feb 2009 12:08:03 -0200 (UYST) Received: from 81.202.12.78 (SquirrelMail authenticated user dinatra) by mail.mtss.gub.uy with HTTP; Wed, 18 Feb 2009 12:08:05 -0200 (UYST) Message-ID: <9afbeb4bf9b368a97080e0a5666cbf27.squirrel@mail.mtss.gub.uy> Date: Wed, 18 Feb 2009 12:08:05 -0200 (UYST) Subject: [SPAM] Your email hwon(webex US$750,000)(claim your prize) From: "Webex winners aknowledgement" Reply-To: webexwinners@aim.com User-Agent: SquirrelMail/1.4.15 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal To: undisclosed-recipients:; X-Virus-Scanned: Wed Feb 18 13:04:50 2009 -0200 (UYST) with ClamAV using ClamSMTP on celebrimbor.eregion.home X-Greylist: Delayed for 21:16:49 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 19 Feb 2009 08:26:45 -0800 (PST) X-Spam-Prev-Subject: Your email hwon(webex US$750,000)(claim your prize) Status: R X-Status: X-Keywords: X-UID: 121 Your email hwon(webex US$750,000)(claim your prize) WEBEX INCORPORATION INTERNATIONAL PROGRAM PRIZE. You email Won US$750,000.(Seven Hundred And Fifty Thousand United States Dollars Only).contact Information:- Full Name, Telephone/Mobile number, Occupation: Age: country. Winning Email:- *************************** MR.IVAN AMBROSIO Tell:+34-678 245 301 WEBEX INCORPORATION S.A Email:webexwinners@aim.com EMAIL:webexlin2009@gmail.com *********************************** NOTE: All winnings must be claimed not later than 14 days, thereafterunclaimed funds would be included in the next stake. Congratulations once more from our members of staff and thank you for being part of our promotional program. yours Faithfully, Mrs Alvaro Alejandro Lottery Coordinator. From franklinjones23432@yahoo.co.jp Fri Feb 20 08:00:23 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************* X-Spam-Status: Yes, score=49.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DEAR_FRIEND, DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLIONS_01,NA_DOLLARS,RAZOR2_CHECK, RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_SOFTFAIL,UNDISC_RECIPS, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=franklinjones23432%40yahoo.co.jp&ip=69.89.20.232&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.73 listed in dnsbl.sorbs.net] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.73 listed in zen.spamhaus.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from outbound-mail-17.bluehost.com (outbound-mail-17.bluehost.com [69.89.20.232]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1KG0I9a004532 for ; Fri, 20 Feb 2009 08:00:22 -0800 Received: (qmail 32319 invoked by uid 0); 20 Feb 2009 15:32:31 -0000 Received: from unknown (HELO box279.bluehost.com) (69.89.31.79) by outboundproxy1.bluehost.com with SMTP; 20 Feb 2009 15:32:31 -0000 Received: from localhost ([127.0.0.1]) by box279.bluehost.com with esmtpa (Exim 4.69) (envelope-from ) id 1LaXNP-0002JB-RP; Fri, 20 Feb 2009 08:33:19 -0700 Received: from 196.3.183.73 ([196.3.183.73]) by cra-z-art.com (Horde MIME library) with HTTP; Fri, 20 Feb 2009 08:33:17 -0700 Message-ID: <20090220083317.u1psefexccgsck8c@cra-z-art.com> Date: Fri, 20 Feb 2009 08:33:17 -0700 From: Franklin Jones Reply-to: franklinjones3@hotmail.com To: undisclosed-recipients:; Subject: [SPAM] Next Of Kin. MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.1.6) X-Identified-User: {1033:box279.bluehost.com:michelo7:cra-z-art.com} {sentby:smtp auth 127.0.0.1 authed with dkhakshoor@cra-z-art.com} X-Greylist: Delayed for 00:26:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 20 Feb 2009 08:00:22 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n1KG0I9a004532 X-Spam-Prev-Subject: Next Of Kin. Status: R X-Status: X-Keywords: X-UID: 122 Content-Length: 2314 Date: Friday February 20, 2009 Time: 11:30 am - 12:30 pm (GMT +00:00) Tel: +234 806 598 4431 Dear Friend, I am an accountant with ORIENT BANK PLC; my name is Mr. Franklin Jones a Banker. I am the Accounts Manager to ENGINEER George a National of your country, who is a contractor with the DEPARTMENT OF PETROLEUM RESOURCES VICTORIA ISLAND, LAGOS. On January 30, 2000 , my client, his wife, and three children were involved in the Kenya airways flight with registration number 5Y- BEN which departed from Nairobi to destination Lagos and they all family died in this fatal air crash On January 30,Since then I have made several inquiries to your embassy to locate any of my clients extended Relatives, this has also proved unsuccessful. After these several unsuccessful attempts, I decided to trace his last name over the Internet, to locate any member of his family hence I contacted you.I have contacted you to assist in repatriating the money and property left behind by my client before they get confiscated or declared unserviceable by the bank where these huge deposits were lodged, particularly the ORIENT BANK PLC. Where the deceased had an account Valued at($35 million U.S Dollars) has issued me a notice to provide the next of kin. Or have the account confiscated within the next ten official working days. Since I have been unsuccessful in locating the relatives for over 6 years now, I seek your consent to present you as the next of kin of the deceased since you have the same last name so that the proceeds of this account valued at ($35 million US Dollars) can be paid to you and then you and me Can share the money.45% to me and 45% to you and 5% for any charity organization in your country. While 5% for unforeseen bottlenecks we might incur in this transaction an attorney will be contracted to help us re-validate and notarize all the necessary legal documents that can be used to back up any claim we may make. All I require is your honest cooperation to enable us see this deal through.I guarantee that this will be executed under a legitimate arrangement that will protect you and me from any breach of the law. You can read more about the crash on visiting this site; http://www.cnn.com/2003/WORLD/africa/07/20/kenya.crash/index.html Best regards, Mr. Franklin Jones. From barrwm1@optonline.net Fri Feb 20 08:59:12 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********** X-Spam-Status: Yes, score=11.3 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, FORGED_RCVD_HELO,FREEMAIL_FORGED,HTML_00_10,HTML_MESSAGE,J_CHICKENPOX_31, J_CHICKENPOX_52,NO_REAL_NAME,RAZOR2_CHECK,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 0.8 HTML_00_10 BODY: Message is 0% to 10% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from mta4.srv.hcvlny.cv.net (mta4.srv.hcvlny.cv.net [167.206.4.199]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1KGx9bd006190 for ; Fri, 20 Feb 2009 08:59:12 -0800 Received: from optonline.net (mstr2a.srv.hcvlny.cv.net [10.240.4.136]) by mta4.srv.hcvlny.cv.net (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTP id <0KFD00AIBHS1T0A1@mta4.srv.hcvlny.cv.net> for jhardin@impsec.org; Fri, 20 Feb 2009 11:28:50 -0500 (EST) Received: from [10.240.3.199] (Forwarded-For: 203.158.167.152, [10.240.3.199]) by mstr2.srv.hcvlny.cv.net (mshttpd); Fri, 20 Feb 2009 16:28:49 +0000 (GMT) Date: Fri, 20 Feb 2009 16:28:49 +0000 (GMT) From: barrwm1@optonline.net Subject: [SPAM] From Mrs. Bashira Amir Bcc: Reply-to: mrsbashiraamir@hotmail.com Message-id: MIME-version: 1.0 X-Mailer: Sun Java(tm) System Messenger Express 6.2-8.04 (built Feb 28 2007) Content-type: multipart/alternative; boundary="Boundary_(ID_wyrDCpg8PALArLwYT/ammg)" Content-language: en X-Accept-Language: en Priority: normal X-Greylist: Delayed for 00:30:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 20 Feb 2009 08:59:12 -0800 (PST) X-Spam-Prev-Subject: From Mrs. Bashira Amir Status: R X-Status: X-Keywords: X-UID: 123 Content-Length: 2164 This is a multi-part message in MIME format. --Boundary_(ID_wyrDCpg8PALArLwYT/ammg) Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline Dear beloved one,I am the wife to Late Dr.Husain Amir who was a merchant in Dubai,in the U.A.E. for nine years.We were married for eight year with a son.My husband died in an auto crash in the 2007.I am left with ourseven year old son.Recently, my Doctor told me that from the entire test conducted on myhealth, I am not going to last long due to my cancer.When my late husband was alive he secured $5Million (Five MillionU.S.Dollars) with financial institution in European.Presently, thismoney is still with the financial institution.The fear i have now is that my husband relations are after my husbandproperty.They have sized most of his estates and business empire.All i want from you is for you to help me receive this funds, take careof my son as soon as i see your reply.I waits your prompt mail and responseThanks,Mrs. Bashira Amir --Boundary_(ID_wyrDCpg8PALArLwYT/ammg) Content-type: text/html; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline

Dear beloved one,

I am the wife to Late Dr.Husain Amir who was a merchant in Dubai,
in the U.A.E. for nine years.We were married for eight year with a son.
My husband died in an auto crash in the 2007.I am left with our
seven year old son.

Recently, my Doctor told me that from the entire test conducted on my
health, I am not going to last long due to my cancer.

When my late husband was alive he secured $5Million (Five Million
U.S.Dollars) with financial institution in European.Presently, this
money is still with the financial institution.

The fear i have now is that my husband relations are after my husband
property.They have sized most of his estates and business empire.

All i want from you is for you to help me receive this funds, take care
of my son as soon as i see your reply.

I waits your prompt mail and response

Thanks,
Mrs. Bashira Amir

--Boundary_(ID_wyrDCpg8PALArLwYT/ammg)-- From mary_jand@club-internet.fr Fri Feb 20 11:33:45 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=22.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_FR_2,DNS_FROM_RFC_ABUSE,FORGED_RCVD_HELO, HTML_MESSAGE,HTML_OBFU_03,J_CHICKENPOX_43,J_CHICKENPOX_84,MILLIONS_01, MIME_HTML_ONLY,NO_REAL_NAME,PHISH_05,SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_PASS, SUBJ_ALL_CAPS,UNPARSEABLE_RELAY,UPPERCASE_75_100,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 HTML_OBFU_03 RAW: HTML table row-spanning obfuscation * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from delay-cv.club-internet.fr (delay-cv.club-internet.fr [194.158.96.172]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1KJXfRt010857 for ; Fri, 20 Feb 2009 11:33:45 -0800 Received: from relay-ev.club-internet.fr (relay-ev.cs.clubint.net [172.16.0.103]) by delay-cv.club-internet.fr (Postfix) with ESMTP id BA5522F6724 for ; Fri, 20 Feb 2009 20:09:01 +0100 (CET) Received: from club-internet.fr (flashmail-12v.cs.clubint.net [172.16.0.155]) by relay-ev.club-internet.fr (Postfix) with SMTP id BC2D12560E; Fri, 20 Feb 2009 20:08:19 +0100 (CET) Received: from [196.201.94.34/172.16.1.158] by flashmail-12v.club-internet.fr via html interface From: mary_jand@club-internet.fr To: mary_jand@club-internet.fr Subject: [SPAM] FROM: MARY JAND. Date: Fri, 20 Feb 2009 20:08:19 +0100 Mime-Version: 1.0 X-Priority: 2 X-Mailer: Medianet/v2.0 Message-Id: Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Greylist: Delayed for 00:23:23 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 20 Feb 2009 11:33:45 -0800 (PST) X-Spam-Prev-Subject: FROM: MARY JAND. Status: R X-Status: X-Keywords: X-UID: 124 Content-Length: 2074 <=21DOCTYPE HTML PUBLIC =22-//W3C//DTD HTML 4.01 Transitional//EN=22> Flashmail

FROM: MARY JAND.
COUNTRY: ABIDJAN, IVORY COAST
 
 Hi DEAR,
I GOT YOUR CONTACT INFORMATION THROUGH THIS SITE AND I DECID= ED TO CONTACT YOU, HOPING THAT BY ALMIGHTY GOD GRACE  YOU WILL SUCCES= SFULLY ASSIST ME OUT FROM MY SITUATION, AFTER MY SEVEN GOOD DAYS PRAYERS A= ND FASTING OVER SEEKING FOR AN OVERSEES GUARDANCE .
 
I AM MARY= JAND (22 YEARS OLD) THE ONLY DAUGHTER OF LATE CHIEF JOSEPH JAND WHO WAS A= FAMOUS AND WEALTHY COCOA MERCHANT BASED IN ABIDJAN, COTE D'IVOIRE HERE,THE ECONOMIC CAPITAL OF IVORY COAST.
I AM SEEKING FOR YOUR URGENT= ATTENTION TO HELP ME TRANSFER THE SUM OF (US=246,500,000.00 ) SIX MILLION= FIVE HUNDRED THOUSAND UNITED STATE OF AMERICAN DOLLARS INTO YOUR NOMINATE= D BANK ACCOUNT OVERSEAS FOR AN INVESTMENTS PURPOSES,SUCH AS REAL ESTATES M= ANAGEMENTS AND STOCK MARKERTS.
 
PLEASE DEAR, I AM WILLING TO O= FFER YOU 20% OF THIS MY TOTAL FUND AS YOUR  COMMISSION FOR YOUR URGEN= T ASSISTANCE TO ME. KINDLY  MAIL ME IMMEDIATELY YOU RECEIVE THIS MY LETTER  FOR MORE IMPORTANT DETAILS CONCERNING THIS
MY MUTUAL T= RANSACTION.
 
NOTE: I HAVE ALL THE NECESSARY DOCUMENTS IN RELA= TION TO THIS MY FUND DEPOSITED BY MY LATE FATHER IN THE BANK HERE. PLEASE = QUICKLY 
AND KINDLY REPLY ME ON THIS MY PRIVATE
EMAIL ADDRESS= , mary=5Fjand=5F123= =40yahoo.co.jp FOR CONFIDENTIAL AND SECURITY REASONS SO THAT I CAN MAI= L YOU MY PHOTOS OK.
THANKS AND GOD BLESS.
 
YOURS SINCERELY= ,
MARY JAND.

 

From j.manuel@usyd.edu.au Fri Feb 20 14:32:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.1 required=5.0 tests=BAYES_80,DEAR_WINNER, HTML_30_40,HTML_MESSAGE,HTML_STOOPID_01,JM_SOUGHT_FRAUD_3,LOTTO_AGENT, LOTTO_MANY,LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_01,LOTTO_YOU_WON_02, RAZOR2_CHECK,SARE_SUB_WINNING_NOT,SPAMMY_HEADER_11,SPAMMY_HEADER_12, UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.2 SPAMMY_HEADER_12 Found a Content-Class header * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.3 SPAMMY_HEADER_11 Found a Thread-Index header * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 2.0 DEAR_WINNER BODY: DEAR_WINNER * 1.0 LOTTO_YOU_WON_01 BODY: You won! * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.9411] * 0.4 HTML_30_40 BODY: Message is 30% to 40% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 HTML_STOOPID_01 RAW: stupid HTML: empty FONT tag * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 0.7 SARE_SUB_WINNING_NOT Spammer subject - black market or scam Received: from kabul.ucc.usyd.edu.au (kabul.ucc.usyd.edu.au [129.78.220.1]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1KMW5a8015798 for ; Fri, 20 Feb 2009 14:32:08 -0800 Received: from kabul.ucc.usyd.edu.au (localhost [127.0.0.1]) by localhost (Postfix) with SMTP id 2A2515FDC0; Sat, 21 Feb 2009 09:16:43 +1100 (EST) Received: from MAIL3.mcs.usyd.edu.au (pioneer.mcs.usyd.edu.au [172.17.185.19]) by kabul.ucc.usyd.edu.au (Postfix) with ESMTP id CABB56003A; Sat, 21 Feb 2009 09:14:54 +1100 (EST) Received: from MAIL.mcs.usyd.edu.au ([172.17.185.71]) by MAIL3.mcs.usyd.edu.au with Microsoft SMTPSVC(6.0.3790.3959); Sat, 21 Feb 2009 09:14:54 +1100 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C993A8.A7B2302B" Subject: [SPAM] Winning Notification Date: Sat, 21 Feb 2009 09:14:53 +1100 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Winning Notification Thread-Index: AcmTqKdxZ1uL99ZKT6ClOxdkAF6UDA== From: "Jackie Manuel" X-OriginalArrivalTime: 20 Feb 2009 22:14:54.0409 (UTC) FILETIME=[A84BAB90:01C993A8] To: undisclosed-recipients:; X-Greylist: Delayed for 00:15:13 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 20 Feb 2009 14:32:09 -0800 (PST) X-Spam-Prev-Subject: Winning Notification Status: R X-Status: X-Keywords: X-UID: 125 Content-Length: 2086 This is a multi-part message in MIME format. ------_=_NextPart_001_01C993A8.A7B2302B Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 Dear Winner, Winning Notification This is to notify you that your email address has won =A31,000,000.00 in the Nokia National Online Email Lottery held on 18th of February,2009 in = Uk, e-mail addresses were picked randomly by computerised balloting powered by the Internet. Your email address was amongst those chosen for this period. Ticket no:1100016231 Serial No:5017708 Winning number:{5-14-8-38-2} Draw (#1057) To claim your prize, please contact: Fiduciary Agent Mr Michael John.=20 Email:nokia.customercarecentre@live.co.uk Tel: +44 752 9531 323 Sincerely, Dr Mrs.Lauren Manuel. Pls send reply to nokia.customercarecentre@live.co.uk Only ------_=_NextPart_001_01C993A8.A7B2302B Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =0A= =0A= =0A= =0A=
 
=0A=
Dear Winner,
Winning Notification
=0A=
This is to notify you that your email address has won = =A31,000,000.00 in
the Nokia National Online Email Lottery held on = 18th of February,2009 in Uk,
e-mail addresses were picked randomly by = computerised balloting
powered by the Internet. Your email address = was amongst
those chosen for this period.
Ticket = no:1100016231
Serial No:5017708 Winning number:{5-14-8-38-2}
Draw = (#1057)
To claim your prize, please contact:
Fiduciary Agent Mr = Michael John.
Email:nokia.customercarecentre@live.co.uk
Tel: +44 = 752 9531 323
=0A=
Sincerely,
Dr Mrs.Lauren Manuel.
Pls send reply to nokia.customercarecen= tre@live.co.uk Only
------_=_NextPart_001_01C993A8.A7B2302B-- From j.manuel@usyd.edu.au Sat Feb 21 05:15:19 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.1 required=5.0 tests=ADVANCE_FEE_1,BAYES_80, DEAR_WINNER,HTML_30_40,HTML_MESSAGE,HTML_STOOPID_01,JM_SOUGHT_FRAUD_3, LOTTO_AGENT,LOTTO_MANY,LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_01, LOTTO_YOU_WON_02,RAZOR2_CHECK,SARE_SUB_WINNING_NOT,SPAMMY_HEADER_11, SPAMMY_HEADER_12,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.2 SPAMMY_HEADER_12 Found a Content-Class header * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.3 SPAMMY_HEADER_11 Found a Thread-Index header * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 2.0 DEAR_WINNER BODY: DEAR_WINNER * 1.0 LOTTO_YOU_WON_01 BODY: You won! * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.9410] * 0.4 HTML_30_40 BODY: Message is 30% to 40% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 HTML_STOOPID_01 RAW: stupid HTML: empty FONT tag * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 0.7 SARE_SUB_WINNING_NOT Spammer subject - black market or scam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from baghdad.ucc.usyd.edu.au (baghdad.ucc.usyd.edu.au [129.78.64.146]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1LDFEnG007264 for ; Sat, 21 Feb 2009 05:15:18 -0800 Received: from baghdad.ucc.usyd.edu.au (localhost [127.0.0.1]) by localhost (Postfix) with SMTP id 327E510469B; Sat, 21 Feb 2009 23:39:43 +1100 (EST) Received: from MAIL3.mcs.usyd.edu.au (pioneer.mcs.usyd.edu.au [172.17.185.19]) by baghdad.ucc.usyd.edu.au (Postfix) with ESMTP id A2784103DB8; Sat, 21 Feb 2009 23:31:15 +1100 (EST) Received: from MAIL.mcs.usyd.edu.au ([172.17.185.71]) by MAIL3.mcs.usyd.edu.au with Microsoft SMTPSVC(6.0.3790.3959); Sat, 21 Feb 2009 23:31:14 +1100 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C99420.47350D7C" Subject: [SPAM] Winning Notification Date: Sat, 21 Feb 2009 23:31:11 +1100 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Winning Notification Thread-Index: AcmUIEaG5Kyy5F99RYexSQwX8J3OSQ== From: "Jackie Manuel" X-OriginalArrivalTime: 21 Feb 2009 12:31:14.0702 (UTC) FILETIME=[495632E0:01C99420] To: undisclosed-recipients:; X-Greylist: Delayed for 00:34:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 21 Feb 2009 05:15:18 -0800 (PST) X-Spam-Prev-Subject: Winning Notification Status: R X-Status: X-Keywords: X-UID: 126 Content-Length: 2071 This is a multi-part message in MIME format. ------_=_NextPart_001_01C99420.47350D7C Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 Dear Winner, Winning Notification This is to notify you that your email address has won =A31,000,000.00 in the Nokia National Online Email Lottery held on 21st of February,2009 in = Uk, e-mail addresses were picked randomly by computerised balloting powered by the Internet. Your email address was amongst those chosen for this period. Ticket no:1100016231 Serial No:5017708 Winning number:{5-14-8-38-2} Draw (#1057) To claim your prize, please contact: Fiduciary Agent Mr Michael John.=20 Email:nokiacustomercareserv@live.co.uk Tel: +44 752 9531 323 Sincerely, Dr Mrs.Lauren Manuel. Pls send reply to nokiacustomercareserv@live.co.uk Only ------_=_NextPart_001_01C99420.47350D7C Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =0A= =0A= =0A= =0A=
 
=0A=
Dear Winner,
Winning Notification
=0A=
This is to notify you that your email address has won = =A31,000,000.00 in
the Nokia National Online Email Lottery held on = 21st of February,2009 in Uk,
e-mail addresses were picked randomly by = computerised balloting
powered by the Internet. Your email address = was amongst
those chosen for this period.
Ticket = no:1100016231
Serial No:5017708 Winning number:{5-14-8-38-2}
Draw = (#1057)
To claim your prize, please contact:
Fiduciary Agent Mr = Michael John.
Email:nokiacustomercareserv@live.co.uk
Tel: +44 752 = 9531 323
=0A=
Sincerely,
Dr Mrs.Lauren Manuel.
Pls send reply to nokiacustomercareserv@li= ve.co.uk Only
------_=_NextPart_001_01C99420.47350D7C-- From honourableministeroffinanceng@gmail.com Sat Feb 21 20:00:23 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,BL_COUNTRY_BR_1,DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO, J_CHICKENPOX_36,J_CHICKENPOX_44,J_CHICKENPOX_65,J_CHICKENPOX_71, J_CHICKENPOX_73,MILLION_USD,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SARE_FRAUD_X3,SPAMMY_WEBMAIL,SPF_NEUTRAL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=honourableministeroffinanceng%40gmail.com&ip=201.28.33.70&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 1.8 MILLION_USD BODY: Talks about millions of dollars * 0.6 J_CHICKENPOX_36 BODY: 3alpha-pock-6alpha * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from mailserver.apcd.org.br (mailserver.apcd.org.br [201.28.33.70]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1M40IhV030646 for ; Sat, 21 Feb 2009 20:00:22 -0800 Received: (qmail 12092 invoked from network); 16 Feb 2009 15:35:17 -0000 Received: from unknown (HELO mailserver.apcd.org.br) (127.0.0.1) by localhost with SMTP; 16 Feb 2009 15:35:17 -0000 Received: from 80.89.177.6 (SquirrelMail authenticated user apcd@apcd.org.br); by mailserver.apcd.org.br with HTTP; Mon, 16 Feb 2009 16:35:17 +0100 (CET) Message-ID: <4978.80.89.177.6.1234798517.squirrel@80.89.177.6> Date: Mon, 16 Feb 2009 16:35:17 +0100 (CET) Subject: [SPAM] From Office Of Dr Mansur Muhtar(F.M.F) / Your Response Is Needed. From: "Dr Mansur Muhtar" Reply-To: mansurmuhtar.fmf.ng@gmail.com User-Agent: SquirrelMail/1.4.3a X-Mailer: SquirrelMail/1.4.3a MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Greylist: Delayed for 93:20:17 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 21 Feb 2009 20:00:23 -0800 (PST) X-Spam-Prev-Subject: From Office Of Dr Mansur Muhtar(F.M.F) / Your Response Is Needed. Status: R X-Status: X-Keywords: X-UID: 127 Content-Length: 1924 FEDERAL MINISTRY OF FINANCE. P.M.B. 14, Garki, Abuja. Official E-mail: mansurmuhtar.fmf.ng@gmail.com Attn:- Beneficiary, Dated This Day: 16th of February,2009. I, Dr Mansur Muhtar,Newly Elected Minister Of Finance Fed. Rep. Of Nigeria do like to inform you that your approved fund valued USD$10.5 Million has now gain interest of USD$5Million making the total of USD$15.5 Million,you are advise to respond immediately for the processing and immediate release of your fund,Your name was on our payment FILE marked "X" and it was discovered that you have not been paid in all your attempt to receive these fund by the past administration of the former President .Olusegun Obasanjo Aremu. You are lucky because you file has been recognised and your payment was approved yesterday by the President,Meanwhile you must stop whatsoever contact you have with those "IMPOSTER" and make sure you forward their emails to me immediately. In the last six month eighty two beneficiaries were paid and it remains Forty eighty (48) Foreign Beneficiaries that will receive their fund,most beneficiaries are from USA,CANADA,AUTRALIA,GERMANY AND JAPAN. Failure to respond immediately,means that there is no way on EARTH you will be able to receive these fund anymore.These is your permanent CODE:2009/USD$15.5MILLION/CONFIRM.You are advise to use it as subject when reponding to my email for urgent attention to be given to you. Kindly Provide the following details for immediate actions to be carried out: 1:Your full names: 2:Your present address: 3:Your age and sex: 4:Your occupation: 5:Your Tel/fax: 6:Scanned copy of your I.D: As soon as i re-confirm your present details,i will prepare a letter of release on your behalf and forward it to the payment bank that will carry out the transfer of your fund directly to you. Regards. Hon. Dr Mansur Muhtar. The Honourable Minister of Finance, Federal Republic of Nigeria. From marywilson200848@yahoo.fr Mon Feb 23 03:28:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************************** X-Spam-Status: Yes, score=41.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,NO_REAL_NAME,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SUB_HELLO,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from citweb1.CIT.LLC (mail.lakequip.com [70.103.229.194] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1NBPod4016059 for ; Mon, 23 Feb 2009 03:26:21 -0800 Message-Id: <200902231126.n1NBPod4016059@ga.impsec.org> Received: from adsl-41.207.213.189.aviso.ci [41.207.213.189] by citweb1.CIT.LLC with SMTP; Mon, 23 Feb 2009 03:50:39 -0700 Reply-To: From: "Wilson" Subject: [SPAM] Hello This IS Mary Wilson Date: Mon, 23 Feb 2009 10:50:29 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 090221-0, 21/02/2009), Outbound message X-Antivirus-Status: Clean X-Greylist: Delayed for 00:33:41 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 23 Feb 2009 03:26:29 -0800 (PST) X-Spam-Prev-Subject: Hello This IS Mary Wilson Status: R X-Status: X-Keywords: X-UID: 128 Content-Length: 3861 Hello This IS Mary Wilson Please contact me through the email address below marywilson2008@live.com Dearest Beloved In The Lord After going through your profile I decided to contact you for friendship and assistance and distribution of my inheritances have to say that I have no intentions of causing you any Pains so I decided to contact you through this medium. I got your Contact through a personal search via the internet. As you read this, I don't want you to feel sorry for me, because, I Believe everyone will die someday but the most important thing here is that I am dying in the Lord. My name is Mrs.Mary Wilson I am a dying woman who have decided to donate What I have to you/ church/charity Organizations. I am 54 years old and I was diagnosed with oesophageal Cancer for about 7 Years ago and now I cannot hear and speak anymore, I am married to Sir Gerald Wilson Owen who worked with British Judicial Commission in Chelsea England for over a decade before he died on 5th of July in the year 1989. We were married for fifteen years without a child and he has left me everything he worked for. I have not particularly lived my life so well, as I never really cared For anyone. Though I am very rich, I was never generous, I was always hostile to people and only focus on my self as that was the only thing I Cared for. But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world. I believe when God gives me a second chance to come to this world I would live my life a different way from how I have lived it. Now that I know My time is near I have been touched by God to donate from what I have Inherited from my late husband for the good work of God, rather than Allow my relatives to use my husband hard earned funds ungodly. Now that my health has deteriorated so badly, I cannot do this my self any more. I once asked members of my family to Close one of my accounts and donate the money, which I have there to Charity organization in Bulgaria; they refused and kept the money to themselves. Hence, I do not trust them anymore, as they seem not to be contended With what I have left for them. The last of my money which is the huge Cash deposit of $8,000,000.00 Eight Million United States Dollars that I have with Financial Firm in Abidjan Cote D Ivoire .I will want you to Help me collect this deposit and dispatched it to charity organizations And let them know that it is me Mary Wilson that is making this Generous donation. I am writing this from my laptop computer in my hospital bed where I wait for my time to come. I pray that God uses you to support and assist me with good heart Please pray that the good Lord forgives me my sins. I have asked God to Forgive me and I believe he has because He is a merciful God. I will be going in for an operation in less than few days. I decided to WILL/donate the money to you for the good work of the lord, And also to help the motherless and less privilege and also for the Assistance of the widows according to (JAMES 1:27). I took this decision because I do not have any child that will inherit this money and my husband relatives are not inclined to helping poor Persons and I do not want my husband's hard earned money to be misused Or spent in the manner in which my late husband did not specify. At the moment I cannot take any telephone calls right now due to the Fact that I cannot talk or hear anymore. I wish you All the best and May the good Lord bless you abundantly, and please use The funds well and always extend the good work to others. NB: I will appreciate your utmost confidentiality in this matter until the task is accomplished as I don't want anything that will jeopardize my last wish.. Regards, Mary Wilson Mrs. Please contact me through the email address below marywilson2008@live.com From marywilson200848@yahoo.fr Mon Feb 23 03:59:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************************** X-Spam-Status: Yes, score=44.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS, MILLIONS_01,MILLION_USD,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,NO_REAL_NAME, RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SUB_HELLO,TO_CC_NONE, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [70.103.229.194 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from citweb1.CIT.LLC (smtp.h2oinmotion.com [70.103.229.194] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1NBx4KQ016507 for ; Mon, 23 Feb 2009 03:59:09 -0800 Message-Id: <200902231159.n1NBx4KQ016507@ga.impsec.org> Received: from adsl-41.207.213.189.aviso.ci [41.207.213.189] by citweb1.CIT.LLC with SMTP; Mon, 23 Feb 2009 03:50:39 -0700 Reply-To: From: "Wilson" Subject: [SPAM] Hello This IS Mary Wilson Date: Mon, 23 Feb 2009 10:50:29 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 090221-0, 21/02/2009), Outbound message X-Antivirus-Status: Clean X-Spam-Prev-Subject: Hello This IS Mary Wilson Status: R X-Status: X-Keywords: X-UID: 129 Content-Length: 3861 Hello This IS Mary Wilson Please contact me through the email address below marywilson2008@live.com Dearest Beloved In The Lord After going through your profile I decided to contact you for friendship and assistance and distribution of my inheritances have to say that I have no intentions of causing you any Pains so I decided to contact you through this medium. I got your Contact through a personal search via the internet. As you read this, I don't want you to feel sorry for me, because, I Believe everyone will die someday but the most important thing here is that I am dying in the Lord. My name is Mrs.Mary Wilson I am a dying woman who have decided to donate What I have to you/ church/charity Organizations. I am 54 years old and I was diagnosed with oesophageal Cancer for about 7 Years ago and now I cannot hear and speak anymore, I am married to Sir Gerald Wilson Owen who worked with British Judicial Commission in Chelsea England for over a decade before he died on 5th of July in the year 1989. We were married for fifteen years without a child and he has left me everything he worked for. I have not particularly lived my life so well, as I never really cared For anyone. Though I am very rich, I was never generous, I was always hostile to people and only focus on my self as that was the only thing I Cared for. But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world. I believe when God gives me a second chance to come to this world I would live my life a different way from how I have lived it. Now that I know My time is near I have been touched by God to donate from what I have Inherited from my late husband for the good work of God, rather than Allow my relatives to use my husband hard earned funds ungodly. Now that my health has deteriorated so badly, I cannot do this my self any more. I once asked members of my family to Close one of my accounts and donate the money, which I have there to Charity organization in Bulgaria; they refused and kept the money to themselves. Hence, I do not trust them anymore, as they seem not to be contended With what I have left for them. The last of my money which is the huge Cash deposit of $8,000,000.00 Eight Million United States Dollars that I have with Financial Firm in Abidjan Cote D Ivoire .I will want you to Help me collect this deposit and dispatched it to charity organizations And let them know that it is me Mary Wilson that is making this Generous donation. I am writing this from my laptop computer in my hospital bed where I wait for my time to come. I pray that God uses you to support and assist me with good heart Please pray that the good Lord forgives me my sins. I have asked God to Forgive me and I believe he has because He is a merciful God. I will be going in for an operation in less than few days. I decided to WILL/donate the money to you for the good work of the lord, And also to help the motherless and less privilege and also for the Assistance of the widows according to (JAMES 1:27). I took this decision because I do not have any child that will inherit this money and my husband relatives are not inclined to helping poor Persons and I do not want my husband's hard earned money to be misused Or spent in the manner in which my late husband did not specify. At the moment I cannot take any telephone calls right now due to the Fact that I cannot talk or hear anymore. I wish you All the best and May the good Lord bless you abundantly, and please use The funds well and always extend the good work to others. NB: I will appreciate your utmost confidentiality in this matter until the task is accomplished as I don't want anything that will jeopardize my last wish.. Regards, Mary Wilson Mrs. Please contact me through the email address below marywilson2008@live.com From calendar-invite@reply.yahoo.com Mon Feb 23 07:40:05 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.3 required=5.0 tests=BAYES_80,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_WHOIS,FILL_THIS_FORM_01,FORGED_YAHOO_RCVD,FREEMAIL_FROM, HTML_EMBED_IMG_03,HTML_EMBED_IMG_04,HTML_MESSAGE,JM_SOUGHT_FRAUD_3, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.8 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.9104] * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.1 HTML_EMBED_IMG_03 RAW: Contains embedded images * 0.2 HTML_EMBED_IMG_04 RAW: Contains embedded images * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [69.147.64.251 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay Received: from n21b.bullet.sp1.yahoo.com (n21b.bullet.sp1.yahoo.com [69.147.64.251]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1NFdwdj022512 for ; Mon, 23 Feb 2009 07:40:05 -0800 Message-Id: <200902231540.n1NFdwdj022512@ga.impsec.org> Received: from [216.252.122.219] by n21.bullet.sp1.yahoo.com with NNFMP; 23 Feb 2009 15:39:57 -0000 Received: from [68.142.194.244] by t4.bullet.sp1.yahoo.com with NNFMP; 23 Feb 2009 15:39:57 -0000 Received: from [209.191.93.245] by t2.bullet.mud.yahoo.com with NNFMP; 23 Feb 2009 15:39:57 -0000 Date: 23 Feb 2009 07:39:57 -0800 Received: from [127.0.0.1] by web122.cal.pim.mud.yahoo.com with NNFMP; 23 Feb 2009 15:39:57 -0000 x-yahoo-newman-errors: calendar-invite.obqxk3dpmruwy2jsgmrww2jngezdgnjugaztkojxfvygc5lmn5sgs3djgizsg23jhiyto-jhardin=impsec.org@returns.bulk.yahoo.com MIME-Version: 1.0 Reply-to: paulodili23@yahoo.com Errors-To: paulodili23@yahoo.com From: Paul Odili To: jhardin@impsec.org Subject: [SPAM] contact my secretary X-Yahoo-Newman-Property: calendar-invite X-Yahoo-Newman-Id: paulodili23#ki-1235403597-paulodili23#ki:17 X-Yahoo-Calendar-Iid: 8hE1%40r3dn23h%40A20MhDEuBd%40buqs%40L8X Content-Type: multipart/alternative; boundary="YCalInvites=NcwpIUFqjXyIhwcSfXGNR1235403581-1" X-Spam-Prev-Subject: contact my secretary Status: R X-Status: X-Keywords: X-UID: 130 Content-Length: 6737 --YCalInvites=NcwpIUFqjXyIhwcSfXGNR1235403581-1 Content-type: text/plain; charset=windows-1252; You are invited to " contact my secretary". By your host Paul Odili: Date: Monday February 23, 2009 Time: 2:00 pm - 3:00 pm (GMT +00:00) Location: Attnear Friend, It is my pleasure to let you know about my success in getting those fund transffered under the cooperation of a new partner from paraguay. I didn't forget your past efforts to assit me in transffering those funds. Now contact my secretary Mr. GOODLOUK ANI. his (Email is (goodlouk_ani@live.fr) ask him to send you the total 3.5musd cheque which i raised for your compensation . so feel free and get intouched with him and give him your address where to send the cheque: (Email is (goodlouk_ani@live.fr ) (1) FULL NAME ................. (2) ADDRESS ................... (3) COUNTRY .................. (4) PRIVATE TEL ............. (5) PRIVATE FAX ........... (6)A COPY OF YOUR PICTURE...... (7) PROFESSION,............... (8) AGE AND MARITAL STATUS..... Do Let me know immediately you receive it okay so feel free to get intouch with him. Best regards, BARRISTER.PAUL ODILI Will you attend? RSVP to this invitation at: http://calendar.yahoo.com/paulodili23?v=126&a1=0&iid=8hE1%40r3dn23h%40A20MhDEuBd%40buqs%40L8X&igid=bxa96rh%40kN%403aEc4FxcHEHt%40fuesANwOvpC6Yx%40%40 Copyright 2009 All Rights Reserved www.yahoo.com Privacy Policy: http://privacy.yahoo.com/privacy/us Terms of Service: http://docs.yahoo.com/info/terms/ --YCalInvites=NcwpIUFqjXyIhwcSfXGNR1235403581-1 Content-type: text/html; charset=windows-1252;
You're invited to:   contact my secretary
By your host:   Paul Odili
 
Date:   Monday February 23, 2009
Time:   2:00 pm - 3:00 pm  (GMT +00:00)
Location:   Attnear Friend, It is my pleasure to let you know about my success in getting those fund transffered under the cooperation of a new partner from paraguay. I didn't forget your past efforts to assit me in transffering those funds. Now contact my secretary Mr. GOODLOUK ANI. his (Email is (goodlouk_ani@live.fr) ask him to send you the total 3.5musd cheque which i raised for your compensation . so feel free and get intouched with him and give him your address where to send the cheque: (Email is (goodlouk_ani@live.fr ) (1) FULL NAME ................. (2) ADDRESS ................... (3) COUNTRY .................. (4) PRIVATE TEL ............. (5) PRIVATE FAX ........... (6)A COPY OF YOUR PICTURE...... (7) PROFESSION,............... (8) AGE AND MARITAL STATUS..... Do Let me know immediately you receive it okay so feel free to get intouch with him. Best regards, BARRISTER.PAUL ODILI
 
Will you attend?   RSVP to this invitation
Copyright 2009  Yahoo! Inc. All Rights Reserved | Terms of Service | Privacy Policy
--YCalInvites=NcwpIUFqjXyIhwcSfXGNR1235403581-1-- From peterlee@live.com Tue Feb 24 05:35:47 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,PHISH_05,SPAMMY_WEBMAIL,SPF_SOFTFAIL,THOUS_EMAIL_ADDRS, TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=peterlee%40live.com&ip=66.147.249.3&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.2 PHISH_05 BODY: Phishing for account information * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from outbound-mail-342.bluehost.com (outbound-mail-342.bluehost.com [66.147.249.3]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1ODZgB7025564 for ; Tue, 24 Feb 2009 05:35:47 -0800 Received: (qmail 28801 invoked by uid 0); 24 Feb 2009 13:05:10 -0000 Received: from unknown (HELO box557.bluehost.com) (66.147.242.157) by outboundproxy7.bluehost.com.bluehost.com with SMTP; 24 Feb 2009 13:05:10 -0000 Received: from localhost ([127.0.0.1] helo=box557.bluehost.com) by box557.bluehost.com with esmtpa (Exim 4.69) (envelope-from ) id 1Lbx1x-000580-Ef; Tue, 24 Feb 2009 06:09:01 -0700 Received: from 87.210.94.50 ([87.210.94.50]) (SquirrelMail authenticated user suning2009@madigo.net) by box557.bluehost.com with HTTP; Tue, 24 Feb 2009 06:09:01 -0700 (MST) Message-ID: <52239.87.210.94.50.1235480941.squirrel@box557.bluehost.com> Date: Tue, 24 Feb 2009 06:09:01 -0700 (MST) Subject: [SPAM] Business proposals From: "Mr.Pt. Lee" Reply-To: petertcleemail@yahoo.com.hk User-Agent: SquirrelMail/1.4.13 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Identified-User: {1545:box557.bluehost.com:madigone:madigo.net} {sentby:program running on server} X-Greylist: Delayed for 00:26:41 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 24 Feb 2009 05:35:47 -0800 (PST) X-Spam-Prev-Subject: Business proposals Status: R X-Status: X-Keywords: X-UID: 131 Content-Length: 1642 good day my friend It is understandable that you might be a little bit apprehensive because you do not know me but I have a lucrative business proposal of mutual interest to share with you. I got your reference in my search for someone who suits my proposed business relationship. I am Mr. Peter. Lee a South Korean, happily married with children, and i am a Director of Hang Seng Bank Ltd, in charge of the International Remittance department. I have a confidential business suggestion for you. I will need you to assist me in executing a business project from Hong Kong to your country. It involves the transfer of a large sum of money. Everything concerning this transaction shall be legally done without hitch. Please endeavour to observe utmost discretion in all matters concerning this issue. Once the funds have been successfully transferred into your account, we shall share in the ratio to be agreed by both of us. I will prefer you reach me on my private email address below (petertcleemail@yahoo.com.hk) and finally after that I shall furnish you with more information's about this operation. Should you be interested, please forward the following to me urgently: 1. Full names 2. Occupation 3. Private phone number 4. Current contact address Please if you are not interested delete this email and do not hunt me because I am putting my career and the life of my family at stake with this venture. Although nothing ventured is nothing gained. Your earliest response to this letter will be appreciated. Kind Regards, Mr.Pt. Lee Hang Seng Bank Limited Hong Kong. {Asia} Tel/Fax:-852-3017 6607 Email:petertcleemail@yahoo.com.hk From ack@telefonica.net Tue Feb 24 09:51:03 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_95,DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FORGED,J_CHICKENPOX_56,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_PASS,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * -0.0 SPF_PASS SPF: sender matches SPF record * 0.4 URG_BIZ BODY: Contains urgent matter * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9716] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.207.194.146 listed in dnsbl.sorbs.net] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout2.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1OHot1I032664 for ; Tue, 24 Feb 2009 09:51:02 -0800 Received: from User (196.207.194.146) by ctsmtpout2.frontal.correo (7.2.056.6) (authenticated as burutra2@infonegocio.com) id 49A3F1350002F073; Tue, 24 Feb 2009 18:48:16 +0100 Message-ID: <49A3F1350002F073@ctsmtpout2.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "SNS BANK NV" To: rnld.mor@snsbank.nl Subject: [SPAM] Regarding payment to you Date: Tue, 24 Feb 2009 09:48:12 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: Regarding payment to you Status: R X-Status: X-Keywords: X-UID: 132 Content-Length: 1839 OUR REFERENCE: SNSNV/097836578/09/NL KINDLY RESPOND ASAP THE SUBJECT MATTER My previous mail to you was not responded to and do not know what to take your non response to mean. This last mail will require your urgent response.. The SNS Bank Nv is currently in possession of an amount of US$10,500,000.00 belonging to a deceased customer whose name is not stated in this mail due to our Bank's privacy policies which protects the safety of our client's information.Our contact to you is based on the fact that our search revealed your last name as been same with that of the Deceased. Our records for this huge deposit showed no beneficiary as at the time of death of the depositor. In view of this and my position as the head of payment of benefits to beneficiaries,your last name can be accepted for a relative/beneficiary to this huge amount of money. Further details will be sent to you on this as soon as you signify your interest by sending to me immediately your full name as it is in your driver's license or international passport, your mobile telephone number, your fax number (if confidential) and your present contact address all needed for the legal documentation of this claim. On receipt of your response with the above details, i shall update you with the procedures of payment of this said amount to you as the legitimate beneficiary. Yours Sincerely Ronald. MORRIS CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not distribute or take action in reliance upon this message. If you have received this in error,please notify us immediately by return email and promptly delete this message and its attachments from your computer system.Going contrary to this warning may be unlawful. From info.optus104@optusnet.com.au Tue Feb 24 11:03:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BAYES_POISON_01,BL_COUNTRY_NG_2, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_3,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,SPF_NEUTRAL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=info.optus104%40optusnet.com.au&ip=195.4.92.91&receiver=ga.impsec.org] * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BAYES_POISON_01 RAW: Appears to have "bayes poison" random text * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mout1.freenet.de (mout1.freenet.de [195.4.92.91]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1OJ31WQ002296 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 24 Feb 2009 11:03:07 -0800 Message-Id: <200902241903.n1OJ31WQ002296@ga.impsec.org> Received: from [195.4.92.21] (helo=11.mx.freenet.de) by mout1.freenet.de with esmtpa (ID stoman01@mabmail-mail.de) (port 25) (Exim 4.69 #76) id 1Lc1bF-0007qi-2v; Tue, 24 Feb 2009 19:01:45 +0100 Received: from [41.220.65.79] (port=63539 helo=User) by 11.mx.freenet.de with esmtpa (ID stoman01@mabmail-mail.de) (port 25) (Exim 4.69 #76) id 1Lc1bC-0008HK-QX; Tue, 24 Feb 2009 19:01:44 +0100 Reply-To: From: "Dr. Tom Poker" Subject: [SPAM] Attention: Special information!! (TO YOUR INHERITANCE). Date: Tue, 24 Feb 2009 10:01:43 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 01:01:03 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 24 Feb 2009 11:03:07 -0800 (PST) X-Spam-Prev-Subject: Attention: Special information!! (TO YOUR INHERITANCE). Status: R X-Status: X-Keywords: X-UID: 133 Content-Length: 1840 African Development Bank Group Accra - Ghana Reply to E-mail : drtompoker@live.com Attention: Special information!! (TO YOUR INHERITANCE). A customer of ours who may relate to you (perhaps) in Ghana died four years ago in Tsunami tragedy in Indonesia leaving behind an estate/capital (US$38.9M with interest) in a bank here where I work as an external auditor, till date nobody has come forward or put application for the claim. Please log on to this websites for more information about the Tsunami tragedy. http://www.asianews.it/index.php?l=en&art=2375 http://www.asianews.it/index.php?l=en&art=2745 During the bank private search recently for the late gentle man relatives your name and email contact was among the findings that matches the SAME SURNAME as the deceased (name WITHHELD for security reason) who died intestate with no Will or Next of Kin. To maintain the level of security required I have intentionally left out the final details. I urge you to come forward since I can provide you with the details needed for you to claim the estate/capital so that we can be gratify by you, in this way USD$11.670,000.00 for you and USD$23.340,000.00 for us and the remaining $3.890,000.00 for miscellaneous expenses incurred during the cause of this project though my colleagues and I will do all the crucial part in the bank to have the inheritance claim released to you promptly as the Next of Kin to the deceased. However, to affirm your willingness and cooperation please do so by replying me at my private email (drtompoker@live.com ) with the following listed below; a.) YOUR FULL NAME: b.) HOME ADDRESS: c.) DATE OF BIRTH: d.) OCCUPATION/POSITION HELD: e.) TELEPHONE & FAX NUMBER: f.) NATIONALITY: g.) PRIVATE EMAIL ADDRESS: h.) MARITAL STATUS, SEX & AGE: I do expect your prompt response. Thank you, Dr. Tom Poker From morgan@live.com Wed Feb 25 06:31:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=21.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO, L_SOME_STD_PROBS,RAZOR2_CHECK,SPAMMY_WEBMAIL,SPF_SOFTFAIL,SUBJ_ALL_CAPS, TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=morgan%40live.com&ip=196.46.232.3&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.qanet.gm (mail.qanet.gm [196.46.232.3]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1PEVXU0001903 for ; Wed, 25 Feb 2009 06:31:37 -0800 Received: from localhost.qanet.gm ([::1] helo=mail.qanet.gm) by mail.qanet.gm with esmtp (Exim 4.62 (FreeBSD)) (envelope-from ) id 1LcJxg-0009Tz-UE; Wed, 25 Feb 2009 13:38:14 +0000 Received: from 81.91.235.152 (SquirrelMail authenticated user saby@qanet.gm) by webmail.qanet.gm with HTTP; Wed, 25 Feb 2009 13:38:08 -0000 (GMT) Message-ID: <3419.81.91.235.152.1235569088.squirrel@webmail.qanet.gm> Date: Wed, 25 Feb 2009 13:38:08 -0000 (GMT) Subject: [SPAM] CONFIRMATION NOTE From: "Mr. David Morgan" Reply-To: info_davidmorgan@yahoo.com User-Agent: SquirrelMail/1.4.6 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Greylist: Delayed for 00:47:07 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 25 Feb 2009 06:31:38 -0800 (PST) X-Spam-Prev-Subject: CONFIRMATION NOTE Status: R X-Status: X-Keywords: X-UID: 134 I am Dr. David Morgan, Staff of one of the leading Bank in Benin Republic. I would like you to indicate your interest to receive the transfer of US$15.5 Million. I will like you to stand as the next of kin to my late client whose account is presently dormant for claims. If you are interested Kindly follow as instruct below: Your Full Name:......... Private Phone:.......... Valid Address:.......... Occupation:............. Country Location:....... Dr. David Morgan. Give me a call upon your acceptance From skarn@pd.jaring.my Wed Feb 25 14:33:20 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.0 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FREEMAIL_FORGED,HTML_MESSAGE, HTML_TITLE_EMPTY,LOTTO_AGENT,MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 LOTTO_AGENT BODY: Claims Agent * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [192.228.250.83 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [41.208.48.160 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [41.208.48.160 listed in psbl.surriel.com] [192.228.250.83 listed in psbl.surriel.com] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.208.48.160 listed in zen.spamhaus.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.208.48.160 listed in dnsbl.sorbs.net] * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from vsmtp3.jaring.my (vsmtp3.jaring.my [192.228.250.83]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1PMXE1J015328 for ; Wed, 25 Feb 2009 14:33:19 -0800 Received: from localhost (localhost.jaring.my [127.0.0.1]) by vsmtp3.jaring.my (8.14.3/8.14.3) with ESMTP id n1PDEYsx069216; Wed, 25 Feb 2009 21:14:34 +0800 (MYT) (envelope-from skarn@pd.jaring.my) X-Virus-Scanned: by JARING Malware Filters (jaring.my) Received: from vsmtp3.jaring.my ([127.0.0.1]) by localhost (vsmtp3.jaring.my [127.0.0.1]) (amavisd-new, port 10024) with LMTP id VbvWnLrodR7Y; Wed, 25 Feb 2009 21:14:33 +0800 (MYT) Received: from User (41-208-48-160.mtn.co.za [41.208.48.160]) (authenticated bits=0) by vsmtp3.jaring.my (8.14.3/8.14.3) with ESMTP id n1PDDFEE068778; Wed, 25 Feb 2009 21:13:22 +0800 (MYT) (envelope-from skarn@pd.jaring.my) Message-Id: <200902251313.n1PDDFEE068778@vsmtp3.jaring.my> Reply-To: From: "Dr.Williams Smith" Subject: [SPAM] Award numbers: NL 56/7765 Date: Wed, 25 Feb 2009 15:14:28 +0200 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_00F7_01C2A9A6.5FC1C612" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 To: undisclosed-recipients:; X-Greylist: Delayed for 06:17:00 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 25 Feb 2009 14:33:20 -0800 (PST) X-Spam-Prev-Subject: Award numbers: NL 56/7765 Status: R X-Status: X-Keywords: X-UID: 135 Content-Length: 1111 This is a multi-part message in MIME format. ------=_NextPart_000_00F7_01C2A9A6.5FC1C612 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit
WINNER NO: 5
PLEASE DOWNLOAD THE ATTACHEMENT FOR YOUR CLAIM OF
GBP 5, 000, 000.00
(The claim agent)
Dr.Williams Smith
Tel+27 732152453
 ------=_NextPart_000_00F7_01C2A9A6.5FC1C612-- From infokwchan@yahoo.com.hk Sun Feb 22 06:33:06 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.7 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_IT_1,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1, J_CHICKENPOX_73,LOTTO_WIN_01,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01, MILLION_USD,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,STOX_30,STOX_58, SUBJ_ALL_CAPS,TO_CC_NONE,X_PRIORITY_HIGH,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.5 BL_COUNTRY_IT_1 Mail client in Italy * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.2 STOX_58 BODY: This company * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtpa1.aruba.it (smtpa2.aruba.it [62.149.128.211]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1MEX2IQ016624 for ; Sun, 22 Feb 2009 06:33:06 -0800 Message-Id: <200902221433.n1MEX2IQ016624@ga.impsec.org> Received: (qmail 16236 invoked by uid 89); 22 Feb 2009 14:00:44 -0000 Received: by simscan 1.1.0 ppid: 15891, pid: 16225, t: 0.1529s scanners: clamav: 0.88.4/m:40/d:1722 Received: from unknown (HELO User) (2067295@aruba.it@77.249.203.22) by smtpa1.aruba.it with SMTP; 22 Feb 2009 14:00:44 -0000 Reply-To: From: "POSTCODE LOTERIJ" Subject: [SPAM] POSTCODE PROMO Date: Sun, 22 Feb 2009 15:00:41 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 090221-0, 21/02/2009), Outbound message X-Antivirus-Status: Clean X-Greylist: Delayed for 00:32:14 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 22 Feb 2009 06:33:06 -0800 (PST) X-Spam-Prev-Subject: POSTCODE PROMO Status: R X-Status: X-Keywords: X-UID: 136 Content-Length: 1721 POSTCODE LOTERIJ PROMOTION RESULTS FOR FIRST CATEGORY Ticket Number: 76547/09 NATIONALE POSTCODE LOTERIJ in Conjunction with the Microsoft Corporation Prize Award. This is to inform you that your email I.D attached to Ticket number: 76547/09,Prized Number: 67898 and Lucky number : 7213 has won the SuperPostcodePrijs of USD{$} 1.500.000 (One Million Five Hundred Thousand United State Dollars) only in the first category of the Award Program held on the 16th January, 2009 in Holland-Netherlands. To claim your winning,you should contact the OFFICIAL and APPROVED paying bank here in Holland-Netherlands urgently:- POST BANK NL www.postbank.nl Email:postbnkclaimdept@aol.nl You are also advice to furnish them with the following information:- Your Names:- Telephone / Fax- Your Nationality{Your country of Origin}- E-Ticket number- Prize Number- Please note that in order to avoid unnecessary delays and complications, remember to always quote your winning details in all your correspondence with the Pay Bank. Congratulations once again from management and staff of this company. This Prize Award is sponsored by Microsoft Corps in conjunction with Arcor-Digital TV.de and promoted by the Nationale Postcode Loterij and they are registered and protected by the Benelux trademark law. This involve international promotion prize award and the winning funds will be paid to all winners in United State Dollars (USD) only to meet up with the World standards currency regulations. Sincerely, Mrs.Lynn Elsenhans (Promotion Co-ordinator) website: www.postcodeloterij.nl 0900 - 300 1500 (20 cpm, 9.00-21.00 uur) Copyright/©1996-2009depostcodeloterij.nl,All rights reserved.Terms of Service-Guideline. From infokwchan@yahoo.com.hk Sun Feb 22 06:33:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.5 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_IT_1,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,J_CHICKENPOX_73,LOTTO_WIN_01, LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,STOX_30,STOX_58, SUBJ_ALL_CAPS,TO_CC_NONE,X_PRIORITY_HIGH,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.5 BL_COUNTRY_IT_1 Mail client in Italy * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.2 STOX_58 BODY: This company * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtpa1.aruba.it (smtpa2.aruba.it [62.149.128.211]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n1MEX2pB016625 for ; Sun, 22 Feb 2009 06:33:06 -0800 Message-Id: <200902221433.n1MEX2pB016625@ga.impsec.org> Received: (qmail 16236 invoked by uid 89); 22 Feb 2009 14:00:44 -0000 Received: by simscan 1.1.0 ppid: 15891, pid: 16225, t: 0.1529s scanners: clamav: 0.88.4/m:40/d:1722 Received: from unknown (HELO User) (2067295@aruba.it@77.249.203.22) by smtpa1.aruba.it with SMTP; 22 Feb 2009 14:00:44 -0000 Reply-To: From: "POSTCODE LOTERIJ" Subject: [SPAM] POSTCODE PROMO Date: Sun, 22 Feb 2009 15:00:41 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 090221-0, 21/02/2009), Outbound message X-Antivirus-Status: Clean X-Greylist: Delayed for 00:32:15 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 22 Feb 2009 06:33:08 -0800 (PST) X-Spam-Prev-Subject: POSTCODE PROMO Status: R X-Status: X-Keywords: X-UID: 137 Content-Length: 1721 POSTCODE LOTERIJ PROMOTION RESULTS FOR FIRST CATEGORY Ticket Number: 76547/09 NATIONALE POSTCODE LOTERIJ in Conjunction with the Microsoft Corporation Prize Award. This is to inform you that your email I.D attached to Ticket number: 76547/09,Prized Number: 67898 and Lucky number : 7213 has won the SuperPostcodePrijs of USD{$} 1.500.000 (One Million Five Hundred Thousand United State Dollars) only in the first category of the Award Program held on the 16th January, 2009 in Holland-Netherlands. To claim your winning,you should contact the OFFICIAL and APPROVED paying bank here in Holland-Netherlands urgently:- POST BANK NL www.postbank.nl Email:postbnkclaimdept@aol.nl You are also advice to furnish them with the following information:- Your Names:- Telephone / Fax- Your Nationality{Your country of Origin}- E-Ticket number- Prize Number- Please note that in order to avoid unnecessary delays and complications, remember to always quote your winning details in all your correspondence with the Pay Bank. Congratulations once again from management and staff of this company. This Prize Award is sponsored by Microsoft Corps in conjunction with Arcor-Digital TV.de and promoted by the Nationale Postcode Loterij and they are registered and protected by the Benelux trademark law. This involve international promotion prize award and the winning funds will be paid to all winners in United State Dollars (USD) only to meet up with the World standards currency regulations. Sincerely, Mrs.Lynn Elsenhans (Promotion Co-ordinator) website: www.postcodeloterij.nl 0900 - 300 1500 (20 cpm, 9.00-21.00 uur) Copyright/©1996-2009depostcodeloterij.nl,All rights reserved.Terms of Service-Guideline. From mrsjoy018@msn.com Thu Feb 26 09:13:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************** X-Spam-Status: Yes, score=54.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_40_50,HTML_MESSAGE,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_73,LOTTO_ADMITS,LOTTO_AGENT, LOTTO_FROM,LOTTO_MANY,LOTTO_RANDOM,LOTTO_WINNINGS,LOTTO_WIN_01, LOTTO_YOU_WON_02,MILLIONS_01,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_FRAUD_X6,SARE_LOTTO_SPAM2,SPF_PASS,SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS, TO_CC_NONE,UNCLAIMED_MONEY,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 LOTTO_FROM Admits to being a lottery * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.5 LOTTO_RANDOM BODY: Random selection * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 2.4 UNCLAIMED_MONEY BODY: People just leave money laying around * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.5 HTML_40_50 BODY: Message is 40% to 50% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.0 LOTTO_MANY LOTTO_MANY * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from blu0-omc1-s9.blu0.hotmail.com (blu0-omc1-s9.blu0.hotmail.com [65.55.116.20]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1QHDa2M014619 for ; Thu, 26 Feb 2009 09:13:39 -0800 Received: from BLU143-W11 ([65.55.116.8]) by blu0-omc1-s9.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 26 Feb 2009 08:57:14 -0800 Message-ID: Content-Type: multipart/alternative; boundary="_e77350b6-9134-40c8-b2fd-41f1d4c328c6_" X-Originating-IP: [62.173.53.134] Reply-To: From: LOTTERY HOUSE Subject: [SPAM] WINNING NUMBERS:37-13-43-85-67-11.BV Date: Thu, 26 Feb 2009 16:57:13 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 26 Feb 2009 16:57:14.0055 (UTC) FILETIME=[45EAF570:01C99833] X-Greylist: Delayed for 00:16:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 26 Feb 2009 09:13:39 -0800 (PST) X-Spam-Prev-Subject: WINNING NUMBERS:37-13-43-85-67-11.BV Status: R X-Status: X-Keywords: X-UID: 138 Content-Length: 8102 --_e77350b6-9134-40c8-b2fd-41f1d4c328c6_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FROM THE DESK OF THE MANAGING DIRECTOR INTERNATIONAL/PRIZE AWARD DEPT CONTACT ADDRESS:NO=2C144 GLOBAL AVENUE VICTORIA ISLAND LAGOS NIGERIA. =20 WINNING NUMBERS:37-13-43-85-67-11.BV =20 REF:S6376527711 BATCH:S7151085135 =20 Attn: Winner=2C =20 We are please to announce you as one of the 10 lucky winners in National th= e Free Lotto draw held on the February 26=2C 2009. All 10 winning addresses= were randomly selected from a batch of 50=2C000=2C000 International emails= . Your email address emerged alongside 9 others as a category one winner in= this year's Annual FreeLotto Draw.=20 =20 Consequently=2Cyou have therefore been approved for a total pay out of $1.5= 00=2C00USD(one million=2C Five hundred Thuosand (Dollars only) CONGRATULATI= ONS!!! Due to mix up of some numbers and names=2C we ask that you keep your= winning information confidential until your claims has been processed and = your money Remitted to you. This is part of our security protocol to avoid = double claiming and unwarranted abuse of this program by some participants.= =20 =20 All participants were selected through a computer ballot system drawn from = over 40=2C000 company and 20=2C000=2C000 individual email addresses and nam= es from all over the world.This promotional program takes place every year.= This lottery was promoted and sponsored by Association of software produc= ers. We hope with part of your winning=2Cyou will take part in our next yea= r US$20 million international lottery.For security reasons=2C you are advis= ed to keep your winning information confidential till your claims is proces= sed and your money remitted to you in whatever manner you deem fit to claim= your prize.This is a part of our precautionary measure to avoid double cla= iming and unwarranted abuse of this program by some unscrupulous elements.= =20 =20 Please be warned. To file for your claim=2C please email our fiduciary age= nt with the below details for processing of your claims: =20 NAME: MR. JUDE WILLIAMS (CHIEF FINANCIAL DIRECTOR NATIONAL LOTTERY NIGERIA LTD.) EMAIL: freelottonl2009@gmail.com =20 Remember=2C all winning must be claimed not later than 11th MAR.=2C2009.Aft= er this date all unclaimed funds will be included in the next stake.Please = note in order to avoid unnecessary delays and complications please remember= to quote your reference number and batch numbers in all correspondence.Fur= thermore=2C should there be any change of address do inform our agent as so= on as possible.Congratulations once more from our members of staff and than= k you for being part of our promotional program. =20 Yours faithfully=2C Mrs. Ann Uba. AFRO-ASIAN Zonal Coordinator. = --_e77350b6-9134-40c8-b2fd-41f1d4c328c6_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
FROM THE DESK OF THE MANA= GING DIRECTOR
INTERNATIONAL/PRIZE AWARD DEPT
CON= TACT ADDRESS:NO=2C144 GLOBAL AVENUE
VICTORIA ISLAND LAGOS NIGERIA.
&n= bsp=3B
WINNING NUMBERS:37-13-43-85-67-11.BV
 =3B =3B
REF:S6376527711
BATCH:S7151085135=
 =3B
Attn: Winner=2C
 =3B
We are please to announce = you as one of the 10 lucky winners in National the Free = Lotto draw held on the February 26=2C 2009. All 10 win= ning addresses were randomly selected from a batch of 50=2C000=2C000 Intern= ational emails. Your email address emerged alongside 9 others as a category= one winner in this year's Annual FreeLotto Draw.
 =3B
Conseque= ntly=2Cyou have therefore been approved for a total pay out of $1.500=2C00U= SD(one million=2C Five hundred Thuosand (Dollars only) CONGRATULATIONS!!! D= ue to mix up of some numbers and names=2C we ask that you keep your winning= information confidential until your claims has been processed and your mon= ey Remitted to you. This is part of our security protocol to avoid double c= laiming and unwarranted abuse of this program by some participants.
&nb= sp=3B
All participants were selected through a computer ballot system d= rawn from over 40=2C000 company and 20=2C000=2C000 individual email address= es and names from all over the world.This promotional program takes place e= very year. This lottery was promoted and sponsored by Association of = =3B software producers. We hope with part of your winning=2Cyou will take p= art in our next year US$20 million international lottery.For security reaso= ns=2C you are advised to keep your winning information confidential till yo= ur claims is processed and your money remitted to you in whatever manner yo= u deem fit to claim your prize.This is a part of our precautionary measure = to avoid double claiming and unwarranted abuse of this program by some unsc= rupulous elements.
 =3B
Please be warned. To file for your clai= m=2C please =3B email our fiduciary agent with the below details for pr= ocessing of your claims:
 =3B
NAME: MR. JUDE WILLIAMS
(CHIEF = FINANCIAL DIRECTOR
NATIONAL LOTTERY NIGERIA LTD.)
E= MAIL: freelotto= nl2009@gmail.com
&nb= sp=3B
Remember=2C all winning must be claimed not later than 11th MAR.= =2C2009.After this date all unclaimed funds= will be included in the next stake.Please note in order to avoid un= necessary delays and complications please remember to quote your reference = number and batch numbers in all correspondence.Furthermore=2C should there = be any change of address do inform our agent as soon as possible.Congratula= tions once more from our members of staff and thank you for being part of o= ur promotional program.
 =3B
Yours faithfully=2C

Mrs. Ann Uba.
AFRO-ASIAN Zonal Coordinator.
= --_e77350b6-9134-40c8-b2fd-41f1d4c328c6_-- From ksam25@me.com Thu Feb 26 17:26:01 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********** X-Spam-Status: Yes, score=10.8 required=5.0 tests=BAYES_99,MISSING_SUBJECT, MSGID_FROM_MTA_HEADER,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SPAMMY_WEBMAIL,SPF_PASS,UNPARSEABLE_RELAY autolearn=disabled version=3.1.8 X-Spam-Report: * -0.0 SPF_PASS SPF: sender matches SPF record * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.8 MISSING_SUBJECT Missing Subject: header * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay Received: from asmtpout014.mac.com (asmtpout014.mac.com [17.148.16.89]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1R1PuQp028291 for ; Thu, 26 Feb 2009 17:26:01 -0800 MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=ISO-8859-1 Received: from spool001.mac.com ([10.150.69.51]) by asmtp014.mac.com (Sun Java(tm) System Messaging Server 6.3-7.03 (built Aug 7 2008; 32bit)) with ESMTP id <0KFP00DFE7TBTO50@asmtp014.mac.com> for jhardin@impsec.org; Thu, 26 Feb 2009 16:24:57 -0800 (PST) Received: from webmail028 ([10.13.128.28]) by spool001.mac.com (Sun Java(tm) System Messaging Server 6.3-8.01 (built Dec 16 2008; 32bit)) with ESMTP id <0KFP00BPQ7TIMVB0@spool001.mac.com>; Thu, 26 Feb 2009 16:24:54 -0800 (PST) Date: Thu, 26 Feb 2009 16:24:54 -0800 From: Mr Samuel Kabelo Message-id: <98691769211861406339852973241878198195-Webmail@me.com> Subject: [SPAM] Received: from [196.2.123.113] from webmail.me.com with HTTP; Thu, 26 Feb 2009 16:24:54 -0800 Received: from [ 196.2.124.253] from webmail.me.com with HTTP; Thu, 26 Feb 2009 16:24:54 -0800 Received: from [ 196.33.166.196] from webmail.me.com with HTTP; Thu, 26 Feb 2009 16:24:54 -0800 X-Originating-IP: 196.2.123.113, 196.2.124.253, 196.33.166.196 To: Undisclosed recipients: ; X-Greylist: Delayed for 01:00:46 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 26 Feb 2009 17:26:01 -0800 (PST) X-Spam-Prev-Subject: Status: R X-Status: X-Keywords: X-UID: 139 Hello, Let me Start By Introducing myself Mr. Samuel Kabelo of Capitec Bank South Africa. I need your assistance in the transfer of the sum $19.5m. I shall perfect all documents in your name to make you beneficiary the funds, Once the funds is transferred to you we then share in a ratio of 65% for me, 30% for you and 5% for expenses. Should you be interested. 1,Full names 2,Phone numbers for more details. Regards, Mr. Samuel Kabelo. From anthoniwood@terra.es Fri Feb 27 10:04:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.4 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, FREEMAIL_FROM,FREEMAIL_REPLYTO,FUZZY_AMBIEN,HTML_MESSAGE,LOTTO_ADMITS, LOTTO_RANDOM,LOTTO_YOU_WON_02,SARE_FREE_WEBM_EsTerra,SPF_PASS,TO_CC_NONE, UPPERCASE_25_50 autolearn=disabled version=3.1.8 X-Spam-Report: * 1.7 SARE_FREE_WEBM_EsTerra Sender used free email account - may be * spammer * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.5 LOTTO_RANDOM BODY: Random selection * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.4 FUZZY_AMBIEN BODY: Attempt to obfuscate words in spam * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.0 UPPERCASE_25_50 message body is 25-50% uppercase * 2.0 TO_CC_NONE No To: or Cc: header Received: from IMPaqm2.telefonica.net (impaqm2.telefonica.net [213.4.149.62]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1RI4MfM023779 for ; Fri, 27 Feb 2009 10:04:25 -0800 Received: from IMPmailhost1.adm.correo ([10.20.102.38]) by IMPaqm2.telefonica.net with bizsmtp id M2ja1b01j0piX6q3M5o6zT; Fri, 27 Feb 2009 18:48:06 +0100 Received: from cps4 ([10.20.100.7]) by IMPmailhost1.adm.correo with BIZ IMP id M5o61b00109a4E21h5o69D; Fri, 27 Feb 2009 18:48:06 +0100 X-TE-authinfo: authemail="??" |auth_email="??" X-TE-AcuTerraCos: auth_cuTerraCos="terra-wm" Received: from [41.211.231.235] by correo8.terra.es with HTTP (authenticated as anthoniwood@terra.es); Fri, 27 Feb 2009 18:48:05 +0100 Message-ID: <21164847.1235756885668.JavaMail.root@cps4> Date: Fri, 27 Feb 2009 18:48:05 +0100 (MET) From: "anthoniwood@terra.es" Reply-To: "anthoniwood@terra.es" Subject: [SPAM] From anthony wood MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_23771_3813875.1235756885521" X-Greylist: Delayed for 00:16:12 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 27 Feb 2009 10:04:26 -0800 (PST) X-Spam-Prev-Subject: From anthony wood Status: R X-Status: X-Keywords: X-UID: 140 Content-Length: 2262 ------=_Part_23771_3813875.1235756885521 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit We wish to notify you that your email address was randomly selected and entered into our free Third Category draws. You have subsequently emerged a winner and therefore entitled to one million five hundred thousand pounds. REFERENCE NUMBER: MT-AUKIL / UK /22 /QE /222, INTERNATIONAL LOTTERY CODE NUMBER: MT-AUKIL / 2024-2 For further information, kindly confirm receipt of this email, by forwarding this message to your transfer agent via email or fax to: Carl Gareth, MERYLYN FINANCIAL INVESTMENT CLAYFIELDS MILL, ST MARYS CHALFORD, STROUD, GLOUCESTERSHIRE, GL6 8NU Tel: +44 703-597-6014 FAX: +44 700-593-0827 , email: merylyninvestment60@gmail.com Congratulations!!! Yours' Sincerely, THE ADMINISTRATOR Ahora también puedes acceder a tu correo Terra desde el móvil. Infórmate pinchando aquí. ------=_Part_23771_3813875.1235756885521 Content-Type: text/html;charset="UTF-8" Content-Transfer-Encoding: 7bit
We wish to notify you that your email address was
randomly selected and entered into our free Third
Category draws. You have subsequently emerged a winner
and therefore entitled to one million five hundred
thousand pounds.

REFERENCE NUMBER: MT-AUKIL / UK /22 /QE /222,
INTERNATIONAL LOTTERY CODE NUMBER: MT-AUKIL / 2024-2


For further information, kindly confirm receipt of
this email, by forwarding this message to your transfer
agent via email or fax to:

Carl Gareth,
MERYLYN FINANCIAL INVESTMENT
CLAYFIELDS MILL,
ST MARYS CHALFORD,
STROUD, GLOUCESTERSHIRE, GL6 8NU
Tel: +44 703-597-6014
FAX: +44 700-593-0827 ,
email: merylyninvestment60@gmail.com

Congratulations!!!

Yours' Sincerely,
THE ADMINISTRATOR




Ahora también puedes acceder a tu correo Terra desde el móvil.
Infórmate pinchando aquí.
------=_Part_23771_3813875.1235756885521-- From andb1000@yahoo.com.hk Fri Feb 27 14:36:48 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.6 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_JP_1,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,MILLIONS_01,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_BRBL,SARE_FRAUD_X3,UNDISC_RECIPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [220.110.216.70 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [220.110.216.70 listed in dnsbl.sorbs.net] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from Vine1.infodream.jp (vine1.infodream.jp [220.110.216.70]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1RMahtV031927 for ; Fri, 27 Feb 2009 14:36:47 -0800 Received: from User (unknown [83.229.62.11]) by Vine1.infodream.jp (Postfix) with ESMTP id 3FBD31D8C3; Thu, 26 Feb 2009 04:52:24 +0900 (JST) Reply-To: From: "Anderson Baker" Subject: [SPAM] Proposal Date: Wed, 25 Feb 2009 20:49:16 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090225195226.3FBD31D8C3@Vine1.infodream.jp> To: undisclosed-recipients:; X-Greylist: Delayed for 40:53:36 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 27 Feb 2009 14:36:47 -0800 (PST) X-Spam-Prev-Subject: Proposal Status: R X-Status: X-Keywords: X-UID: 141 Content-Length: 1912 From: Anderson Baker , Auditor: Alpha Bank Uk, London - UK. Attention: Sir, This letter might surprise you, because we have never met either in person or by correspondence. But I believe it is one day that you got to know someone either physical or through correspondence. Please accept my sincere apologies if my email does not meet your business or personal ethics. I will first introduce myself as Anderson Baker, an auditor with a bank in United Kingdom. One of our accounts, with holding balance of 15,000,000.00GBP(Fifteen Million Great Britain Pounds Sterling) has been dormant, and last operated many years ago. Nobody has done anything as regards to the claiming of this money, because the account owner has no family member or friends that have any knowledge, as to the existence of either the account or the funds; I have decided to find a reliable foreign partner to deal with. My proposition to you, is to seek your consent to present you as the Next of kin and beneficiary of this late client, that the proceeds of this account valued a huge sum shall be paid to you, and then we can share the amount on a mutually agreed percentage. This transaction is totally free of risk and troubles, as the fund is legitimate, and does not originate from drug, money laundry, terrorism or any other illegal act. The funds will be released to you after necessary processes have been followed. As an officer of the bank I cannot be directly connected to this money, that prompted my contacting you, to receive this money into your bank account . The proceeds will be shared 60/40 %. I assure you that , we will have this funds within seven working days, all things been equal . Alternatively, you can write me back with my private email address (andersonbaker1@googlemail.com). As soon as I receive your response I will details you on how we can achieve it successfully . Mr Anderson Baker . From fundpaymentrelease@ny.frb.org Sat Feb 28 08:50:49 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************** X-Spam-Status: Yes, score=28.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FORGED,FROM_SUBDOMAIN,LOTTO_YOU_WON_03,MILLIONS_01,MILLION_USD, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SPF_NEUTRAL, SUBJ_ALL_CAPS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.2 FROM_SUBDOMAIN From address is a third-level domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=fundpaymentrelease%40ny.frb.org&ip=211.29.132.188&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail07.syd.optusnet.com.au (mail07.syd.optusnet.com.au [211.29.132.188]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1SGog7r030436 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 28 Feb 2009 08:50:49 -0800 Received: from User ([59.154.25.30]) (authenticated sender bmurphy17) by mail07.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id n1SGZHSt023713; Sun, 1 Mar 2009 03:35:27 +1100 Message-Id: <200902281635.n1SGZHSt023713@mail07.syd.optusnet.com.au> Reply-To: From: "FEDERAL RESERVE BANK, NEW YORK" Subject: [SPAM] YOUR FUND PAYMENT IS READY - RESPOND WITH YOUR DETAILS FOR CONFIRMATION Date: Sat, 28 Feb 2009 08:36:33 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: YOUR FUND PAYMENT IS READY - RESPOND WITH YOUR DETAILS FOR CONFIRMATION Status: R X-Status: X-Keywords: X-UID: 142 Content-Length: 3222 >From the Corporate Department Federal Reserve Bank of New York 33 Liberty Street New York , NY 10045 Attention; Beneficiary The fund and its interest accrued to it amounting to US$ 4.5 Million United States Dollars is ready to be released to you as the beneficiary of the Fund and its Interest Fund upon the confirmation of your personal details. This Fund and Interest Fund is on your name. This Fund has been long over-due payment and has been officially approved for payment by the G8 Government, United Nations and the United States Government. This is based on encouraging quick inflow of cash/liquidity into the world economy as a means of boosting the economy already ailing and bad. Based on this, we have been authorized by the various authorities and governments to urgently process and release these funds to the respective beneficiaries, all outstanding payments including With-held Lottery Funds, Unpaid Inheritance Funds, Unpaid Contract Funds and all other Funds that have not been paid till date that are enlisted in the unpaid funds files with us. Most of these Unpaid Funds were with-held due to improper and un-official payment documentations, lack of proper verification documents to ascertain the legality, source/origin and authenticity of these funds. As a means of boosting the ailing world economy, these funds have now been properly documented and verified officially and we have been asked by the various government authorities involved together with the United Nations authority to urgently contact the recipients of these funds and get them released to them without delay. This is the reason why you are being contacted to enable you contact us urgently without delay because these funds are due for payment to the respective beneficiaries as indicated. You are therefore required to cease or stop any further communication, contact or response to any office, person or group pf persons with regards to the release of your payment. You are instructed in your best interest to "only" contact us for the immediate confirmation of your personal details, processing and release of this fund to you. Contact us now as we have been authorized and mandated to confirm details, process this payment and get the payment released to the various beneficiaries. We are required to re-confirm your personal details to ascertain and ensure that you are the rightful beneficiary of this Fund and its Interest Amount that has accrued to the fund which is due for payment. The Government has therefore given us time limit within which to confirm your details and release the Fund and its Interest Amount to you. Failure to hear from you with your timely and urgently, your fund payment will automatically be cancelled. You are here-by required to urgently contact us with your details as follows; Your Full Name Your Contact address Your telephone numbers Your sex Your age Your occupation Let us know if you were expecting to receive any payment You are required to quickly respond urgently without delay. Faithfully yours, Edward F. Murphy Head, Corporate Department Federal Reserve Bank of New York 33 Liberty Street New York, NY 10045 From al095413@alumail.uji.es Sat Feb 28 15:37:25 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FORGED_RCVD_HELO,FREEMAIL_FORGED, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_33,L_SOME_STD_PROBS,MILLION_USD,RAZOR2_CHECK, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPAMMY_WEBMAIL,SPF_PASS, SUBJ_ALL_CAPS,UNDISC_RECIPS,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from postfix-i02.uji.es (nuvol.uji.es [150.128.98.40]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n1SNbKED009615 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sat, 28 Feb 2009 15:37:25 -0800 Received: from localhost (postfix-i02.uji.es [150.128.193.20]) by localhost (Postfix) with ESMTP id A986D1F7268; Sun, 1 Mar 2009 00:15:26 +0100 (CET) X-Virus-Scanned: by amavisd-new at uji.es Received: from postfix-i02.uji.es ([150.128.193.20]) by localhost (postfix-i02.uji.es [150.128.193.20]) (amavisd-new, port 2027) with ESMTP id 5jWTZXA67vrX; Sun, 1 Mar 2009 00:15:26 +0100 (CET) Received: from localhost (webforum.uji.es [150.128.98.47]) by postfix-i02.uji.es (Postfix) with ESMTP id E28451EED27; Sun, 1 Mar 2009 00:13:28 +0100 (CET) Received: from 83.229.87.246 ([83.229.87.246]) by webmail.uji.es (IMP) with HTTP for ; Sun, 01 Mar 2009 00:13:28 +0100 Message-ID: <1235862808.49a9c5181dd7c@webmail.uji.es> Date: Sun, 01 Mar 2009 00:13:28 +0100 From: Carmen =?iso-8859-1?b?Tao=?= Gil =?iso-8859-1?b?RmVybuFuZGV6?= Reply-to: louissmithjnr01@yahoo.com.hk Subject: [SPAM] RE_BANKING BUSINESS MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: Internet Messaging Program (IMP) 3.2.2 X-Originating-IP: 83.229.87.246 To: undisclosed-recipients:; X-Greylist: Delayed for 00:21:44 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 28 Feb 2009 15:37:25 -0800 (PST) X-Spam-Prev-Subject: RE_BANKING BUSINESS Status: R X-Status: X-Keywords: X-UID: 143 Content-Length: 5807 Greetings, Dear One Permit me to inform you of my desire of going into business relationship with you. I Come across your profile and have Decided to get in touch with you after my prayer, to see if you can help me alleviate this problem. I can't imagine how you will feel receiving a sudden letter from a remote country far away and probably from someone you are not closely related with. But all the same, I believe we do not need to be of blood relatives before we can establish cordial relationship, this proposal might come to you as a surprise but believe me that it is transparent business. My name is MR.LOUIS SMITH JNR, and I work in the delivery department in a security company here in London. I feel quite safe dealing with you in this important Business. I was on a routine inspection when I discovered a deposit account with a balance of (EIGHTY TWO MILLION UNITED STATES DOLLAR). I later learn t on further discreet investigation that the depositor of the funds has passed away (dead) leaving no beneficiary to the deposit. The company will deliver this money to anyone with legal claims because the former depositor was a foreigner. I am certainly sure that nobody will come again for the claim of this money. We claim this money with legal claims to the deposit Holder; therefore I need your cooperation in this transaction. I will provide all necessary information needed in order to claim this money, Hoping in God that you will never let me down now and in future o.k. Late Rafik Bahaa Edine Hariri (November 1, 1944 - February 14, 2005), married to Nazek Audi Hariri, was a Lebanese self-made billionaire and business tycoon, and was five times Prime Minister of Lebanon (1992-1998) and (2000- 2004) before his last resignation from office on October 20, 2004. The late Rafik Hariri died on February 14, 2005 when explosives equivalent to around 300 kg of C4 were detonated as his motorcade drove past the Saint George Hotel in the Lebanese capital, for more information please log on to http://en.wikipedia.org/wiki/Rafik_Hariri WE WANT TO TRANSFER THIS MONEY INTO A SAFE FOREIGN ACCOUNT ABROAD BUT I DON'T KNOW ANY FOREIGNER WHOM I CAN TRUST, I KNOW THAT THIS MESSAGE WILL COME TO YOU AS A SURPRISE AS WE DON'T KNOW OURSELVES BEFORE, BUT BE SURE THAT IT IS REAL AND A GENUINE BUSINESS. I CONTACT YOU BELIEVING THAT YOU WILL NOT LET ME DOWN ONCE THE FUND GOES TO YOU.LET ME HERE FROM YOU URGENTLY VIA PRIVATE EMAIL BOX expect your urgent response including your addresses, your telephone and fax number. Thanks for expected cooperation. Best Regards, MR.LOUIS SMITH. =============================================================================== =============================================================================== =========================================================================== Gre, Eine Liebe Lassen Sie mich Ihnen mein Wunsch, die in Geschftsbeziehung mit Ihnen. I Come in Ihrem Profil und haben sich entschlossen, mit Ihnen in Kontakt treten, nachdem mein Gebet, um zu sehen, wenn Sie mir helfen, dieses Problem lindern. Ich kann mir nicht vorstellen, wie Sie sich fhlen, die eine pltzliche Schreiben von einem entfernten Land, weit weg und die wahrscheinlich von jemandem, Sie sind nicht eng mit. Aber alle die gleiche, ich glaube, wir mssen nicht von Blut-Angehrigen, bevor wir feststellen knnen, herzliche Beziehung, diesem Vorschlag knnte fr Sie als berraschung, aber glauben Sie mir, dass es transparente Unternehmen. Mein Name ist MR.LOUIS SMITH JNR, und ich arbeite in der Abteilung Lieferung in einem Security-Unternehmen hier in London. Ich fhle mich ganz sicher mit Ihnen in diesem wichtigen Geschftsbereich. Ich war auf einer Routine- Kontrolle, wenn ich auf ein Sparkonto mit einer ausgewogenen Verteilung der (achtzig zwei Millionen US-Dollar). Ich spter erfahren t ber weitere diskrete Untersuchung, da der Einleger der Mittel hat sich (tot), die keine Empfnger der Kaution. Das Unternehmen wird dieses Geld an jeden Inhaber rechtlicher Ansprche vor Gericht, weil die ehemaligen Einleger war ein Auslnder. Ich bin sicher, dass Sie sicher, niemand wird kommen wieder fr die Behauptung, dieses Geld. Wir behaupten, dieses Geld mit gesetzlichen Ansprche auf die Kaution Holder, deshalb brauche ich Ihre Untersttzung in dieser Transaktion. Ich werde alle notwendigen Angaben, die notwendig sind, um zu behaupten, dieses Geld, in der Hoffnung auf Gott, dass Sie nie let me down, jetzt und in Zukunft ok Late Bahaa Edine Rafik Hariri (1. November 1944 - 14. Februar 2005), verheiratet mit Nazek Audi Hariri, war eine libanesische Self-made-Milliardr und Business Tycoon, und wurde fnf Mal Premierminister des Libanon (1992- 1998) und (2000 -2004) vor seinem letzten Rcktritt aus dem Amt am 20. Oktober 2004. Der verstorbene Rafik Hariri starb am 14. Februar 2005, wenn Sprengstoff entspricht rund 300 kg C4 wurden gezndet als seine Wagenkolonne fuhr vorbei an der St. George Hotel in der libanesischen Hauptstadt, fr weitere Informationen melden Sie sich bitte an http://en.wikipedia.org/wiki/Rafik_Hariri Wir wollen dieses Geld in einen sicheren AUSLNDISCHEN im Ausland aber ich wei nicht, Jeder Auslnder, die ich vertrauen kann, ich wei, dass diese Botschaft wird zu Ihnen kommen als berraschung Da wir nicht wissen das ja selbst schon frher gegeben, aber sicher sein, dass Sie ist real und eine echte BUSINESS. Ich Sie glauben, dass Sie nicht Let Me Down, SOBALD DER FONDS GOES TO ME YOU.LET HIER AUS Sie dringend ber private E-Mail-Box erwarten dringend Ihre Antwort einschlielich Ihrer Adresse, Ihrer Telefon-und Faxnummer. Vielen Dank fr die Zusammenarbeit zu erwarten. Mit besten Gren, MR.LOUIS Smith. From diirchan@hangseng.com Sat Feb 28 21:02:47 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=17.0 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_FR_2,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2,L_SOME_STD_PROBS, MILLIONS_01,RAZOR2_CHECK,RBL_PSBL_01,SPAMMY_WEBMAIL,SPF_SOFTFAIL, UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_FR_2 Mail client in France * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=diirchan%40hangseng.com&ip=195.5.209.6&receiver=ga.impsec.org] * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [62.4.16.120 listed in psbl.surriel.com] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp-delay1.nerim.net (mailhost-b6-p0.nerim.net [195.5.209.6]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2152fve018463 for ; Sat, 28 Feb 2009 21:02:47 -0800 Received: from maiev.nerim.net (smtp-120-saturday.nerim.net [62.4.16.120]) by smtp-delay1.nerim.net (Postfix) with ESMTP id 96C74CA6436 for ; Sun, 1 Mar 2009 04:40:16 +0100 (CET) Received: from webmail.nerim.net (archimonde.nerim.net [62.4.16.97]) by maiev.nerim.net (Postfix) with ESMTP id 4ED52B8DB5; Sun, 1 Mar 2009 05:44:36 +0100 (CET) Received: from 41.220.75.3 (SquirrelMail authenticated user machto) by webmail.nerim.net with HTTP; Sun, 1 Mar 2009 05:44:36 +0100 (CET) Message-ID: Date: Sun, 1 Mar 2009 05:44:36 +0100 (CET) Subject: [SPAM] Business proposal for you. From: "Patrick W. Chan" Reply-To: diirchan@live.com User-Agent: SquirrelMail/1.4.15 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal To: undisclosed-recipients:; X-Greylist: Delayed for 00:17:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 28 Feb 2009 21:02:47 -0800 (PST) X-Spam-Prev-Subject: Business proposal for you. Status: R X-Status: X-Keywords: X-UID: 144 My name is Mr. Patrick Chan, a branch director of Hang Seng Bank Ltd, Hong Kong. I was account officer to an Iraqi who made a fixed deposit of Twelve million dollars in my bank Upon maturity, several notices were sent to him, even during the war, (2003). Again after the war another notification was sent and still no response came from him. We later found out that Farouk Bassem and his family had been killed during the war in a bomb blast that hit their home. After further investigation, I also discovered that he did not declare any next of kin in the paper work of his bank deposit. So, 12.5m Usd is still lying in my bank and no one will ever come forward to claim it. My proposal is to hae you stand as nex of kin so the funds can be released to you for us to share 50/50 for your assistance. Should you be interested in executing this with me, please send your response immediately. If not, just disregard this email. You can reach me via email: diirchan@live.com Yours Truly, Patrick W. Chan From m.joyceuk@googlemail.com Sun Mar 1 06:19:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.6 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_CN_1,BL_COUNTRY_CN_2,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,LOTTO_AGENT,LOTTO_YOU_WON_02,L_SOME_STD_PROBS, MILLIONS_01,PLING_PLING,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL,RCVD_IN_SBL,SPF_NEUTRAL, THOUS_EMAIL_ADDRS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=m.joyceuk%40googlemail.com&ip=59.41.8.48&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [59.41.8.48 listed in b.barracudacentral.org] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [59.41.8.48 listed in cn.countries.nerd.dk] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [92.41.72.19 listed in zen.spamhaus.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [59.41.8.48 listed in psbl.surriel.com] * 0.3 PLING_PLING Subject has lots of exclamation marks * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.gz2010ag.org ([59.41.8.48]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n21EJMfc002977 for ; Sun, 1 Mar 2009 06:19:26 -0800 Received: from User (92.41.72.19.sub.mbb.three.co.uk [92.41.72.19]) by mail.gz2010ag.org (Postfix) with ESMTP id F1BC515DB05; Wed, 25 Feb 2009 19:53:23 +0800 (CST) Reply-To: From: "Karen Lindsey" Subject: [SPAM] Lucky Winner !!! Date: Wed, 25 Feb 2009 12:30:11 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090225115324.F1BC515DB05@mail.gz2010ag.org> To: undisclosed-recipients:; X-Greylist: Delayed for 30:37:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 01 Mar 2009 06:19:26 -0800 (PST) X-Spam-Prev-Subject: Lucky Winner !!! Status: R X-Status: X-Keywords: X-UID: 145 Attn Lucky Winner, We are pleased to inform you that you have emerged a winner in the annual draw of our Global Lottery Promotions, UK. You are therefore to receive a cash prize of 2,500,000.00. (Two Million Five Hundred Thousand Pounds Sterling) from the total payout CONGRATULATIONS!!!. You are hereby requested to contact your claims agent and immediately update your claims process for your payment. Contact: Mr. Martin Joyce Tel :+447551249192 Fax :+448703121132 Email:j.martinuk1@googlemail.com You are advised to provide the following information: 1. Name in full 2. Address 3. Nationality 4. Age 5. Gender 6. Occupation 7. Phone/Fax Yours Faithfully, Karen Lindsey Lottery Coordinator From barclays.bank1936@yahoo.co.uk Sun Mar 1 07:16:48 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_46, J_CHICKENPOX_61,J_CHICKENPOX_72,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID, PHISH_05,SARE_RECV_UK2NET2,TO_CC_NONE,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.9 SARE_RECV_UK2NET2 Passed through possible spammer relay or source * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_46 BODY: 4alpha-pock-6alpha * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp5.uk2.net (smtp5.uk2.net [83.170.81.185]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n21FGhjT004444 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sun, 1 Mar 2009 07:16:48 -0800 Message-Id: <200903011516.n21FGhjT004444@ga.impsec.org> Received: from [41.207.213.233] (helo=User) by smtp5.uk2.net with esmtpa (Exim 4.60) (envelope-from ) id 1Ldn8n-0005mV-RX; Sun, 01 Mar 2009 14:59:43 +0000 Reply-To: From: "From Briggs Arthur" Subject: [SPAM] from Briggs Arthur Date: Sun, 1 Mar 2009 06:59:43 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam_score: 10.0 X-Greylist: Delayed for 00:16:31 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 01 Mar 2009 07:16:48 -0800 (PST) X-Spam-Prev-Subject: from Briggs Arthur Status: R X-Status: X-Keywords: X-UID: 146 Content-Length: 2381 My Good Friend & Partner Briefly I am Mr.Arthur Briggs the Director Foriegn Remittance Department Barclays Bank London-United Kingdom.I have (20.000.000.00) Twenty Million Pounds that i want to transfer from our Bank to your Bank Account the Depositor of this money died along with all his Entire Family since last two years in a fire Accident and since that time no body in there family has come for this money all this years. My Good Friend,I have arranged every thing concerning the transfer of this money to your Bank account through our paying bank in Spain i did it this way because i dont want any body in our bank to know about this transaction untill you confirm this money in your Bank Account. I only need your Complete Bank account informations and your direct telephone and fax numbers and your complete address so that i will forward them to our Paying Bank in Spain for the completion of the transfer of this 20 Million Pounds to your Bank Account that is all.I will give you 25 Percent of the total amount immediately you confirm this money in your Bank Account. My Good Friend and Partner i will send my international passport to you immediately i receive your message so that you will know exactly whom you are dealing with,Please you will promise me that you will never in your life think of betraying me after you could have confirmed this money in your Bank Account because this money is all my hope to start a new life in your country,We have alot to talk about but that should be immediately i arrive your country. My Good Friend and Partner you should keep this transaction to your self alone untill you confirm this money in your bank account for security reasons and you should also try and do exactly what our paying bank in Spain ask you to do so that the will give you a smooth transfer of this 20.000.000.00 Million Pounds to your Bank Account and you should try and give this transaction much of your time because you are going to gain alot immediately you confirm this money in your Bank Account ok. I await your Urgent response including your complete Bank Account Informations as requested. I await Your Urgent Response and i wish you the best of luck in this new year 2009. Best Regards. >From Mr.Arthur Briggs. Director Barclays Bank 190 Tottenham Court Road Bloomsbury,London,W1T 7lh UK. Direct Mobile Line. +447 031814540 From omen@xamle.net Sun Mar 1 07:45:12 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_3, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_BY_IP,RCVD_IN_BRBL, SARE_PROLOSTOCK_SYM3,SUBJ_ALL_CAPS,TO_CC_NONE,X_PRIORITY_HIGH autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.0 RCVD_BY_IP Received by mail server with no name * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.2 PHISH_05 BODY: Phishing for account information * 1.6 SARE_PROLOSTOCK_SYM3 BODY: Last week's hot stock scam * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [69.90.47.153 listed in b.barracudacentral.org] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from ns48.servepower.com (ns48.servepower.com [69.90.47.153]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n21Fj6B9004867 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sun, 1 Mar 2009 07:45:11 -0800 Message-Id: <200903011545.n21Fj6B9004867@ga.impsec.org> Received: (qmail 9325 invoked from network); 28 Feb 2009 17:12:07 -0800 Received: from unknown (HELO User) (195.166.239.228) by 64.34.102.244 with SMTP; 28 Feb 2009 17:12:07 -0800 Reply-To: From: "Adams Stmichael Idioma" Subject: [SPAM] TESTING SMTP 209.123.28.249 Date: Sun, 1 Mar 2009 03:00:30 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 07:49:02 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 01 Mar 2009 07:45:12 -0800 (PST) X-Spam-Prev-Subject: TESTING SMTP 209.123.28.249 Status: R X-Status: X-Keywords: X-UID: 147 Hello my friend, I am Mr. Adams St.Michael, chairman contract dept NNPC-Nigeria. We Have an over invoiced USD28.6M to be transfered to your account.Shares, 30% for you and 70% for us If you are interested kindly get back to us via e-mail. Thanks, Yours Sincerly, Adams St.Michael Tel:234 706 121 6502 From infob5@me.com Mon Mar 2 02:46:13 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********** X-Spam-Status: Yes, score=11.5 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, DNS_FROM_RFC_POST,MSGID_FROM_MTA_HEADER,RBL_POXLAY_01,SPAMMY_WEBMAIL,SPF_PASS, UNPARSEABLE_RELAY autolearn=disabled version=3.1.8 X-Spam-Report: * -0.0 SPF_PASS SPF: sender matches SPF record * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9921] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [165.146.17.158 listed in dnsbl.sorbs.net] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from asmtpout013.mac.com (asmtpout013.mac.com [17.148.16.88]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n22Ak75P018397 for ; Mon, 2 Mar 2009 02:46:13 -0800 MIME-version: 1.0 Content-type: text/plain; charset=UTF-8 Received: from spool002.mac.com ([10.150.69.52]) by asmtp013.mac.com (Sun Java(tm) System Messaging Server 6.3-7.03 (built Aug 7 2008; 32bit)) with ESMTP id <0KFV00NFCHSP3390@asmtp013.mac.com> for jhardin@impsec.org; Mon, 02 Mar 2009 01:46:02 -0800 (PST) Received: from webmail039 ([10.13.128.39]) by spool002.mac.com (Sun Java(tm) System Messaging Server 6.3-8.01 (built Dec 16 2008; 32bit)) with ESMTP id <0KFV00E5YHSP1ZB0@spool002.mac.com> for jhardin@impsec.org; Mon, 02 Mar 2009 01:46:01 -0800 (PST) Date: Mon, 02 Mar 2009 01:46:01 -0800 From: "Bar. Peter Ozolua." Message-id: <49328990575095121913580802830733328365-Webmail@me.com> Subject: [SPAM] Message from Peter Ozolua. Received: from [165.146.17.158] from webmail.me.com with HTTP; Mon, 02 Mar 2009 01:46:01 -0800 X-Originating-IP: 165.146.17.158 To: Undisclosed recipients: ; X-Greylist: Delayed for 01:00:07 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 02 Mar 2009 02:46:13 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n22Ak75P018397 X-Spam-Prev-Subject: Message from Peter Ozolua. Status: R X-Status: X-Keywords: X-UID: 148 Complement of the season.I want you to stand as a beneficiary to the total sum of Ј4,600,000. Since there is no written will. Acceptance of this deal, I want you to send your telephone/fax numbers and a forwarding address (not p.o.box) to enable me file in all documents at our High court probate division for the release of the funds. The funds . Your response is confidential. Yours faithfully, Bar. Peter Ozolua. From eaglesridgeranch@post.com Mon Mar 2 07:25:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_95,BL_COUNTRY_CN_1,BL_COUNTRY_CN_2, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_29, J_CHICKENPOX_54,LOTTO_WIN_01,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01, NA_DOLLARS,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, RCVD_IN_NJABL_PROXY,RCVD_IN_SORBS_WEB,STOX_30,SUBJ_ALL_CAPS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_29 BODY: 2alpha-pock-9alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9898] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [61.152.219.51 listed in b.barracudacentral.org] * 0.7 RCVD_IN_NJABL_PROXY RBL: NJABL: sender is an open proxy * [61.152.219.51 listed in combined.njabl.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [121.13.232.252 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [61.152.219.51 listed in psbl.surriel.com] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [61.152.219.51 listed in cn.countries.nerd.dk] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [121.13.232.252 listed in dnsbl.sorbs.net] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail2005.shift.edu.cn ([61.152.219.51]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n22FPYFS025682 for ; Mon, 2 Mar 2009 07:25:38 -0800 Received: from User ([121.13.232.252]) by mail2005.shift.edu.cn with Microsoft SMTPSVC(6.0.3790.3959); Mon, 2 Mar 2009 23:22:44 +0800 Reply-To: From: "EAGLES RANCH" Subject: [SPAM] "FROM THE EAGLES RIDGE RANCH ONLINE COMPETITION LUCKY WINNER E-MAIL WON ANNOUNCEMENT" Date: Mon, 2 Mar 2009 23:27:21 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 02 Mar 2009 15:22:44.0546 (UTC) FILETIME=[BC478A20:01C99B4A] X-Greylist: Delayed for 04:14:31 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 02 Mar 2009 07:25:38 -0800 (PST) X-Spam-Prev-Subject: "FROM THE EAGLES RIDGE RANCH ONLINE COMPETITION LUCKY WINNER E-MAIL WON ANNOUNCEMENT" Status: R X-Status: X-Keywords: X-UID: 149 Content-Length: 2009 The Eagles Ridge Ranch, River Falls, WI,Minnesota 4-H Horse Association, Lucky mail Promotion prize Award, 94040: Califonia-U.S.A. In cooperation with the Minnesota 4-H Horse Association, i hereby announced to you today that you are one of the winner award CASH PRIZE of us$ 1,000,000,00 (One million us dollars only) from the Lucky mail Promotion prize Award open to all individual pets lovers through internet users online email addresses in our verious websites and this your email was one of our lucky winners. This is to promote and compensate all individuals, pets lovers and also users who used their times to views all our various websites both on our competition areas. Eagles Ridge Ranch and with the American Paint Horse Association has freely given you the total sum of us$1m, cash payment effectively. This Lottery is approved by the Paint horse Gaming Board and also Licensed by the The International Association of Gaming Regulators (IAGR) And we intend to sensitize the public.As indicated by the computerized selection machine and your lucky winning numbers (ERRNET2009/4-H ) AND ( CODE NO: 00 531278/CH/LM/HORSE), falls within our Asia booklet representative office in THE PEOPLE REPUBLIC OF CHINA as showed in our coupon which won you the prize award. Therefore, you are noted to send yours names,home address, telephone number and with your winning numbers to the below agent name: Mr.Davidson Delica Foreign Service Manager The Eagles Ridge Ranch Asia Regional Office-China. Email: davidsondelicanotification@gmail.com Phone: +8613143933243 to enable the office issued you the copy of yours award winning certificate with the process whereby you would receive your email won prize immediately. NOTE: Yours winning informations is highly secret untill yours email won prize award get to you to avoid any misconduct of double claim or paying to the wrong hands. Accept my hearty congratulations Yours faithfully, Dr. Albert Coleman, (Director) From smithfrederick_20078@yahoo.com.cn Mon Mar 2 13:52:55 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.8 required=5.0 tests=ADDR_NUMS_AT_BIGSITE, ADVANCE_FEE_1,ADVANCE_FEE_2,BAYES_99,BL_COUNTRY_TR_1,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SORBS_WEB,TO_CC_NONE, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TR_1 Mail client in Turkey * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [212.57.26.2 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [193.120.116.183 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [193.120.116.183 listed in psbl.surriel.com] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [193.120.116.183 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADDR_NUMS_AT_BIGSITE Has an address with lots of numbers at a big * ISP * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from yaklasim.com (asy2.asy26.tellcom.com.tr [212.57.26.2] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n22Lqnwd002875 for ; Mon, 2 Mar 2009 13:52:54 -0800 Received: from User [193.120.116.183] by yaklasim.com with ESMTP (SMTPD32-8.04) id A32971800DC; Mon, 02 Mar 2009 16:54:33 +0200 Reply-To: From: "Smith Frederick" Subject: [SPAM] I am waiting to hear from you please ! 22 Date: Mon, 2 Mar 2009 14:45:46 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200903021654625.SM01828@User> X-Greylist: Delayed for 01:26:59 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 02 Mar 2009 13:52:55 -0800 (PST) X-Spam-Prev-Subject: I am waiting to hear from you please ! 22 Status: R X-Status: X-Keywords: X-UID: 150 Private and Personal Please Good day, I am a senior Auditor and Heading-computing department here in a leading bank in the United Kingdom, in my Bank I discovered an abandoned large sum of money 35Million pounds belonging to one of our late Foreign Customer, since 2000. The owner of this account is late Mr. Thomas Stockley, an American National, a businessman, who involved in air crash along with his family. You can confirm from the website below. http://www.cnn.com/2000/US/02/01/alaska.airlines.list/ No other person knows about this account. The Strategy is to use our influence as a senior Auditor and Heading-computing department to approve the funds to you. If you are interested, please get back to me on my private email address below: Email: smithfrederick_20078@yahoo.com.cn Yours faithfully SmithFrederick From tammieragan@cox.net Thu Mar 5 07:45:02 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n25Fj29c007555 for ; Thu, 5 Mar 2009 07:45:02 -0800 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******** X-Spam-Status: Yes, score=8.0 required=5.0 tests=ADVANCE_FEE_1,BAYES_80, DEAR_SOMETHING,FREEMAIL_FORGED,SARE_SUB_WINNING_NOT,TO_CC_NONE, UNPARSEABLE_RELAY autolearn=disabled version=3.1.8 X-Spam-Report: * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8919] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 2.0 TO_CC_NONE No To: or Cc: header * 0.7 SARE_SUB_WINNING_NOT Spammer subject - black market or scam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Thu, 05 Mar 2009 07:45:02 -0800 (PST) Received: from eastrmmtao107.cox.net (eastrmmtao107.cox.net [68.230.240.59]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n25Ffga9010402 for ; Thu, 5 Mar 2009 07:41:46 -0800 Received: from eastrmimpo03.cox.net ([68.1.16.126]) by eastrmmtao107.cox.net (InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP id <20090305135926.DOSE23750.eastrmmtao107.cox.net@eastrmimpo03.cox.net>; Thu, 5 Mar 2009 08:59:26 -0500 Received: from eastrmwml31 ([172.18.18.217]) by eastrmimpo03.cox.net with bizsmtp id PRzS1b00M4h0NJL02RzSTW; Thu, 05 Mar 2009 08:59:27 -0500 X-CM-Score: NA Received: Message-ID: <20090305085928.DVW68.143338.imail@eastrmwml31> Date: Thu, 5 Mar 2009 8:59:27 -0500 From: Liyana KYO Reply-To: scott.parker6@gmail.com Subject: [SPAM] NOTIFICATION MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 X-Priority: 3 (Normal) Sensitivity: Normal X-Greylist: Delayed for 01:42:13 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Mar 2009 07:41:46 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n25Ffga9010402 X-Spam-Prev-Subject: NOTIFICATION Status: R X-Status: X-Keywords: X-UID: 151 Yayasan Ma’had Foundation 32, Jalan Tengku Ampuan Zabedah 9/A, Shah Alam, 40000. Malaysia. Dear Sir/Madam, The award committee of Yayasan Ma’had Foundation has selected you as one of the four (4) nominees for the award of 1,000,000 Euros from the foundation electronic draws in line with the Philanthropy work being carried out by the Yayasan Ma’had Foundation. For details and processing of the above sum, please contact the secretary of the award Committee with the given details below: Name: Scott Parker E mail: scott.parker6@gmail.com Yours faithfully, Mrs. Liyana KYO From smantaylor3@msn.com Tue Mar 3 02:13:10 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO, HTML_50_60,HTML_MESSAGE,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLION_USD, RAZOR2_CHECK,SARE_SUB_GOOD_DAY,SPF_PASS,STOX_30,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.7 SARE_SUB_GOOD_DAY Contains spammer phrasing * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from bay0-omc1-s3.bay0.hotmail.com (bay0-omc1-s3.bay0.hotmail.com [65.54.246.75]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n23AD6fX022494 for ; Tue, 3 Mar 2009 02:13:10 -0800 Received: from BAY116-W9 ([64.4.38.109]) by bay0-omc1-s3.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 3 Mar 2009 01:56:38 -0800 Message-ID: Content-Type: multipart/alternative; boundary="_a650cd4b-bb3f-4dfc-a4f5-607f9b1f725f_" X-Originating-IP: [41.203.239.35] Reply-To: From: usman taylor Subject: [SPAM] Good Day, Date: Tue, 3 Mar 2009 09:56:38 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 03 Mar 2009 09:56:38.0455 (UTC) FILETIME=[5864BC70:01C99BE6] X-Greylist: Delayed for 00:16:27 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 03 Mar 2009 02:13:10 -0800 (PST) X-Spam-Prev-Subject: Good Day, Status: R X-Status: X-Keywords: X-UID: 152 Content-Length: 3123 --_a650cd4b-bb3f-4dfc-a4f5-607f9b1f725f_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Good Day=2C My Name is Dr. Usman Taylor=2C I am the Credit and audits manager with bank of Africa (BOA) bank of Africa in Ouagadougou Burkina Faso West Africa. =20 Please contact me with my private email address=3B(usman-01@hotmail.fr) I have a business proposal in the tune of $11.6m=2C (eleven Million six Hun= dred Thousand United States Dollar only) after the successful transfer=3B = we shall share in ratio of 40% for you and 60% for me.. =20 Should you be interested=2C so we can commence all arrangements and I Will = give you more information on how we would handle this project. Please treat= this business with utmost confidentiality and send me the Following inform= ation's bellow=3B=20 =20 (1) Full names: (2) Private phone number: (3) Current residential address: (4) Occupation: (5) Age and Sex: =20 Best Regards=2C Dr. Usman Taylor= --_a650cd4b-bb3f-4dfc-a4f5-607f9b1f725f_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Good Day=2C
My Name is Dr. Usman Taylor=2C
I am the Credit and audits m= anager with bank of Africa
(BOA) bank of Africa in Ouagadougou Burkina Faso West Africa.
 =3B
Please contact me with my private email address=3B(usman-01@hotmail= .fr)
I have a busines= s proposal in the tune of $11.6m=2C (eleven Million six Hundred Thou= sand United States Dollar only) after the successful transfer=3B =3B we shall share in ratio = of 40% for you and 60% for me..
 =3B
Should you be interested=2C so we can commence all arrangement= s and I Will give you more information on how we would handle this project.= Please treat this business with utmost confidentiality and send me the Fol= lowing information's bellow=3B =3B
 =3B
(1) Full names:
(2) Private phone number:
(3) Current residential address:
= (4) Occupation:
(5) Age and Sex:
 =3B
Best Regards=2C
Dr. = Usman Taylor
= --_a650cd4b-bb3f-4dfc-a4f5-607f9b1f725f_-- From fundpaymentunit@ny.frb.org Tue Mar 3 14:39:59 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************** X-Spam-Status: Yes, score=28.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FORGED,FROM_SUBDOMAIN,LOTTO_YOU_WON_03,MILLIONS_01,MILLION_USD, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SPF_NEUTRAL, SUBJ_ALL_CAPS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.2 FROM_SUBDOMAIN From address is a third-level domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=fundpaymentunit%40ny.frb.org&ip=211.29.132.193&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9994] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail12.syd.optusnet.com.au (mail12.syd.optusnet.com.au [211.29.132.193]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n23MdpmH009345 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 3 Mar 2009 14:39:57 -0800 Received: from User ([59.154.25.30]) (authenticated sender daniel.linda) by mail12.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id n23MYdtj015227; Wed, 4 Mar 2009 09:34:50 +1100 Message-Id: <200903032234.n23MYdtj015227@mail12.syd.optusnet.com.au> Reply-To: From: "FEDERAL RESERVE BANK, NEW YORK" Subject: [SPAM] YOUR FUND PAYMENT IS READY - RESPOND WITH YOUR DETAILS FOR CONFIRMATION Date: Tue, 3 Mar 2009 17:37:02 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: YOUR FUND PAYMENT IS READY - RESPOND WITH YOUR DETAILS FOR CONFIRMATION Status: R X-Status: X-Keywords: X-UID: 153 Content-Length: 3222 >From the Corporate Department Federal Reserve Bank of New York 33 Liberty Street New York , NY 10045 Attention; Beneficiary The fund and its interest accrued to it amounting to US$ 4.5 Million United States Dollars is ready to be released to you as the beneficiary of the Fund and its Interest Fund upon the confirmation of your personal details. This Fund and Interest Fund is on your name. This Fund has been long over-due payment and has been officially approved for payment by the G8 Government, United Nations and the United States Government. This is based on encouraging quick inflow of cash/liquidity into the world economy as a means of boosting the economy already ailing and bad. Based on this, we have been authorized by the various authorities and governments to urgently process and release these funds to the respective beneficiaries, all outstanding payments including With-held Lottery Funds, Unpaid Inheritance Funds, Unpaid Contract Funds and all other Funds that have not been paid till date that are enlisted in the unpaid funds files with us. Most of these Unpaid Funds were with-held due to improper and un-official payment documentations, lack of proper verification documents to ascertain the legality, source/origin and authenticity of these funds. As a means of boosting the ailing world economy, these funds have now been properly documented and verified officially and we have been asked by the various government authorities involved together with the United Nations authority to urgently contact the recipients of these funds and get them released to them without delay. This is the reason why you are being contacted to enable you contact us urgently without delay because these funds are due for payment to the respective beneficiaries as indicated. You are therefore required to cease or stop any further communication, contact or response to any office, person or group pf persons with regards to the release of your payment. You are instructed in your best interest to "only" contact us for the immediate confirmation of your personal details, processing and release of this fund to you. Contact us now as we have been authorized and mandated to confirm details, process this payment and get the payment released to the various beneficiaries. We are required to re-confirm your personal details to ascertain and ensure that you are the rightful beneficiary of this Fund and its Interest Amount that has accrued to the fund which is due for payment. The Government has therefore given us time limit within which to confirm your details and release the Fund and its Interest Amount to you. Failure to hear from you with your timely and urgently, your fund payment will automatically be cancelled. You are here-by required to urgently contact us with your details as follows; Your Full Name Your Contact address Your telephone numbers Your sex Your age Your occupation Let us know if you were expecting to receive any payment You are required to quickly respond urgently without delay. Faithfully yours, Edward F. Murphy Head, Corporate Department Federal Reserve Bank of New York 33 Liberty Street New York, NY 10045 From patrickchan@echina.org Tue Mar 3 21:56:21 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_TW_1,BL_COUNTRY_TW_2,DNS_FROM_RFC_BOGUSMX, FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01, SUBJ_ALL_CAPS,UNDISC_RECIPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 1.9 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [210.243.179.201 listed in tw.countries.nerd.dk] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [210.243.179.201 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.joseph.org.tw (oldfriend.joseph.org.tw [210.243.179.201]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n245uGFL020847 for ; Tue, 3 Mar 2009 21:56:20 -0800 Received: from mail.joseph.org.tw (localhost [127.0.0.1]) by mail.joseph.org.tw (Postfix) with ESMTP id 4F70F2366A53; Wed, 4 Mar 2009 11:27:21 +0800 (CST) Received: from mail.joseph.org.tw (localhost [127.0.0.1]) by mail.joseph.org.tw (Postfix) with ESMTP id BCC812364219; Wed, 4 Mar 2009 09:13:28 +0800 (CST) From: "ptrick chan" Reply-To: patrickk_chan117@yahoo.com.hk Subject: [SPAM] BUSINESS PROPOSAL Date: Tue, 3 Mar 2009 17:12:10 -0800 Message-Id: <20090304011438.M91609@echina.org> X-Mailer: OpenWebMail 2.52 20060502 X-OriginatingIP: 80.255.59.242 (791102) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 To: undisclosed-recipients:; X-NetStation-Status: PASS X-NetStation-SPAM: 0.00/5.00-10.00 X-Greylist: Delayed for 00:18:40 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 03 Mar 2009 21:56:21 -0800 (PST) X-Spam-Prev-Subject: BUSINESS PROPOSAL Status: R X-Status: X-Keywords: X-UID: 154 Private Business Proposal FROM: MR.PATRICK CHAN Hang Seng Bank Ltd, patrickk_chan117@yahoo.com.hk Hong Kong. Good Day, I have a Business Proposal of (Twenty Four million Five Hundred Thousand United State Dollars only) for you to handle with me from my bank.I will need you to help me in transferring the above funds from Hong Kong to your country. I need to know if you will be able to handle this with me before I explain to you in details. Should you be interested please send me your: 1,Full names, 2,occupation, 3,private phone number, 4,current residential address. finally after that I shall furnish you with more informations about this project. However I shall be waiting your response and assurance. Kind Regards, Patrick Chan. From taylor7usman@msn.com Wed Mar 4 13:12:04 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FREEMAIL_FROM,FREEMAIL_REPLYTO, HTML_MESSAGE,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLION_USD, SARE_SUB_GOOD_DAY,SPF_PASS,STOX_30,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.7 SARE_SUB_GOOD_DAY Contains spammer phrasing * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from blu0-omc2-s36.blu0.hotmail.com (blu0-omc2-s36.blu0.hotmail.com [65.55.111.111]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n24LC0db013390 for ; Wed, 4 Mar 2009 13:12:04 -0800 Received: from BLU126-W25 ([65.55.111.72]) by blu0-omc2-s36.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 4 Mar 2009 12:55:35 -0800 Message-ID: Content-Type: multipart/alternative; boundary="_0a956a69-7ac8-488e-8488-b742af21408b_" X-Originating-IP: [41.203.233.114] Reply-To: From: usman taylor Subject: [SPAM] Good Day, Date: Wed, 4 Mar 2009 20:55:35 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 04 Mar 2009 20:55:35.0867 (UTC) FILETIME=[90F0C8B0:01C99D0B] X-Greylist: Delayed for 00:16:24 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 04 Mar 2009 13:12:04 -0800 (PST) X-Spam-Prev-Subject: Good Day, Status: R X-Status: X-Keywords: X-UID: 155 Content-Length: 9351 --_0a956a69-7ac8-488e-8488-b742af21408b_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Good Day=2C=20 My Name is Dr. Usman Taylor=2C I am the Credit and audits manager with bank of Africa=20 (BOA) bank of Africa in Ouagadougou Burkina Faso West Africa.=20 =20 Please contact me with my private email address=3B(usman-01@hotmail.fr)=20 I have a business proposal in the tune of $11.6m=2C (eleven Million six Hun= dred Thousand United States Dollar only) after the successful transfer=3B = we shall share in ratio of 40% for you and 60% for me..=20 =20 Should you be interested=2C so we can commence all arrangements and I Will = give you more information on how we would handle this project. Please treat= this business with utmost confidentiality and send me the Following inform= ation's bellow=3B =20 =20 (1) Full names: (2) Private phone number: (3) Current residential address: (4) Occupation: (5) Age and Sex: =20 Best Regards=2C Dr. Usman Taylor= --_0a956a69-7ac8-488e-8488-b742af21408b_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Good Day=2C

My Name is Dr. Usman Taylor=2C=
I am the Credit and audits manager with bank of Africa=

(BOA) bank of Africa in Ouagadougou Burkina Faso = West Africa<= /SPAN>.

 =3B

Please contact me with my priv= ate email address=3B(usman-01@hotmail.fr)

I have a <= B>business proposal in the tun= e of $11.6m=2C (eleven Million six Hundred Thousand United States only) after the successful transfer=3B =3B we shall sh= are in ratio of 40% for you and 60% for me..

 =3B

Should you be interested=2C so= we can commence all arrangements and I Will give you more information on h= ow we would handle this project. Please treat this business with utmost con= fidentiality and send me the Following information's bellow=3B =3B

 =3B

(1) Full names:
(2) Private phone number:
<= STRONG>(3) Current residential address= :
(4) Occup= ation:
(5) = Age and Sex:
Best Regards=2C
Dr. Usman Taylor

= --_0a956a69-7ac8-488e-8488-b742af21408b_-- From centralbkn.bank263@googlemail.com Wed Mar 4 15:10:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************* X-Spam-Status: Yes, score=49.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,BL_COUNTRY_TW_2, FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_3,MILLIONS_01,MILLION_USD,NA_DOLLARS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_NEUTRAL,STOX_30,SUBJ_ALL_CAPS, THOUS_EMAIL_ADDRS,UNDISC_RECIPS,UPPERCASE_75_100 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=centralbkn.bank263%40googlemail.com&ip=59.120.91.111&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [59.120.91.111 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.73 listed in zen.spamhaus.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.73 listed in dnsbl.sorbs.net] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.73 listed in psbl.surriel.com] * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from dns.tongx.com.tw (dns.tongx.com.tw [59.120.91.111] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n24NA0F3016594 for ; Wed, 4 Mar 2009 15:10:06 -0800 Received: from User (unknown [196.3.183.73]) by dns.tongx.com.tw (Postfix) with ESMTP id 56E1349B621; Thu, 5 Mar 2009 02:44:50 +0800 (CST) Reply-To: From: "DR VICTOR MARTINS" Subject: [SPAM] RE:INHERITANCE FUND TRANSFER NOTIFICATION Date: Wed, 4 Mar 2009 08:09:43 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-Antivirus: avast! (VPS 090303-2, 03/04/2009), Outbound message X-Antivirus-Status: Clean Message-Id: <20090304184451.56E1349B621@dns.tongx.com.tw> To: undisclosed-recipients:; X-Greylist: Delayed for 03:41:03 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 04 Mar 2009 15:10:07 -0800 (PST) X-Spam-Prev-Subject: RE:INHERITANCE FUND TRANSFER NOTIFICATION Status: R X-Status: X-Keywords: X-UID: 156 Content-Length: 3309 CENTRAL BANK OF NIGERIA PHASE II, GARKIFEDERAL CAPITAL TERRETORY ABUJA-NIGERIA REF: CBN-0XX2/987 E-MAIL:centralbkn.bank263@googlemail.com TEL: +234 702 986 5890 ATTN: BENEFICIARY RE:INHERITANCE FUND TRANSFER NOTIFICATION WE HAVE RECEIVED AN INSTRUCTION FROM THE OFFICE OF THE PRESIDENCY, THE FEDERAL MINISTRY OF FINANCE (FMF), AND THE SENATE COMMITTEE ON FOREIGN PAYMENTS (SCFP), TO PAY YOU YOUR CONTRACT/INHERITANCE FUND FROM OUR BANK (CENTRAL BANK OF NIGERIA) IN CONJUNCTION WITH THE HSBC BANK LONDON. THIS IS TO NOTIFY YOU THAT YOUR FUND WHICH IS THE TOTAL SUM OF TEN MILLION FIVE HUNDRED THOUSAND DOLLARS (US$10, 500,000.00), AS YOUR CONTRACT/INHERITANCE FUND HAVE BEEN PROGRAMMED FOR IMMEDIATE PAYMENT TO YOU. AND YOUR INHERITANCE FUND PAYMENT HAS BEEN FINALIZED TO BE RELEASED TO YOU AS THE LEGITIMATE BENEFICIARY OF THE FUND, VIA HSBC ATM DEBIT CARD. MEANWHILE, WE WANT YOU TO CLARIFY IF YOU INDEED APPROVE A WOMAN FEW DAYS AGO TO CLAIM YOUR FUND ON YOUR BEHALF, WHO NOW CLAIM THAT SHE IS YOUR REPRESENTATIVE SENT BY YOU TO RECEIVE YOUR FUND. NOTE THAT SHE ACTUALLY TENDERED SOME VITAL DOCUMENT, WHICH PROVED THAT YOU ACTUALLY SENT HER FOR THE COLLECTION OF THESE FUNDS. BELOW IS THE LIST OF THE DOUCMENTS WHICH SHE TENDERED TO BANK: 1. LETTER OF ADMINISTRATION. 2. HIGH COURT INJUNCTION. 3. ORDER TO RELEASE. DUE TO THE NATURE OF MY JOB, I CANNOT AFFORD TO MAKE ANY MISTAKE IN RELEASING THESE FUNDS TO ANYONE EXCEPT YOU WHO IS THE RECOGNIZED TRUE BENEFICIARY TO THESE FUNDS. NOTE THAT I ASKED HER TO COME BACK NEXT WEEK SO I CAN VERIFY THIS FACT FROM YOU FIRST. KINDLY CLARIFY US ON THIS ISSUE BEFORE WE MAKE THIS PAYMENT TO HER WHOM CAME ON YOUR BEHALF. HOWEVER, NOTE THAT WE ARE WAITING TO HEAR FROM YOU SHORTLY, AS YOU PROVIDE THE REQUIRED INFORMATION BELLOW TO ENABLE OUR ATM PROCESSING DEPARTMENT TO ISSUE YOUR ATM CARD TO YOU SO THAT YOU WILL BE ABLE TO CASH YOUR TEN MILLION FIVE HUNDRED THOUSAND UNITED STATES DOLLARS FROM ANY ATM MARCHINE AT ANY WHERE IN THE WORLD. THE REQUIRED INFORMATION IS AS STATED BELOW: 1.YOUR NAME: 2.YOUR ADDRESS: 3.YOUR TELEPHONE: 4.FAX: 5.AGE: 6.SEX: 7.YOUR OCCUPATION: NOTE THAT THIS ATM CARD WILL BE SENT TO YOU THROUGH THE COURIER SUCH AS FEDEX, UPS OR ANY COUIRER COMPANY OF YOUR CHOICE FOR THE DELIVERY OF YOUR ATM CARD TO YOU FOR YOUR EASY CASHING OF YOUR CONTRACT SUM OF US$10, 500,000.00. FROM THE OFFICE OF THE PRESIDENCY, THIS REPUTABLE BANK HAS BEEN APPROVED IN CONJUNCTION WITH THE HSBC BANK LONDON, THEY HAS BEEN ACCREDITED TO HANDLE AND MAKE PAYMENT TO ALL FOREIGN CONTRACT/INHERITANCE FUNDS BENEFICIARIES THIS SECOND QUARTER PAYMENT OF THE YEAR 2008/2009. THEREFORE, WE WAIT TO HEAR FROM YOU SOON. WE ARE WAITNG TO HERE FROM YOU AS SOON AS POSSIBLE. BEST REGARDS, DR VICTOR MARTINS DIRECTOR, ATM PAYMENT DEPARTMENT CENTRAL BANK OF NIGERIA (CBN) From jedavis71@cox.net Wed Mar 4 21:16:41 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.7 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLIONS_01,NA_DOLLARS,RAZOR2_CHECK, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,THOUS_EMAIL_ADDRS, TO_CC_NONE,UNPARSEABLE_RELAY autolearn=disabled version=3.1.8 X-Spam-Report: * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from eastrmmtao107.cox.net (eastrmmtao107.cox.net [68.230.240.59]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n255GbWt026734 for ; Wed, 4 Mar 2009 21:16:41 -0800 Received: from eastrmimpo03.cox.net ([68.1.16.126]) by eastrmmtao107.cox.net (InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP id <20090304161725.EVQQ23750.eastrmmtao107.cox.net@eastrmimpo03.cox.net>; Wed, 4 Mar 2009 11:17:25 -0500 Received: from eastrmwml40 ([172.18.18.217]) by eastrmimpo03.cox.net with bizsmtp id P4HP1b0064h0NJL024HPie; Wed, 04 Mar 2009 11:17:24 -0500 X-CM-Score: NA Received: Message-ID: <20090304111725.VIYSO.228770.imail@eastrmwml40> Date: Wed, 4 Mar 2009 11:17:24 -0500 From: siowkiong Reply-To: siowkiong22@gmail.com Subject: [SPAM] ATTENTION MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) Sensitivity: Normal X-Greylist: Delayed for 12:59:10 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 04 Mar 2009 21:16:41 -0800 (PST) X-Spam-Prev-Subject: ATTENTION Status: R X-Status: X-Keywords: X-UID: 157 Content-Length: 2086 SIOW KIONG ATAN AND ASSOCIATE. SOLICITOR AND ADVOCATES NO. 24, JALAN MELAKA RAYA 31, TAMAN MELAKA RAYA MALAYSIA TEL: +60 169026876 Email: siowkiong22@gmail.com I am Barrister siow kiong, an attorney at law. A deceased client of mine, that shares the same last name as yours, who here in after shall be referred to as my client, died as the result of a heart-related condition on March 12th 2007. His heart condition was due to the death of all the members of his family in the tsunami disaster on the 26th December 2006 in Sumatra Indonesia . http://en.wikipedia.org/wiki/2004_Indian_Ocean_earthquake I have contacted you to assist in distributing the money left behind by my client before it is confiscated or declared unserviceable by the bank where this deposit valued at Eighteen Million dollars( US$18 million dollars) is lodged. This bank has issued me a notice to contact the next of kin, or the account will be confiscated. My proposition to you is to seek your consent to present you as the next-of-kin and beneficiary of my named client, since you have the same last name, so that the proceeds of this account can be paid to you. Then we can share the amount on a mutually agreed-upon Percentage. All legal documents to back up your claim as my client's next-of-kin will be provided. All I require is your honest cooperation to enable us see this transaction through. This will be executed under a legitimate arrangement that will protect you from many breach of the law. If this business proposition offends your moral values, do accept my apology. I must use this opportunity to implore you to exercise the utmost indulgence to keep this matter extraordinary confidential, whatever your decision, while I await your prompt response. Please contact me at once to indicate your interest. I will like you to acknowledge the receipt of this e-mail as soon as possible via my private EMAIL: (siowkiong22@gmail.com ) and treat with absolute confidentiality and sincerity. I look forward to your quick reply. Best regards, Barrister siow kiong. Attorney at Law From info@cenbank.org Thu Mar 5 02:51:25 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************************** X-Spam-Status: Yes, score=39.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_SOMETHING,DNS_FROM_RFC_BOGUSMX, DNS_FROM_RFC_POST,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_73,MILLIONS_01,MILLION_USD,PHISH_01,PHISH_05,PHISH_08, SARE_FRAUD_X3,SARE_FRAUD_X4,SPAMMY_WEBMAIL,STOX_30,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 1.0 PHISH_08 BODY: Phishing * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.5 PHISH_01 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.9 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from mail.bbts.net (mail.bbts.net [119.18.145.2]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n25ApHcN002538 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 5 Mar 2009 02:51:24 -0800 Received: from mail.bbts.net (localhost.localdomain [127.0.0.1]) by mail.bbts.net (8.13.1/8.13.1) with ESMTP id n25986aG012534; Thu, 5 Mar 2009 15:08:06 +0600 Received: (from apache@localhost) by mail.bbts.net (8.13.1/8.13.1/Submit) id n2596HkF012315; Thu, 5 Mar 2009 10:06:17 +0100 X-Authentication-Warning: mail.bbts.net: apache set sender to info@cenbank.org using -f Received: from 83.229.69.145 (proxying for 192.168.0.13, 192.168.16.31) (SquirrelMail authenticated user fs); by mail.bbts.net with HTTP; Thu, 5 Mar 2009 10:06:17 +0100 (WAT) Message-ID: <57523.83.229.69.145.1236243977.squirrel@mail.bbts.net> Date: Thu, 5 Mar 2009 10:06:17 +0100 (WAT) Subject: [SPAM] Attn: Dear Valued Contractor From: "Central Bank Of Nigeria" Reply-To: charlesprivate1@sify.com Bcc: User-Agent: SquirrelMail/1.4.3a-12.EL4.centos4 X-Mailer: SquirrelMail/1.4.3a-12.EL4.centos4 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Greylist: Delayed for 01:37:51 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Mar 2009 02:51:25 -0800 (PST) X-Spam-Prev-Subject: Attn: Dear Valued Contractor Status: R X-Status: X-Keywords: X-UID: 158 Content-Length: 3484 CENTRAL BANK OF NIGERIA FEDERAL REPUBLIC OF NIGERIA TINUBU SQUARE, LAGOS. CABLES: CENBANK TELEGRAM: CENBANK FROM THE DESK OF: Professor Charles C. Soludo Executive Governor,Central Bank Of Nigeria (CBN), International Remittance Department, Corporate Headquarters: # CBN House, Tinubu Square, 213 Eleke Crescent-Victoria Island, Marina, Lagos, Nigeria, West Africa. P.O.Box 55037 Falomo Ikoyi Lagos Island Marina. YOUR IMMEDIATE PAYMENT Dear Sir/Madam, I know that this letter will hit you by surprise, but firstly I will like to introduce myself; I am (Prof. Charles Chukwuma Soludo) the rightful Governor of The Central Bank of Nigeria (CBN) and the Executive Chairman of "E.C.D.R". Sorry for the inconveniences that was rendered to you in your line of Inheritance Payment transaction with some Nigerian Officials some while ago, We apologies, for the delay of your payment and all the inconveniences and inflict that we might have indulge you through, it was due to the newly assigned President Of Nigeria President Umar' Musa Yaradua, However, we were having some minor problems with our payment system, which is inexplicable, and have held us stranded and indolent, not having the aspiration to devote our 100% assiduity in accrediting foreign contract payments.We apologies once again. During the auditing and closing of all financial records of the Central Bank of Nigeria (CBN) it was discovered from the records of outstanding Foreign contractors due for payment with the Federal Government of Nigeria in the year 2009 that your name and company is next on the list of those who Will receive their fund. On the 1st of October 2006 , the President of The Federal Republic of Nigeria (Chief Olusegun Obasanjo) introduced a Commission named the "E.C.D.R" (Executive Committee on Debt Recovery) which is duly registered under the United Nations (U.N.) and the Federal Government of Nigeria.This particular Commission was initiated to detect fraud/fund delays/interrupted funds Payments and to also Settle foreign debts/fraud victims/Un-paid beneficiaries to satisfactory in other to maintain peace in the world at large,Presently we are being paid by the American government in other to avert Scam and also to avert beneficiary funds delays here in Nigeria. I wish to officially notify you that your payment is being processed And will be released to you as soon as you respond to this letter. Also note that from the record in our file, your outstanding contract payment is USD $7.7 Million dollars (Seven million seven hundred thousand United States Dollars). Kindly re-confirm to me if this is inline with what you have in your record and also re-confirm the information below to enable this office proceed and finalize your fund remittance without further delays. 1) Your full name. 2) Phone, fax and mobile . 3) Company name, position and address. 4) Profession, age and marital status. 5) Working id/Int'l passport 6) Daytime telephone 7) Home Equity Line Of Credit Account(Yes Or No) 8) Home telephone I wish to inform you now that the square peg is now in square whole and can be voguish for that your payment is being processed and will be released to you as soon as you respond to this letter. As soon as the above information are received, your payment will be Made available to you via an international offshore payment bank in Canada, to your nominated bank account. Prof Charles Chukwuma Soludo, EXECUTIVE GOVERNOR, OF CENTRAL BANK OF NIGERIA (CBN) From garfieldjames0@gmail.com Thu Mar 5 03:40:43 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.6 required=5.0 tests=ADVANCE_FEE_1,BAYES_95, DEAR_FRIEND,DNS_FROM_RFC_POST,FREEMAIL_FROM,HTML_MESSAGE,J_CHICKENPOX_42, J_CHICKENPOX_43,J_CHICKENPOX_57,J_CHICKENPOX_63,J_CHICKENPOX_64, J_CHICKENPOX_74,J_CHICKENPOX_84,LOTTO_RANDOM,LOTTO_YOU_WON_02, LOTTO_YOU_WON_03,L_SOME_STD_PROBS,RAZOR2_CHECK,RCVD_BY_IP,SPF_PASS,STOX_30, UPPERCASE_75_100 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.0 RCVD_BY_IP Received by mail server with no name * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 0.5 LOTTO_RANDOM BODY: Random selection * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9735] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail-ew0-f164.google.com (mail-ew0-f164.google.com [209.85.219.164]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n25BecTu003946 for ; Thu, 5 Mar 2009 03:40:42 -0800 Received: by ewy8 with SMTP id 8so1654803ewy.13 for ; Thu, 05 Mar 2009 03:40:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=xYy14MqR9o07V4h+OaO6iuQ/FJQ41ZkASylanyyJ5SE=; b=QAFmVdwmwZML7RcWvT2JmKoJ7fcl41EN3wwANpi/03GkwBFfSf8uJEkn9pinjio1tn +rsP5z4LBIKZ9MZGVRQzFAI1IJFKCs1ubGHXQFtV0XI49pDeHt8Go+JamM0LePphTZ3+ sqFYXkHp9MWsgdx/VV3loT07uASF8lLVNAmU0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=Q8iug9LqBukVpcUkfo5Q/7L5p/vNCipgo0G67+FrymdLZXr5iXVh7ozdRxrh0KRj/p ROi2+oUyWQZt1PU+lO4uwuQs53IihRwBKfEAQgdrBCAh36J8cjCpnsn51lLbpZixcL2D 30W2WKu0Xc8fKW63+DZM6eBkRIdwUZueNRoSw= MIME-Version: 1.0 Received: by 10.216.30.81 with SMTP id j59mr530607wea.50.1236250035271; Thu, 05 Mar 2009 02:47:15 -0800 (PST) Date: Thu, 5 Mar 2009 02:47:15 -0800 Message-ID: Subject: [SPAM] Dear friend From: james garfield To: 71016.1644@compuserve.com, jmsatb5@aol.com Content-Type: multipart/alternative; boundary=0016e6dd89f534b96404645ce4a4 X-Greylist: Delayed for 00:53:20 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Mar 2009 03:40:43 -0800 (PST) X-Spam-Prev-Subject: Dear friend Status: R X-Status: X-Keywords: X-UID: 159 Content-Length: 4426 --0016e6dd89f534b96404645ce4a4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit OFFICE OF THE DIRECTOR GENERAL PETROLEUM MANAGEMENT COMMISSION CENTRAL BUSINESS DISTRICT,LAGOS LAGOS,NIGERIA C/O THE HEAD MANAGER P.M.C TO WHOM IT MAY CONCERN, SALES/AUCTIONS OF OIL(CRUDE) WELLS/RIGS HELLO, I'M THE HEAD MANAGER OF PETROLEUM MANAGEMENT COMMISSION,UNDER THE NIGERIAN PETROLEUM CORPORATION,I WRITE TO YOU TO LET YOU KNOW OF OUR SALES AND AUCTION OF OIL RIGS IN THE COUNTRY,THIS IS DUE TO THE ECONOMIC RECESSION TAKING PLACE AROUND THE WORLD.IT HAS BEEN REVEIWED THAT THE SALES OF THESE OIL WELLS/RIGS WILL HELP BOOST OUR ECONOMY SO AS TO AID IN DEVELOPMENT AND ALSO TO HELP BRING BUSINESS PARTNERS TO THE COUNTRY.I WILL ALSO LET YOU KNOW OF YOUR OWN BENEFITS IF YOU BUY AN OIL WELL,YOU WILL BECOME A LIFE LONG PARTNER OF THE PETROLEUM CORPORATION AND AFTER SOME YEARS YOU WILL START RECEIVEING DIVIDENDS FROM THE CORPORATION IF YUOUR OIL WELL IS USED FOR TRANSACTION OR REFINING OR MINING,ALSO YOU WILL BE LEGIBLE TO TAKE CHARGE OF ANY OF THE REFINERIES UNDER CONSTRUCTION.I WILL LET YOU KNOW HERE THAT YOU STAND A CHANCE OF BECOMING A MULTI-MILLIONIARE IN NO TIME.IF YOU HAVE INTEREST IN THIS YOU CAN WRITE BACK TO THE SAME EMAIL ADDRESS OR GIVE A CALL ON +(234)8055368918.YOU MAY ALSO WONDER HOW YOU WERE MAILED,YOU SEE THIS IS AN OPEN SALE SO IT IS OPEN TO ALL AND EMAILS WERE GOTTEN FROM A RANDOM SELECTION.PLEASE DO NOT BE OFFENDED,JUST WRITE BACK IF YOU ARE WILLING TO BUY. THANK YOU. YOURS SINCERELY, JAMES GARFIELD --0016e6dd89f534b96404645ce4a4 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0 OFFICE OF THE DIRECTOR GENERAL
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 PETROLEUM MANAGEMENT COMMI= SSION
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0 CENTRAL BUSINESS DISTRICT,LAGOS
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0 LAGOS,NIGERIA
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0
C/O THE HEAD MANAGER
P.M.C
=A0=A0= =A0
=A0=A0=A0 TO WHOM IT MAY CONCERN,

=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 SALES/AUCTIONS OF OIL(CRUDE) WELLS/RIGS <= /p>

=A0=A0=A0=A0 HELLO,
=A0=A0=A0=A0=A0=A0=A0=A0 I'M THE HEAD MANAGER= OF PETROLEUM MANAGEMENT COMMISSION,UNDER THE NIGERIAN PETROLEUM CORPORATIO= N,I WRITE TO YOU TO LET YOU KNOW OF OUR SALES AND AUCTION OF OIL RIGS IN TH= E COUNTRY,THIS IS DUE TO THE ECONOMIC RECESSION TAKING PLACE AROUND THE WORLD.IT HAS BEEN REVEIWED THAT THE SALES OF T= HESE OIL WELLS/RIGS WILL HELP BOOST OUR ECONOMY SO AS TO AID IN DEVELOPMENT= AND ALSO TO HELP BRING BUSINESS PARTNERS TO THE COUNTRY.I WILL ALSO LET YO= U KNOW OF YOUR OWN BENEFITS IF YOU BUY AN OIL WELL,YOU WILL BECOME A LIFE L= ONG PARTNER OF THE PETROLEUM CORPORATION AND AFTER SOME YEARS YOU WILL STAR= T RECEIVEING DIVIDENDS FROM THE CORPORATION IF YUOUR OIL WELL IS USED FOR T= RANSACTION OR REFINING OR MINING,ALSO YOU WILL BE LEGIBLE TO TAKE CHARGE OF= ANY OF THE REFINERIES UNDER CONSTRUCTION.I WILL LET YOU KNOW HERE THAT YOU= STAND A CHANCE OF BECOMING A MULTI-MILLIONIARE IN NO TIME.IF YOU HAVE INTE= REST IN THIS YOU CAN WRITE BACK TO THE SAME EMAIL ADDRESS OR GIVE A CALL ON= +(234)8055368918.YOU MAY ALSO WONDER HOW YOU WERE MAILED,YOU SEE THIS IS A= N OPEN SALE SO IT IS OPEN TO ALL AND EMAILS WERE GOTTEN FROM A RANDOM SELEC= TION.PLEASE DO NOT BE OFFENDED,JUST WRITE BACK IF YOU ARE WILLING TO BUY. THANK YOU.
YOURS SINCERELY,
JAMES GARFIELD


=A0

--0016e6dd89f534b96404645ce4a4-- From mryan2@eastlink.ca Thu Mar 5 05:01:01 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********** X-Spam-Status: Yes, score=10.3 required=5.0 tests=BAYES_60,BL_COUNTRY_NG_2, DNS_FROM_RFC_ABUSE,FORGED_RCVD_HELO,L_SOME_STD_PROBS,NO_REAL_NAME, RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,SPF_PASS,SUBJ_ALL_CAPS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.6789] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mta03.eastlink.ca (smtpout.eastlink.ca [24.222.0.30]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n25D0wIB006027 for ; Thu, 5 Mar 2009 05:01:01 -0800 Received: from ip02.eastlink.ca ([24.222.39.20]) by mta03.eastlink.ca (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KG100MPK9ERXK70@mta03.eastlink.ca> for jhardin@impsec.org; Thu, 05 Mar 2009 08:30:27 -0400 (AST) Received: from smtpout.eastlink.ca (HELO eastlink.ca) ([24.222.0.30]) by ip02.eastlink.ca with ESMTP; Thu, 05 Mar 2009 08:30:25 -0400 Received: from [10.10.10.62] (Forwarded-For: [80.255.59.242]) by ms1.eastlink.ca (mshttpd); Thu, 05 Mar 2009 04:30:25 -0800 Date: Thu, 05 Mar 2009 04:30:25 -0800 From: mryan2@eastlink.ca Subject: [SPAM] YOU ....HAVE....WON Bcc: Message-id: MIME-version: 1.0 X-Mailer: Sun Java(tm) System Messenger Express 6.2-4.03 (built Sep 22 2005) Content-type: text/plain; charset=us-ascii Content-language: en Content-transfer-encoding: 7BIT Content-disposition: inline X-Accept-Language: en Priority: normal X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Aup0AJdUr0kY3gAe/2dsb2JhbAASgRclixgIhjcmFx+BVhOeA6RrhAgG X-IronPort-AV: E=Sophos;i="4.38,307,1233547200"; d="scan'208";a="439903682" X-Greylist: Delayed for 00:30:04 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Mar 2009 05:01:01 -0800 (PST) X-Spam-Prev-Subject: YOU ....HAVE....WON Status: R X-Status: X-Keywords: X-UID: 160 Claimed as winner of 516,778:00 GBP Contact, Mr Clarke Davis via email: webdraws88@hotmail.co.uk Kindly fill the form below Your full names: Age: Sex: Country: Best Regards Pauline Ryan From drfredazu@zhervel.com Thu Mar 5 06:16:13 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************************************** X-Spam-Status: Yes, score=42.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_SOMETHING,DNS_FROM_RFC_BOGUSMX, FREEMAIL_FROM,J_CHICKENPOX_43,J_CHICKENPOX_73,J_CHICKENPOX_84, L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,NA_DOLLARS,NO_REAL_NAME,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_LWOILCO,STOX_30,SUBJ_ALL_CAPS, TO_CC_NONE,UPPERCASE_75_100,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 1.1 SARE_LWOILCO BODY: SARE_LWOILCO * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 52] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 52] * 1.9 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.27.29.103 listed in b.barracudacentral.org] * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.zhervel.com ([64.27.29.103]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n25EG9ti008451 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 5 Mar 2009 06:16:13 -0800 Received: from localhost ([127.0.0.1]) by mail.zhervel.com (IceWarp 9.2.1) with SMTP id MQO98545; Thu, 05 Mar 2009 05:35:45 -0800 Date: Thu, 05 Mar 2009 05:35:27 -0800 From: drfredazu9@yahoo.com.hk Reply-To: drfredazu9@yahoo.com.hk Subject: [SPAM] FROM DR FRED AZU Message-ID: <583bd859275d5e3b5dec694c77c7bba3@zhervel.com> X-Mailer: IceWarp Web Mail 5.6.7 X-Originating-IP: 216.250.221.147 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 00:25:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Mar 2009 06:16:13 -0800 (PST) X-Spam-Prev-Subject: FROM DR FRED AZU Status: R X-Status: X-Keywords: X-UID: 161 Content-Length: 2939 DEAR SIR I AM DR FRED AZU, AN ACCOUNTANT WITH BEAGON OIL NIGERIA LTD, A FOREIGN OIL COMPANY BASED IN BONNY - RIVERS STATE OF NIGERIA, THE HOME OF BUNNY LIGHT CRUDE OIL. WE ALSO MAINTAINED A LIASON OFFICE IN LAGOS NIGERIA. BEAGON OIL WAS INVOLVED IN PROSPECTING, DRILLING AND BUNKERING OF OIL AT HIGH SEA (OFFSHORE) WITH EXPATRIATE CONSISTING MAJORITY OF THE STAFF STRENGTH.UNFORTUNATELY,THESE EXPATRIATES GOT INTO AN ILLEGAL SALE OF OIL AND THE MONEY FROM IT TRANSFERRED THROUGH A SECURITY COMPANY OUT OF THE COUNTRY BUT WITH A SECURITY STAMP ON IT AND AFTER SOME TIME THE FEDERAL GOVERNMENT OF NIGERIA DISCOVERED THE ILLEGAL DEAL,AND REVOKED THEIR LICENCE AND THE EXPARTRIATES WERE REPATRIATED. BY VIRTUE OF MY POSITION AS THE ACCOUNTANT OF THE BEAGON OIL COMPANY, I HAVE IN MY POSSESSION ALL DOCUMENTS CONTAINING ALL INFORMATION ABOUT ONE OF THOSE TRUNK BOXES DEPOSITED WITH THE SECURITY COMPANY.THE CONTENT OF THE BOX IS THIRTY-FIVE MILLION,UNITED STATES DOLLARS (US$35M). I HAVE PUT IN AN APPLICATION WITH THE SECURITY COMPANY TO TRANSFER THIS ONE BOX TO THEIR CORRESPONDENCE OFFICE IN AMERICA, ASIA OR EUROPE WHICH THEY HAVE OBLIGED. AND BEING THAT THIS DEAL WAS CARRIED OUT BY A FOREIGN FIRM, I NEED A TRUST WORTHY FOREIGNER LIKE YOU THAT WILL CLAIM THIS BOX FROM THE SECURITY COMPANY OFFICE ABROAD AND ASSIST US TO A LOGICAL CONCLUSION OF THIS PENDING BUSINESS WHICH I BELEIVE THAT IF YOU ASSIST US TO CLAIM THE BOX, THAT BOTH OF US ARE BOUND TO BENEFIT FROM THE TRANSACTION. RIGHT NOW ALL I NEED FROM YOU IS TO STAND BEFORE THE SECURITY COMPANY AND SIGN AS ONE OF THE EXPATRIATES TO ENABLE YOU CLAIM THE MONEY AND PAY IT INTO YOUR BANKACCOUNT AFTER YOU MUST HAVE CLAIMED THE BOX (MONEY) OUT OF THE SECURITY COMAPNY. PLEASE, NOTE THAT THIS TRANSACTION IS 100% RISK-FREE AND THERE IS NO HARM OR SCAM INVOLVED, FOR EVERY MACHINERIES HAVE BEEN PUT IN PLACE FOR SUCCESSFUL AND SMOOTH CONCLUSION OF THIS MUTUAL BENEFIT TRANSACTION.AND PLEASE REMEMBER,THAT I HAVE WITH ME ALL THE NECESSARY AND VITAL DOCUMENTS THAT WILL PROVE THAT THE MONEY BELONG TO US. I EXPECT YOU TO BE TRUSTWORTHY AND KIND ENOUGH TO KEEP MY OWN SHARE OF THE MONEY WHEN THE MONEY FINALLY GETS INTO YOUR ACCOUNT. WE HEREBY AGREE TO COMPENSATE YOUR SINCERE AND CANDID EFFORT IN THIS REGARD WITH 30% OF THE FUNDS AFTER THE TRANSFER AND 10%(PERCENT) WILL BE SET ASIDE FOR ANY EXPENSES BOTH LOCAL AND INTERNATIONAL LIKE; TRANSPORTATION, TELEPHONE BILLS, ETC. WILL BE SETTLED FROM THIS PERCENTAGE, WHILE 60% WILL BE FOR ME AND TWO OF MY COLLEAGUES. NOTE THAT THIS DEAL WILL BE CONCLUDED WITHIN SEVEN (7) WORKING DAYS WITH YOUR FULL SUPPORT. I WILL BE LOOKING FORWARD TO DOING BUSINESS WITH YOU, AND SOLICIT YOUR CONFIDENTIALITY IN THIS TRANSACTION. ACKNOWLEDGE THE RECEIPT OF THIS PROPOSAL IMMEDIATELY, PLEASE SEND US YOUR FULL ADDRESS, PRIVATE TELEPHONE NUMBER OR CELL PHONE, FAX NUMBER FOR EASIER COMMUNICATION IN THIS TRANSACTION. YOURS FAITHFULLY. DR FRED AZU From charitywork@walla.com Thu Mar 5 10:46:53 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_BR_1,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_24,J_CHICKENPOX_37,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01, SARE_FRAUD_X3,SARE_FREE_WEBM_COMWALL,SPAMMY_WEBMAIL,SPF_FAIL,SPF_HELO_PASS, UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 1.7 SARE_FREE_WEBM_COMWALL Maybe spammer with free email * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 1.1 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=charitywork%40walla.com&ip=200.241.255.65&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 J_CHICKENPOX_24 BODY: 2alpha-pock-4alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from interconect.com.br (intercon.interconect.com.br [200.241.255.65]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n25IklPu015459 for ; Thu, 5 Mar 2009 10:46:52 -0800 Received: (qmail 28187 invoked by uid 502); 5 Mar 2009 18:23:32 -0000 Received: from 127.0.0.1 by intercon.interconect.com.br (envelope-from , uid 92) with qmail-scanner-2.02st (clamdscan: 0.94.2/8746. spamassassin: 3.2.5. perlscan: 2.02st. Clear:RC:1(127.0.0.1):SA:0(4.5/5.0):. Processed in 1.237782 secs); 05 Mar 2009 18:23:32 -0000 Received: from unknown (HELO webmail.nautilus.com.br) (127.0.0.1) by localhost with SMTP; 5 Mar 2009 18:23:31 -0000 MIME-Version: 1.0 Date: Thu, 05 Mar 2009 15:23:30 -0300 From: Mrs Maria Bejes To: undisclosed-recipients:; Subject: [SPAM] Work For You.Read Reply-To: bejesbejes54@aim.com Message-ID: X-Sender: charitywork@walla.com User-Agent: Webmail Nautilus RC-0.2 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="UTF-8" X-Greylist: Delayed for 00:21:50 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Mar 2009 10:46:52 -0800 (PST) X-Spam-Prev-Subject: Work For You.Read Status: R X-Status: X-Keywords: X-UID: 162 Content-Length: 2763 Dear Beloved, How are you.I hope this email will meet you good heaith My name is Mrs. Maria Bejes I am a dying woman who has decided to donate what I have to charities through you. You may be wondering why I chose you.But someone has to be chosen. I am 59 years old and was diagnosed forcancer about 2 years ago, after the death of my husband who had left me everything he worked for. I have been touched by the Lord to donate from what I have inherited from my late husband to charity through you for the good work of humanity, rather than allow my relatives to use my husband's hard earned funds inappropriately. I have asked the Lord to forgive me all my sins and I believe he has,because He is merciful. I will be going in for an operation, and I pray that I survive the operation. I have decided to Will/Donate the sum of 10,300,000.00 (Ten Million three hundred thousand Dollars) to charities through you for the good work of the Lord, and to help the motherless,lessprivileged and also for the assistance of the widows. Presently, I have informed my consultant about my decision in willing this fund to charity through you. I wish you all the best and may the good Lord bless you abundantly, and please use the funds well and always extend the good work to others. If you are interested in carrying out this task, I will inform my consultant, so that he can arrange the release of the funds to you. I know I have never met you but my mind tells me to do this, and I hope you act sincerely. I decided that 30% of this money should be taken by you from the total sum upon the success release of this fund, because I am now too weak and fragile to do things myself because of my cancer.Presently, I,m in a hospital where I have been undergoing treatment for oesophageal cancerI have since lost my ability to talk.   NB:This money has been packed into one box and the consignments"box" were tagged Diplomatic Luggage.You will be given the right to verify this directly with the Finance Security Bank company were the TruckBox is presently deposited. i want you  to help me carry out the charity work to the motherless,lessprivileged and also for the assistance of the widows in the World. I will appreciate your utmost confidentiality in this matter until the task is accomplished, as I don't want anything that will jeopardize my last wish, due to the fact that I do not want relatives or family members standing in the way of my last wish. If you ready to carry on this task reply to: email address:bejesbejesn@aim.com God bless you and your family. Mrs.Maria Bejes PLEASE INCLUDE YOUR FULL NAME, ADDRESS, TELEPHONE/FAX NUMBER ON YOUR REPLY FOR EASY AND IMMEDIATE COMMUNICATION WITH MY CONSULTANT.Reply me via this email address:bejesbejesn@aim.com From root@ns1.netspring.pt Thu Mar 5 11:19:32 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=19.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DATE_IN_PAST_48_96,FREEMAIL_FROM,FREEMAIL_REPLYTO,L_MANY_STD_PROBS, NO_REAL_NAME,RBL_PSBL_01,RCVD_IN_BRBL,SUB_HELLO,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.4 DATE_IN_PAST_48_96 Date: is 48 to 96 hours before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [82.102.12.161 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [82.102.12.161 listed in psbl.surriel.com] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 L_MANY_STD_PROBS Three or more standards-compliance problems Received: from ns1.netspring.pt ([82.102.12.161]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n25JJPpV016595 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Thu, 5 Mar 2009 11:19:31 -0800 Received: (qmail 32646 invoked by uid 48); 2 Mar 2009 21:29:55 +0000 Date: 2 Mar 2009 21:29:55 +0000 Message-ID: <20090302212955.32645.qmail@ns1.netspring.pt> To: jhardin@impsec.org Subject: [SPAM] Hello, From: Reply-To: billalex00@yahoo.com.hk MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 40:36:52 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Mar 2009 11:19:32 -0800 (PST) X-Spam-Prev-Subject: Hello, Status: R X-Status: X-Keywords: X-UID: 163 Hello, This is to inform you that your funds of US$7.5 Million have been converted into a Bank Draft and will be deliver to you through the service of the Courier Agency. You are hereby advised to forward these details to this office below: (1) Your Full Names: (2) Complete Address with Zip Code: (3) Direct Telephone Number for easy access of communication. (4) Date of Birth (Day/Month/Year) (5) Occupation The Bank Draft will be deliver you within a maximum of 48 hours on receiving the requested details. Please reply your mail to this email address: billalex00@yahoo.com.hk Regards, Mr. Bill Alex From centralbkn000@o2.pl Thu Mar 5 20:40:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************** X-Spam-Status: Yes, score=50.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,BL_COUNTRY_TW_1, BL_COUNTRY_TW_2,DNS_FROM_RFC_POST,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,JM_SOUGHT_FRAUD_3,MILLIONS_01,MILLION_USD,NA_DOLLARS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_FAIL,STOX_30,SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS, UNDISC_RECIPS,UPPERCASE_75_100 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.1 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=centralbkn000%40o2.pl&ip=59.120.91.111&receiver=ga.impsec.org] * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [59.120.91.111 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.72 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.72 listed in psbl.surriel.com] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.72 listed in zen.spamhaus.org] * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [59.120.91.111 listed in tw.countries.nerd.dk] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.72 listed in dnsbl.sorbs.net] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from dns.tongx.com.tw (dns.tongx.com.tw [59.120.91.111] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n264e69Z031272 for ; Thu, 5 Mar 2009 20:40:11 -0800 Received: from User (unknown [196.3.183.72]) by dns.tongx.com.tw (Postfix) with ESMTP id F23E349B663; Fri, 6 Mar 2009 03:13:11 +0800 (CST) Reply-To: From: "DR VICTOR MARTINS" Subject: [SPAM] RE:INHERITANCE FUND TRANSFER NOTIFICATION Date: Thu, 5 Mar 2009 11:37:47 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-Antivirus: avast! (VPS 090305-0, 03/05/2009), Outbound message X-Antivirus-Status: Clean Message-Id: <20090305191311.F23E349B663@dns.tongx.com.tw> To: undisclosed-recipients:; X-Greylist: Delayed for 09:01:31 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 05 Mar 2009 20:40:11 -0800 (PST) X-Spam-Prev-Subject: RE:INHERITANCE FUND TRANSFER NOTIFICATION Status: R X-Status: X-Keywords: X-UID: 164 Content-Length: 3392 CENTRAL BANK OF NIGERIA PHASE II, GARKIFEDERAL CAPITAL TERRETORY ABUJA-NIGERIA REF: CBN-0XX2/987 E-MAIL:centralbkn000@o2.pl TEL: +234-83-487669 ATTN: BENEFICIARY RE:INHERITANCE FUND TRANSFER NOTIFICATION WE HAVE RECEIVED AN INSTRUCTION FROM THE OFFICE OF THE PRESIDENCY, THE FEDERAL MINISTRY OF FINANCE (FMF), AND THE SENATE COMMITTEE ON FOREIGN PAYMENTS (SCFP), TO PAY YOU YOUR CONTRACT/INHERITANCE FUND FROM OUR BANK (CENTRAL BANK OF NIGERIA) IN CONJUNCTION WITH THE HSBC BANK LONDON. THIS IS TO NOTIFY YOU THAT YOUR FUND WHICH IS THE TOTAL SUM OF TEN MILLION FIVE HUNDRED THOUSAND DOLLARS (US$10, 500,000.00), AS YOUR CONTRACT/INHERITANCE FUND HAVE BEEN PROGRAMMED FOR IMMEDIATE PAYMENT TO YOU. AND YOUR INHERITANCE FUND PAYMENT HAS BEEN FINALIZED TO BE RELEASED TO YOU AS THE LEGITIMATE BENEFICIARY OF THE FUND, VIA HSBC ATM DEBIT CARD. MEANWHILE, WE WANT YOU TO CLARIFY IF YOU INDEED APPROVE A WOMAN FEW DAYS AGO TO CLAIM YOUR FUND ON YOUR BEHALF, WHO NOW CLAIM THAT SHE IS YOUR REPRESENTATIVE SENT BY YOU TO RECEIVE YOUR FUND. NOTE THAT SHE ACTUALLY TENDERED SOME VITAL DOCUMENT, WHICH PROVED THAT YOU ACTUALLY SENT HER FOR THE COLLECTION OF THESE FUNDS. BELOW IS THE LIST OF THE DOUCMENTS WHICH SHE TENDERED TO BANK: 1. LETTER OF ADMINISTRATION. 2. HIGH COURT INJUNCTION. 3. ORDER TO RELEASE. DUE TO THE NATURE OF MY JOB, I CANNOT AFFORD TO MAKE ANY MISTAKE IN RELEASING THESE FUNDS TO ANYONE EXCEPT YOU WHO IS THE RECOGNIZED TRUE BENEFICIARY TO THESE FUNDS. NOTE THAT I ASKED HER TO COME BACK NEXT WEEK SO I CAN VERIFY THIS FACT FROM YOU FIRST. KINDLY CLARIFY US ON THIS ISSUE BEFORE WE MAKE THIS PAYMENT TO HER WHOM CAME ON YOUR BEHALF. HOWEVER, NOTE THAT WE ARE WAITING TO HEAR FROM YOU SHORTLY, AS YOU PROVIDE THE REQUIRED INFORMATION BELLOW TO ENABLE OUR ATM PROCESSING DEPARTMENT TO ISSUE YOUR ATM CARD TO YOU SO THAT YOU WILL BE ABLE TO CASH YOUR TEN MILLION FIVE HUNDRED THOUSAND UNITED STATES DOLLARS FROM ANY ATM MARCHINE AT ANY WHERE IN THE WORLD. THE REQUIRED INFORMATION IS AS STATED BELOW: 1.YOUR NAME: 2.YOUR ADDRESS: 3.YOUR TELEPHONE: 4.FAX: 5.AGE: 6.SEX: 7.YOUR OCCUPATION: NOTE THAT THIS ATM CARD WILL BE SENT TO YOU THROUGH THE COURIER SUCH AS FEDEX, UPS OR ANY COUIRER COMPANY OF YOUR CHOICE FOR THE DELIVERY OF YOUR ATM CARD TO YOU FOR YOUR EASY CASHING OF YOUR CONTRACT SUM OF US$10, 500,000.00. FROM THE OFFICE OF THE PRESIDENCY, THIS REPUTABLE BANK HAS BEEN APPROVED IN CONJUNCTION WITH THE HSBC BANK LONDON, THEY HAS BEEN ACCREDITED TO HANDLE AND MAKE PAYMENT TO ALL FOREIGN CONTRACT/INHERITANCE FUNDS BENEFICIARIES THIS SECOND QUARTER PAYMENT OF THE YEAR 2008/2009. THEREFORE, WE WAIT TO HEAR FROM YOU SOON. WE ARE WAITNG TO HERE FROM YOU AS SOON AS POSSIBLE. BEST REGARDS, DR VICTOR MARTINS DIRECTOR, ATM PAYMENT DEPARTMENT CENTRAL BANK OF NIGERIA (CBN) From www.fbi911@live.com Fri Mar 6 06:03:27 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************************** X-Spam-Status: Yes, score=44.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,BL_COUNTRY_TW_2, DATE_IN_PAST_03_06,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_3,LOTTO_YOU_WON_03,MILLIONS_01,MILLION_USD, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3, SARE_FRAUD_X4,SPF_SOFTFAIL,STOX_30,SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS, UNDISC_RECIPS,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=www.fbi911%40live.com&ip=59.120.91.111&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.5 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 51] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 51] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [59.120.91.111 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.73 listed in dnsbl.sorbs.net] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from dns.tongx.com.tw (dns.tongx.com.tw [59.120.91.111] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n26E3J3Y013484 for ; Fri, 6 Mar 2009 06:03:25 -0800 Received: from User (unknown [196.3.183.73]) by dns.tongx.com.tw (Postfix) with ESMTP id E549D499DA8; Fri, 6 Mar 2009 09:29:04 +0800 (CST) Reply-To: From: "Robert S. Mueller III" Subject: [SPAM] RE: FEDERAL BUREAU OF INVESTIGATION Date: Fri, 6 Mar 2009 02:53:13 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-Antivirus: avast! (VPS 090305-1, 03/05/2009), Outbound message X-Antivirus-Status: Clean Message-Id: <20090306012904.E549D499DA8@dns.tongx.com.tw> To: undisclosed-recipients:; X-Greylist: Delayed for 11:58:00 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 06 Mar 2009 06:03:27 -0800 (PST) X-Spam-Prev-Subject: RE: FEDERAL BUREAU OF INVESTIGATION Status: R X-Status: X-Keywords: X-UID: 165 Content-Length: 5400 Federal Bureau of Investigation J. Edgar Hoover Building 935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001, USA Phone Number: 6022795511 RE: FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP THE INTERNET. We the Federal bureau of investigation (FBI) Washington, DC in conjunction with some other relevant Investigation Agencies here in the United states of America have recently been informed through our Global intelligence monitoring network that you presently have transaction going on with of Bank of Africa (CBN) as regards to your over-due contract payment which was fully enclosed in your favor accordingly. It might interest you to know that we have taken out time in screening through this project as stipulated on our protocol of operation and have finally confirmed that your contract payment is 100% genuine and hitch free from all fact and of which you have the lawful right to claim your fund without any further delay. Having said all this, we will further advise that you go ahead in dealing with the Central Bank of Nigeria office accordingly, as we will be monitoring all their services with you as well as your correspondence at all level. In addendum, also be informed that we recently had a meeting with the Executive Director of the Central Bank of Nigeria, in the person of Dr. Charles Brown along with some of the top officials of the Ministry regarding your case and they made us to understand that your file has been held in abase depending on when you personally come for the claim. They also told us that the only problem they are facing right now is that some unscrupulous element are using this project as an avenue to scam innocent people off their hard earned money by impersonating the Executive Governor and the Central Bank office. We were also made to understand that a lady with name Mrs. Joan C.Bailey from OHIO has already contacted them and also presented to them all the necessary documentations evidencing your claim purported to have been signed personally by you prior to the release of your contract fund valued at about (US$10, 500,000.00), Ten Million Five Hundred United States Dollars. but the Central Bank of Nigeria did the wise thing by insisting on hearing from you personally before the go ahead on wiring your fund to the Bank informations which was forwarded to them by the above named Lady so that was the main reason why they contacted us so as to assist them in making the investigations. They further informed us that we should warn our dear citizens who must have been informed of the contract payment which was awarded to them from the Central Bank of Nigeria, to be very careful prior to this irregularities so that they don't fall victim to this ugly circumstance. And should in case you are already dealing with anybody or office claiming to be from the Central Bank of Nigeria, you are further advised to STOP further contact with them in your best interest and then contact immediately the real office of the Central Bank of Nigeria (CBN) only with the below informations accordingly: NAME: Dr. Charles Brown OFFICE ADDRESS: Central Bank of Nigeria. Paymaster General, International operations Central Bank Headquarters, Tinubu Square, Lagos TEL: +234 702 986 5890 EMAIL: drbrown_atmpaymentcentbank@yahoo.co.uk NOTE: In your best interest, any message that doesn't come from the above official email address and phone numbers should not be replied to and should be disregarded accordingly for security reasons. Meanwhile, we will advise that you contact the Central Bank of Nigeria office immediately with the above email address and request that they attend to your payment file as directed so as to enable you receive your contract fund accordingly. Ensure you follow all their procedure as may be required by them as that will further help hasten up the whole procedures as regards to the transfer of your fund to you as designated. Also have in mind that the Central Bank of Nigeria equally has their own protocol of operation as stipulated on there banking terms, so delay could be very dangerous. Once again, we will advise that you contact them with the above email address and make sure you forward to them all the necessary informations which they may require from you prior to the release of your fund to you accordingly. All modalities has already been worked out even before you were contacted and note that we will be monitoring all your dealings with them as you proceed so you don't have anything to worry about. All we require from you henceforth is an update so as to enable us be on track with you and the Central Bank of Nigeria. Without wasting much time, will want you to contact them immediately with the above email address so as to enable them attend to your case accordingly without any further delay as time is already running out. Should in case you need any more informations in regards to this notification, feel free to get back to us so that we can brief you more as we are here to guide you during and after this project has been completely perfected and you have received your contract fund as stated. Thank you very much for your co-operation in advance as we earnestly await your urgent response to this matter. Best Regards, Robert S. Mueller III Federal Bureau of Investigation Phone Number: 6022795511 Email: www.fbi911@live.com From cynthiagodsona@katamail.com Fri Mar 6 09:54:43 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=17.0 required=5.0 tests=BAYES_99,BL_COUNTRY_IT_1, DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_RCVD_HELO,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_30_40,HTML_MESSAGE,J_CHICKENPOX_44,J_CHICKENPOX_74, L_SOME_STD_PROBS,MIME_HTML_ONLY,NO_REAL_NAME,URI_ONLY_ARGS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 0.5 BL_COUNTRY_IT_1 Mail client in Italy * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 1.0 URI_ONLY_ARGS URI: URI contains only CGI arguments * 0.4 HTML_30_40 BODY: Message is 30% to 40% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9997] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp1.aruba.it (smtp.katamail.com [62.149.157.154]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n26Hsb0X019683 for ; Fri, 6 Mar 2009 09:54:41 -0800 Received: (qmail 25171 invoked by uid 89); 6 Mar 2009 17:27:51 -0000 Received: from unknown (HELO localhost) (10.10.176.105) by smtp1-pc with SMTP; 6 Mar 2009 17:27:51 -0000 MIME-Version: 1.0 X-Mailer: AtMail PHP 5.1 Message-ID: <24190.1236360471@katamail.com> To: Reply-To: cynthiagodson@yahoo.com Content-Type: text/html; charset="utf-8" X-Origin: 41.214.126.231 Date: Fri, 6 Mar 2009 18:27:51 +0100 Subject: [SPAM] hi From: cynthiagodsona@katamail.com Content-Transfer-Encoding: quoted-printable X-Greylist: Delayed for 00:26:35 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 06 Mar 2009 09:54:41 -0800 (PST) X-Spam-Prev-Subject: hi Status: R X-Status: X-Keywords: X-UID: 166
Hello,
     Hope you are doing just fine over there.My name is= Cynthia. I just want to let you know that l came accross your profile and = your e-mail adderss from. after going through it l found you intresting,hop= e you don't mind.
     If you are intrested in knowing more about me and = for me to send you my picture,just feel free to contact me at my private ma= il addresse at(Cynthiagodson@yahoo.com)
     Hope to hear from you soon,have a nice day and sta= y blessed.
            &nb= sp;            =     Cynthia,

Nuova grafica e nuove funzionalit=C3=A0! Crea subito Gratis la tua= nuova Casella di Posta Katamail From shawn.philip@hotmail.com Fri Mar 6 21:21:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.9 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_CN_2,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FILL_THIS_FORM_01, FORGED_HOTMAIL_RCVD2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL,RCVD_IN_SBL, SPF_SOFTFAIL,SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=shawn.philip%40hotmail.com&ip=59.41.8.48&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.2 FORGED_HOTMAIL_RCVD2 hotmail.com 'From' address, but no 'Received:' * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [59.41.8.48 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [92.40.36.136 listed in zen.spamhaus.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [59.41.8.48 listed in psbl.surriel.com] * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.gz2010ag.org ([59.41.8.48]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n275L0Tl006100 for ; Fri, 6 Mar 2009 21:21:06 -0800 Received: from User (92.40.36.136.sub.mbb.three.co.uk [92.40.36.136]) by mail.gz2010ag.org (Postfix) with ESMTP id 6D3821B9FFA; Wed, 4 Mar 2009 15:12:10 +0800 (CST) Reply-To: From: "Mr Karen Lindsey" Subject: [SPAM] CONTACT US AS SOON AS POSSIBLE. CONGRATULATION. Date: Wed, 4 Mar 2009 07:49:51 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090304071216.6D3821B9FFA@mail.gz2010ag.org> To: undisclosed-recipients:; X-Greylist: Delayed for 29:07:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 06 Mar 2009 21:21:06 -0800 (PST) X-Spam-Prev-Subject: CONTACT US AS SOON AS POSSIBLE. CONGRATULATION. Status: R X-Status: X-Keywords: X-UID: 167 Attn Lucky Winner, We are pleased to inform you that you have emerged a winner in the annual draw of our Global Lottery Promotions, UK. You are therefore to receive a cash prize of 2,500,000.00. (Two Million Five Hundred Thousand Pounds Sterling) from the total payout CONGRATULATIONS!!!. You are hereby requested to contact your claims process agent and immediately update your claims process for your payment. Contact: Mr. Mr Shawn Philip. Tel :+447529361324 Fax :+448703121132 Email:mr.shawn.philip@googlemail.com You are advised to provide the following information: 1. Name in full 2. Address 3. Nationality 4. Age 5. Gender 6. Occupation 7. Phone/Fax Yours Faithfully, Karen Lindsey Lottery Coordinator From JMStrouse@racc.edu Mon Mar 9 05:30:05 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n29CU4BB016912 for ; Mon, 9 Mar 2009 05:30:04 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********* X-Spam-Status: Yes, score=9.7 required=5.0 tests=ADVANCE_FEE_1,BAYES_60, FORGED_RCVD_HELO,HTML_MESSAGE,J_CHICKENPOX_21,J_CHICKENPOX_31,J_CHICKENPOX_41, J_CHICKENPOX_45,L_SOME_STD_PROBS,SARE_SUB_GOOD_DAY,SPAMMY_HEADER_11, SPAMMY_HEADER_12,THOUS_EMAIL_ADDRS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.2 SPAMMY_HEADER_12 Found a Content-Class header * 0.3 SPAMMY_HEADER_11 Found a Thread-Index header * 0.7 SARE_SUB_GOOD_DAY Contains spammer phrasing Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Mon, 09 Mar 2009 05:30:04 -0700 (PDT) * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.6538] * 0.0 HTML_MESSAGE BODY: HTML included in message * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from rsrv.racc.edu (66.216.141.70.static.dejazzd.com [66.216.141.70]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n29CSLaU030703 for ; Mon, 9 Mar 2009 05:28:25 -0700 Received: from mailsrv2.racc.edu ([10.1.3.46]) by rsrv.racc.edu with Microsoft SMTPSVC(6.0.3790.3959); Sun, 8 Mar 2009 20:45:25 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre6 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C9A047.007E7FDA" Subject: [SPAM] Good Day, Date: Sun, 8 Mar 2009 19:38:36 -0400 Message-ID: <89164F7655F05D47A75868A35C37694B01AEB71B@mailsrv2.racc.edu> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Good Day, Thread-Index: AcmgRv8u7/6LGnr7SiGagFN3L+MBgw== From: "Joy M. Strouse" Bcc: X-OriginalArrivalTime: 09 Mar 2009 00:45:25.0686 (UTC) FILETIME=[55F72D60:01C9A050] X-Greylist: Delayed for 01:10:33 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 09 Mar 2009 05:28:31 -0700 (PDT) X-Spam-Prev-Subject: Good Day, Status: R X-Status: X-Keywords: X-UID: 168 Content-Length: 4282 This is a multi-part message in MIME format. ------_=_NextPart_001_01C9A047.007E7FDA Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Good Day,=20 =20 This message is directed to you for the purpose of a transaction that is = worth US$48,300,000.This transaction is completely legitimate and all = legal documents will be provided which will cover you and the funds during the course of = this transaction. I am Eric Elliot by name and i am presently in the Italy precisely = because of this transaction.If you are interested in this transaction,i = will advise yousend me an email or place a call to me: Find below my = contact information: =20 Name: Mr. Eric Elliot Tel: +39 327 568 3543 Email: eric_elliot@jewectaylor.com =20 The reason for these details to be released to me is for me to be sure i = am not corresponding with the wrong person.Note that you are been = contacted because of your family name and as such,i must be very sure = someoneelse is not playing a fast one on either of us. If you would like to discuss further about this transaction that is in = your family name as an inheritance that you will benefit from,email me = back only on this email address : eric_elliot@jewectaylor.com Note: Do not respond to this email address you received this message = from because my server has a problem to send mails and so,i send you = with my relative's email.Endeavour to respond only to the email address = stated above. Your response will be highly appreciated at this point because this = money has been delayed for too long and i would like to finalize the = transaction as soon as possible so that i can go ahead with my other = client's issues i have at stake. Provide me with the following information: =20 Full Names: Tel: Occupation: Age:I will send you more information about this proposal. =20 Best Regards. Eric Elliot. +39 327 568 3543 ------_=_NextPart_001_01C9A047.007E7FDA Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =0A= =0A= =0A= =0A=
Good Day, =
 
This message is directed to you for the purpose of a = transaction that is worth US$48,300,000.This transaction is completely = legitimate and all legal documents
will be provided which will cover = you and the funds during the course of this transaction.
I am Eric = Elliot by name and i am presently in the Italy precisely because of this = transaction.If you are interested in this transaction,i will advise = yousend me an email or place a call to me: Find below my contact = information:
 
Name: Mr. Eric Elliot
Tel: +39 327 568 = 3543
Email: eric_elliot@jewectaylor.com
 
The reason for these details to be released to me is for = me to be sure i am not corresponding with the wrong person.Note that you = are been contacted because of your family name and as such,i must be = very sure someoneelse is not playing a fast one on either of us.
If = you would like to discuss further about this transaction that is in your = family name as an inheritance that you will benefit from,email me back = only on this email address : eric_elliot@jewectaylor.com
Note: Do not respond to this email address you received this = message from because my server has a problem to send mails and so,i send = you with my relative's email.Endeavour to respond only to the email = address stated above.
Your response will be highly appreciated at = this point because this money has been delayed for too long and i would = like to finalize the transaction as soon as possible so that i can go = ahead with my other client's issues i have at stake.
Provide me with = the following information:
 
Full = Names:
Tel:
Occupation:
Age:I will send you more information = about this proposal.
 
Best Regards.
Eric Elliot.
+39 = 327 568 3543
------_=_NextPart_001_01C9A047.007E7FDA-- From johnfredrick_chamber20@yahoo.co.uk Sun Mar 8 16:35:29 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.3 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,FROM_HAS_ULINE_NUMS,JM_SOUGHT_FRAUD_3,LOTTO_YOU_WON_03, MILLIONS_01,MILLION_USD,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,TO_CC_NONE, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.3 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mout2.freenet.de (mout2.freenet.de [195.4.92.92]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n28NZPFI011201 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 8 Mar 2009 16:35:29 -0700 Message-Id: <200903082335.n28NZPFI011201@ga.impsec.org> Received: from [195.4.92.24] (helo=14.mx.freenet.de) by mout2.freenet.de with esmtpa (ID william-t@bilobobo7-mail.de) (port 25) (Exim 4.69 #76) id 1LgRk9-0000k5-Gn; Sun, 08 Mar 2009 23:45:13 +0100 Received: from ae.5e.2d.static.xlhost.com ([173.45.94.174]:55570 helo=User) by 14.mx.freenet.de with esmtpa (ID william-t@bilobobo7-mail.de) (port 25) (Exim 4.69 #76) id 1LgRk8-0000rD-Dy; Sun, 08 Mar 2009 23:45:13 +0100 Reply-To: From: "SEC. Joy McCutchan" Subject: [SPAM] CODICIL Date: Sun, 8 Mar 2009 22:45:12 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Warning: yahoo.co.uk is listed at postmaster.rfc-ignorant.org X-Warning: yahoo.co.uk is listed at abuse.rfc-ignorant.org X-Greylist: Delayed for 00:49:56 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 08 Mar 2009 16:35:29 -0700 (PDT) X-Spam-Prev-Subject: CODICIL Status: R X-Status: X-Keywords: X-UID: 169 Content-Length: 1251 On behalf of the Trustees and Executor of the estate of Late Engr. Luther Kruger, I once again try to notify you as my earlier letter returned undelivered. I hereby attempt to reach you again by this same email address on the WILL. I wish to notify you that Late Engr. Luther Kruger made you a beneficiary to his WILL.He left the sum of Twenty two million five hundred thousand United States Dollars to you in the codicil and last testament to his WILL. This may sound strange and unbelievable to you, but it is real and true. Being a widely travelled man, he must have been in contact with you in the past or simply you were recommended to him by one of his numerous friends abroad who wished you good.Late Engr. Luther Kruger died on the 12th day of March,2007 at the age of 80 years, and his WILL is now ready for execution. According to him this money is to support your humanitarian activities and to help the poor and the needy in our society.Please if I reach you this time as I am hopeful, endeavor to get back to me as soon as possible to enable me conclude my job. I hope to hear from you in no distant time through the email address below. Yours in Service, Joy McCutchan(Mrs) Secretary To- John Fredrick QC. MANAGING PARTNERS/ASSOCIATES From info@uknl.org Sun Mar 8 21:37:52 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.9 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, FORGED_RCVD_HELO,J_CHICKENPOX_72,LOTTO_ADMITS,LOTTO_FROM,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,RCVD_IN_BL_SPAMCOP_NET,SPAMMY_WEBMAIL,SPF_HELO_PASS, THOUS_EMAIL_ADDRS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 LOTTO_FROM Admits to being a lottery * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from sapo.pt (relay1.ptmail.sapo.pt [212.55.154.21]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n294blVO018888 for ; Sun, 8 Mar 2009 21:37:51 -0700 Received: (qmail 18839 invoked from network); 9 Mar 2009 04:11:06 -0000 Received: from unknown (HELO sapo.pt) (10.134.35.142) by relay1 with SMTP; 9 Mar 2009 04:11:06 -0000 Received: (qmail 8514 invoked by uid 64140); 9 Mar 2009 04:11:06 -0000 Received: from mtnngprs.com (mtnngprs.com [41.220.75.3]) by w2.webmail.telepac.pt (Horde) with HTTP for ; Mon, 09 Mar 2009 04:11:05 +0000 Message-ID: <1236571865.71l99s9tom4g@w2.webmail.telepac.pt> Date: Mon, 09 Mar 2009 04:11:05 +0000 From: UK NATIONAL LOTTERY Reply-to: uknl.mr.grahamwilbert@live.co.uk To: undisclosed-recipients: ; Subject: [SPAM] Winner MIME-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-15" Content-Disposition: inline Content-Transfer-Encoding: 7bit User-Agent: PTMail Webmail v2.0.17 X-Originating-IP: 41.220.75.3 X-Greylist: Delayed for 00:26:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 08 Mar 2009 21:37:52 -0700 (PDT) X-Spam-Prev-Subject: Winner Status: R X-Status: X-Keywords: X-UID: 170 UK NATIONAL LOTTERY DESK Reference No: ACCU/2008-200 Good day Winner No: MG00708SMYM, We use this medium to notify you of the lottery prize won by your email address,in this year's edition of the UK National Lottery. Kindly contact Our payment Officer, below via email: Mr. Graham Wilbert, Tel: +44 704 572 5542 Email: uknl.mr.grahamwilbert@live.co.uk Signed, Notification Department. From almajozi@gmail.com Mon Mar 9 03:19:43 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.6 required=5.0 tests=BAYES_99,BL_COUNTRY_BR_1, DEAR_NOTHING,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,L_SOME_STD_PROBS,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_BRBL,RCVD_IN_SBL,SPF_NEUTRAL,UNDISC_RECIPS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=almajozi%40gmail.com&ip=200.213.209.134&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 DEAR_NOTHING BODY: Dear [nothing] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [200.213.209.134 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.208.50.176 listed in zen.spamhaus.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [41.208.50.176 listed in psbl.surriel.com] * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from correio.cral.com.br (200-213-209-134.cral.com.br [200.213.209.134]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n29AJcFI027373 for ; Mon, 9 Mar 2009 03:19:42 -0700 Received: from User (gprs02.rb.mtnns.net [41.208.50.176]) by correio.cral.com.br (Postfix) with ESMTP id BAC92C03B93; Thu, 5 Mar 2009 23:04:39 -0300 (BRT) Reply-To: From: "Majozi" Subject: [SPAM] ++ Partnership Proposal ++ Date: Fri, 6 Mar 2009 04:04:44 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090306020440.BAC92C03B93@correio.cral.com.br> To: undisclosed-recipients:; X-Greylist: Delayed for 70:24:43 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 09 Mar 2009 03:19:43 -0700 (PDT) X-Spam-Prev-Subject: ++ Partnership Proposal ++ Status: R X-Status: X-Keywords: X-UID: 171 Dear, Am Dr. Alex Majozi of Old Mutual Group South Africa. I have a unique business proposal for you that will benefit the both of us on a grand scale if executed with utmost trust and sincerity. Please contact me on +27766334525, almajozi@yahoo.com.hk if you are interested so I can update you more. Am keeping this mail short for confidential reason. Awaiting your honest early reply Alex From paullucrative@gmail.com Mon Mar 9 07:27:40 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.7 required=5.0 tests=BAYES_99,DNS_FROM_RFC_POST, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_43, MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,PLING_PLING,SARE_SUB_REPRESENT_REQ, SPF_NEUTRAL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.7 SARE_SUB_REPRESENT_REQ Possible phishing subject * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=paullucrative%40gmail.com&ip=68.73.221.9&receiver=ga.impsec.org] * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 0.3 PLING_PLING Subject has lots of exclamation marks * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.bigtube.net (mail.bigtube.net [68.73.221.9]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n29ERUUo001409 for ; Mon, 9 Mar 2009 07:27:36 -0700 Message-Id: <200903091427.n29ERUUo001409@ga.impsec.org> Received: from User ([69.209.40.173]) by bigtube.net with MailEnable ESMTP; Mon, 9 Mar 2009 08:46:28 -0400 X-ParanoidSpam-Flag: 99% Reply-To: From: "Paul Adeshina" Subject: [SPAM] Job Offer Opportunity!!! (Representative Needed) Date: Mon, 9 Mar 2009 07:46:48 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 01:04:42 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 09 Mar 2009 07:27:37 -0700 (PDT) X-Spam-Prev-Subject: Job Offer Opportunity!!! (Representative Needed) Status: R X-Status: X-Keywords: X-UID: 172 Hello, I'm Paul Adeshina from GOLDEN EGLE company.The GOLDEN Company deals with Digital Gold and Silver (also known as e-currency, Digital Currency or e-money). We need someone to work for the company as a Payment representative in USA. The average monthly income is $2100. We pay workers VIA bank transfer only and our registered banks are W-E-L-L-S- F-A-R-G-O BANK also with HELOC (HOME EQUITY LINE OF CREDIT) and any other bank you use a credit card with,get back to us with your contact information to get started. FULL NAME: ADDRESS: PHONE NUMBER: BANK NAME: Thanks Paul Adeshina From garmont@telefonica.net Mon Mar 9 15:12:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************** X-Spam-Status: Yes, score=28.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,BL_COUNTRY_TW_2,DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_56, L_SOME_STD_PROBS,NO_REAL_NAME,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SPF_PASS,UNCLAIMED_MONEY autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 1.0 NO_REAL_NAME From: does not include a real name * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * -0.0 SPF_PASS SPF: sender matches SPF record * 0.2 PHISH_05 BODY: Phishing for account information * 2.4 UNCLAIMED_MONEY BODY: People just leave money laying around * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 96] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 96] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [114.47.202.188 listed in dnsbl.sorbs.net] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [114.47.202.188 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout2.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n29MCBZf014482 for ; Mon, 9 Mar 2009 15:12:15 -0700 Received: from User (114.47.202.188) by ctsmtpout2.frontal.correo (7.2.056.6) (authenticated as mcdistri@infonegocio.com) id 49B4D7130004DD41; Mon, 9 Mar 2009 22:56:03 +0100 Message-ID: <49B4D7130004DD41@ctsmtpout2.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "U.A.C.C" To: garmont@rediffmail.com Subject: [SPAM] Kindly signify interest Date: Mon, 9 Mar 2009 22:55:59 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:15:32 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 09 Mar 2009 15:12:15 -0700 (PDT) X-Spam-Prev-Subject: Kindly signify interest Status: R X-Status: X-Keywords: X-UID: 173 Content-Length: 2242 REF:NL-0068796-4595 KINDLY SIGNIFY INTEREST OR DIS REGARD THIS MAIL I am Mr. Garmo Montagna, Chairman of the Unclaimed Assets Control Commission (U.A.C.C) in the Netherlands. U.A.C.C is charged with the responsibility of finding beneficiaries to unclaimed funds/assets or return such to the Netherlands Governments. My office implemented active outreach programs designed to reunite unclaimed funds/property with existing beneficiaries. A national database has been established to track all unclaimed assets and it might please you to know that in the Netherlands today, we have:-. About 25 Million Euros in unclaimed Premium Bond prizes About 3.5 Billion Euros in National Savings accounts About 1.8 Billion Euros life policies About 4.5 Billion Euros dormant bank accounts About 4.3 Billion Euros shares and unclaimed dividends About 3.5 Billion Euros pensions. The core objective of my committee is to trace existing beneficiaries for any of this amounts, bank accounts, safe deposit box contents, stocks, mutual funds, bonds and dividends, insurance policies, utility deposits, escrow accounts and process payment/return to their respective legal beneficiaries or process return to the Netherlands government in the event of no trace of a beneficiary. It may please you to know that there is an amount of US$8.25 Million lying dormant in a financial institution with no trace of a beneficiary. I can use my position/authority to process payment to you as the only surviving heir so we can benefit mutually from this amount. Kindly signify interest by sending to me your name as they appear in your international passport or driver's license, your cell/mobile phone number and your present address. Will update you on this as soon as i get your response. Sincerely yours Garmo Montagna CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not distribute or take action in reliance upon this message. If you have received this in error,please notify us immediately by return email and promptly delete this message and its attachments from your computer system.Going contrary to this warning may be unlawful. From senatormike1@sify.com Tue Mar 10 22:09:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.7 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DEAR_SOMETHING, DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FREE_WEBM_ZCom01,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.6 SARE_FREE_WEBM_ZCom01 Sender used free email account - may be * spammer * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.13.208.3 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [64.13.208.3 listed in psbl.surriel.com] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from ss93.shared.server-system.net (ss93.shared.server-system.net [64.13.208.3]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2B592XP030841 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 10 Mar 2009 22:09:11 -0700 Received: from User ([82.128.27.131]) (authenticated bits=0) by ss93.shared.server-system.net (8.12.11.20060308/8.12.11) with ESMTP id n2AEZKuL023727; Tue, 10 Mar 2009 07:35:31 -0700 Message-Id: <200903101435.n2AEZKuL023727@ss93.shared.server-system.net> Reply-To: From: "SENATOR MIKE JOSEPH OJO" Subject: [SPAM] Attn: ATM card Beneficiary Date: Tue, 10 Mar 2009 07:35:53 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 14:32:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 10 Mar 2009 22:09:11 -0700 (PDT) X-Spam-Prev-Subject: Attn: ATM card Beneficiary Status: R X-Status: X-Keywords: X-UID: 174 Content-Length: 2234 FROM THE DESK OF SENATOR MIKE JOSEPH OJO HONORABLE SENATOR FOREIGN PAYMENT SETTLEMENT BOARD HOUSE OF SENATE FEDERAL REPUBLIC OF NIGERIA Attn: ATM card Beneficiary. Ref: Payment/notification/2007 RE: NOTIFICATION OF READINESS OF PAYMENT BY INTERNATIONAL ATM CARD. Dear Sir, This is to inform you that your payment entitlement of has been fully withdrawn from the Remittance Department of the Central Bank After several complains from Foreign beneficiaries through the Attorney General of the Federation, the High commission in the UK and also the United Nations Secretary General. This funds where yesterday returned to the Federal Ministry of Finance reserve account with the Central Bank of Nigeria. After a just concluded meeting amongst the Federal House of Senator, I Senator Mike Joseph Ojo has been appointed to head this federal Board in regards to the settlement of your entitlement upon it return back to the Government purse with the central Bank of Nigeria. Because of so many International Banking rules unfavorable to 3rd world countries like Nigeria in regards to transfer of large amount of monies, the federal Republic of Nigeria via the federal Government has decided to settle all foreign payment by the issuance of an International Valid ATM CARD from a reliable Bank here in Nigeria. This would allow and enable all beneficiaries to access there ATM CARD from any ATM machine in any part of the world. As soon as the below information is secured from you, it would be passed to the appointed bank to issue an International ATM CARD in your favor and it would be sent to you via a courier company for delivery. The below information is required from you, 1, Your Full names 2, your full billing address 3, your direct phone number This information is to be made available immediately so that your ATM CARD can be issued under the provided name and also delivered to the provided address. You will be sent a copy of the international ATM CARD by email attachment as soon as it is issue and also before it is dispatched. Regards SENATOR MIKE JOSEPH OJO HONORABLE SENATOR FOREIGN PAYMENT SETTLEMENT BOARD HOUSE OF SENATE FEDERAL REPUBLIC OF NIGERIA From goods@yahoo.com Wed Mar 11 10:57:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************** X-Spam-Status: Yes, score=52.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_KR_2,BL_COUNTRY_NG_2, DATE_IN_PAST_03_06,DEAR_FRIEND,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST, FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,FORGED_YAHOO_RCVD,FREEMAIL_FROM, FREEMAIL_REPLYTO,J_CHICKENPOX_45,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, NO_REAL_NAME,PHISH_05,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_SUB_NEED_REPLY, SPF_HELO_PASS,SUBJ_ALL_CAPS,TO_CC_NONE,TVD_PH_SUBJ_URGENT,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 TVD_PH_SUBJ_URGENT Subject looks like a phish * 1.0 NO_REAL_NAME From: does not include a real name * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.5 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9985] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.92.140.22 listed in b.barracudacentral.org] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.72 listed in psbl.surriel.com] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ckdpharm.com (mail.ckdpharm.com [210.92.140.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2BHvXSj018434 for ; Wed, 11 Mar 2009 10:57:37 -0700 Received: from User ([196.3.183.72]) by ckdpharm.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 12 Mar 2009 02:35:29 +0900 Reply-To: From: "jones1jones" Subject: [SPAM] URGENT REPLY NEEDED___ Date: Wed, 11 Mar 2009 07:33:06 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 11 Mar 2009 17:35:32.0109 (UTC) FILETIME=[C708EBD0:01C9A26F] X-Greylist: Delayed for 00:22:24 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 11 Mar 2009 10:57:37 -0700 (PDT) X-Spam-Prev-Subject: URGENT REPLY NEEDED___ Status: R X-Status: X-Keywords: X-UID: 175 Content-Length: 2442 11 CREEK ROAD, SOUTH MONROVIA LIBERIA. EMAILjones1jones5007@o2.pl Dear Friend REF:NINE MILLION, TWO HUNDRED AND FIFTY THOUSAND UNITED STATES DOLLARS($9.250 M) FOR INVESTMENT. I am an Attorney Jones 1 jones based in Monrovia here the capital of Liberia. This fund belongs to one of my clients, an ex-President of my Country. He asked me to get a reliable some One to help him invest this fund over there in your Country, Before the present government of my Country claims it as they did to other of His properties. If you can assist us and invest this fund wisely, 20% of the Total sum will be yours.Due to political Crises during his tenures few years ago, his entire family was declared wanted and his properties/belongings were taken away.While he run for his dare life,lucky for him, the Nigeria president Olusegun Obasanjo s rescued him by granting Asylum in Calabar-Cross River State Nigeria. View: http://www.greaterboston.tv/features/gb_071003_liberia.html Thereafter, his stay expires, the Federal Authorities appealed for his release back to Liberia but Mr.Taylor attempted escaping from Asylum but unfortunately, he betrayed and cutch he now facing trial under the US custody in Sierra Leone.For detail view: http://commentisfree.guardian.co.uk/cameron_duodu/2006/03/liberia_asks _for_the_extraditi.htm http://www.alertnet.org/thenews/emergency/LR_CRI.htm These said funds investment amount 9.250musd is been assigned by Mr.President Charles Taylor for investment allocation we have alot of money to invest wisely under your care.20% of the total sum is been assigned as per your share.I Shall visit you with the wife of the president to your country for the investment. once the funds hits your account for the onward investment. Kindly get back to me with the following information s of yours to enable me start the processing. 1. Your Full name & Age:---------------- Contact Address:------------------- Contact Telephone:-------------------- Occupation & Position:------------------- Above all, I wish to assure you that the funds in question is not an act of Terrorist Funding, neither Money Laundering nor Drug-funding. Thus, the transfer will follow the normal protocol of funds transfer, backed up with its papers so that you will not encounter any difficulties/problem with your Federal Monetary Control authorities. I await your urgent response. Thanks and God bless. jones1jones5007@o2.pl Barrister Jones From info@sarah-cole.com Thu Mar 12 01:32:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,BL_COUNTRY_CN_2,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML, FORGED_OUTLOOK_TAGS,FREEMAIL_FORGED,HTML_50_60,HTML_MESSAGE,HTML_TITLE_EMPTY, JM_SOUGHT_FRAUD_3,LOTTO_YOU_WIN_04,LOTTO_YOU_WON_03,MILLION_USD, MIME_HTML_ONLY,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,SUBJ_ALL_CAPS, UNDISC_RECIPS,UPPERCASE_25_50 autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_CN_2 Mail client in China * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.8 MILLION_USD BODY: Talks about millions of dollars * 0.5 LOTTO_YOU_WIN_04 BODY: Won a prize * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.0 UPPERCASE_25_50 message body is 25-50% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from relay03.kiev.sovam.com (relay03.kiev.sovam.com [62.64.120.201]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2C8W3XE010280 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 12 Mar 2009 01:32:08 -0700 Received: from [83.170.209.226] (helo=gate1.novo-farm.com.ua) by relay03.kiev.sovam.com with esmtp (Exim 4.69) (envelope-from ) id 1LhfSY-0007ox-Ta; Thu, 12 Mar 2009 09:36:07 +0200 Received: from User (unknown [61.134.60.254]) by gate1.novo-farm.com.ua (Postfix) with ESMTP id F18EBB82E; Thu, 12 Mar 2009 09:46:10 +0200 (EET) Reply-To: From: "Miss Sarah Cole" Subject: [SPAM] PRIVATE EMAIL (A-342-8876) Date: Thu, 12 Mar 2009 07:36:00 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090312074611.F18EBB82E@gate1.novo-farm.com.ua> To: undisclosed-recipients:; X-Scanner-Signature: bf674e48040b805769da4ba4af5b826b X-DrWeb-checked: yes X-Greylist: Delayed for 00:55:34 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 12 Mar 2009 01:32:08 -0700 (PDT) X-Spam-Prev-Subject: PRIVATE EMAIL (A-342-8876) Status: R X-Status: X-Keywords: X-UID: 176 Content-Length: 2969
PRIVATE EMAIL (A-342-8876)
 
The Office of interswitch technology & standard chartered finance have chosen you by the board of trustees via random email as one of the final recipients for the 2009 cash grant promo.
 
This is to celebrate there anniversary by giving out once in a life time cash grant promo of ATM Card Value of ($10 MILLION USD) to lucky recipients respectively, as the Year financial grant promo. From inters witch technology and standard chartered, in accordance with the enabling act of Parliament world development promo.
 
You have been granted an ATM Card, with a total sum value of ($10 MILLION USD) only. We have secured the release of the funds to you as soon as you call and email the financier and assigned agent, with the following information of yours
(1) Your fully name
(2) Your mobile telephone and fax number,
(3) Your occupation, address and country below.
(4) Your age Sex Male / Female
 
THE ATM CARD PAYMENT CENTER HAS BEEN MANDATED TO ISSUE OUT AN ATM CARD VALUE OF ($10 MILLION USD) WHICH YOU WILL USE TO WITHDRAW YOUR MONEY IN ANY ATM MACHINE, IN ANY PART OF THE WORLD AS PAYMENT FOR THIS FISCAL YEAR 2009. Note always quote your (ATM CASH GRANT NUMBER: A-342-8876) in all your emails.
 
Best regards,
Mr.LEZE PANZE
Director of inters witch
 
 From daviddwalker65@aol.com Thu Mar 12 02:41:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************** X-Spam-Status: Yes, score=38.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_NEUTRAL,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=daviddwalker65%40aol.com&ip=62.2.117.204&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9946] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [62.2.117.204 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.73 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.73 listed in psbl.surriel.com] [62.2.117.204 listed in psbl.surriel.com] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.73 listed in zen.spamhaus.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from thor.sylog.com (62-2-117-204.static.cablecom.ch [62.2.117.204]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2C9fJfc011905 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 12 Mar 2009 02:41:26 -0700 Received: from User (unknown [196.3.183.73]) by thor.sylog.com (Postfix) with ESMTP id BD38B88A6C; Wed, 11 Mar 2009 10:30:55 +0100 (CET) Reply-To: From: "David Walker" Subject: [SPAM] Respond promptly Date: Wed, 11 Mar 2009 10:30:52 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090311093055.BD38B88A6C@thor.sylog.com> To: undisclosed-recipients:; X-Greylist: Delayed for 19:00:12 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 12 Mar 2009 02:41:26 -0700 (PDT) X-Spam-Prev-Subject: Respond promptly Status: R X-Status: X-Keywords: X-UID: 177 Content-Length: 2091 Hello, I will like to solicit your help in a business proposition, which is by nature very confidential. I know that a transaction of this magnitude will make any one worried and Apprehensive but I am assuring you not to worry, as all will be well at the end of this endeavor.A few months back, I sent you an email of which i am yet to receive your response. I am Mr. David Walker, personal attorney to late Dr. Edward who died of a cardiac arrest a few years ago leaving behind a large sum of money with a commercial bank in the Island of Seychelles which is a tax free zone, a place where plenty of rich people tend to hide away funds not ready to be used or invested . I will not mention the amount of money and name of bank presently until we have agreed to deal. So far, valuable efforts has been made to get to his people but to no avail, as he had no known relatives more because he left his next of kin column in his account opening forms blank and he has no known relative. Due to this development the bank has come forward to ask us as his personal attorneys to bring forward a close relative to claim the funds otherwise as the Seychelles national laws would have it, any dormant account for five years will be declared unclaimed and then paid into the government purse. To avert this negative development my colleagues and I have decided to look for a reputable person to act as the next of kin to late Dr. Edward so that the funds could be processed and released into his account, which is where you come in. my law firm will also act as your personal attorneys since we will be portraying you as being directly related to our late client being from the same country. All legal documents to aid your claim for this fund and to prove your relationship with the deceased will be provided by us. Your help will be appreciated with 30% of the total sum which I would disclose in my next email Please accept my apologies, keep my confidence and disregard this letter if you do not appreciate this proposition I have offered you. Yours Faithfully, David Walker From elgo653@terra.es Thu Mar 12 03:41:15 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.0 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3, MILLIONS_01,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,NO_REAL_NAME, RBL_POXLAY_01,SARE_FREE_WEBM_EsTerra,SPF_PASS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 1.7 SARE_FREE_WEBM_EsTerra Sender used free email account - may be * spammer * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.4.149.61 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from IMPaqm1.telefonica.net (impaqm1.telefonica.net [213.4.149.61]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2CAfBcR013410 for ; Thu, 12 Mar 2009 03:41:15 -0700 Message-Id: <200903121041.n2CAfBcR013410@ga.impsec.org> Received: from IMPmailhost4.adm.correo ([10.20.102.125]) by IMPaqm1.telefonica.net with bizsmtp id S6gX1b01M2iL0W201AQ98Z; Thu, 12 Mar 2009 11:24:09 +0100 Received: from User ([85.55.51.13]) by IMPmailhost4.adm.correo with BIZ IMP id SAQ81b0070H5Gl91kAQ8v4; Thu, 12 Mar 2009 11:24:09 +0100 X-TE-authinfo: authemail="elgo653@terra.es" |auth_email="elgo653@terra.es" X-TE-AcuTerraCos: auth_cuTerraCos="cosuitera01" Reply-To: From: "Abogado" Subject: [SPAM] Abogado Date: Thu, 12 Mar 2009 11:24:08 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:16:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 12 Mar 2009 03:41:15 -0700 (PDT) X-Spam-Prev-Subject: Abogado Status: R X-Status: X-Keywords: X-UID: 178 I am Abogado Ruiperez Balic, an attorney at law.I contacted you for a business transaction to transfer of funds for investment purpose. A deposited Fund valued US$7.5 Million dollars by late client of my in one of the banks here in Europe. Please contact me at once to indicate your interest. I will like you to acknowledge the receipt of this e-mail as soon as possible via my private email :( balicruiprez@gmail.com ) and treat with absolute confidentiality and sincerity. I look forward to your quick reply. Best regards, Abogado Ruiperez Balic From info@hongwu.com Thu Mar 12 09:09:12 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************************* X-Spam-Status: Yes, score=43.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,NA_DOLLARS,PHISH_05,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SUBJ_ALL_CAPS,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from cs.iowatelecom.net (mg.iowatelecom.net [69.66.1.16]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2CG94Ed022225 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 12 Mar 2009 09:09:12 -0700 Received: from localhost (localhost [127.0.0.1]) by cs.iowatelecom.net (8.13.8/8.12.10) with ESMTP id n27GDjDO026376; Sat, 7 Mar 2009 10:13:45 -0600 Received: from cs.iowatelecom.net ([127.0.0.1]) by localhost (cs.iowatelecom.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NMphMTf0kQqS; Sat, 7 Mar 2009 10:13:44 -0600 (CST) Received: from hill8-en-tel.net (54.60.in-addr.arpa [60.54.42.188] (may be forged)) (authenticated bits=0) by cs.iowatelecom.net (8.13.8/8.13.1) with ESMTP id n27GDL6C026266; Sat, 7 Mar 2009 10:13:23 -0600 Message-Id: <200903071613.n27GDL6C026266@cs.iowatelecom.net> Reply-To: From: "Mr. Hong Wu" Subject: [SPAM] KINDLY REPLY IF INTERESTED. Date: Sun, 8 Mar 2009 00:13:36 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 119:53:55 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 12 Mar 2009 09:09:12 -0700 (PDT) X-Spam-Prev-Subject: KINDLY REPLY IF INTERESTED. Status: R X-Status: X-Keywords: X-UID: 179 Content-Length: 4512 Compliment Of The Day! It is understandable that you might be a little bit apprehensive because you do not know me but I have a lucrative business proposal of mutual benefits to share with you. Let me start by introducing myself. I am Mr. Hong Wu operations manager of the Bank of China (Shanghai Branch), 200 Mid. Yincheng Rd., Pudong New District, Shanghai 200121, China. I have an obscured Business suggestion for you. In June, 2002, a certain British Crude oil merchant (Mr.Martin Walker) came to our bank and made a Fixed (Numbered) deposit of Thirty Million United State Dollars (US$30,000,000.00) Only in my branch for 12 calender months. Upon maturity, I sent a routine notification to his forwarding address but got no reply. A month later, we sent a reminder and finally we discovered from his contract employers, the Chinese Solid Minerals Corporation that he died from an automobile accident. On further investigation, I found out that he died without making a WILL, and all attempts to trace his next of kin was fruitless. After proper further investigations, it was also discovered that he did not declare any next of kin in his official papers including the paper work of his bank deposit and he also confided in me the last time he was in my office that no one except me knew of his deposit in my bank. So, Thirty Million United State Dollars is still lying in my bank and no one will ever come forward to claim it. What bothers me most is that according to Laws of Republic of China, at the expiration of seven {7} years the funds will revert to the ownership of the Chinese Government if nobody applies to claim the funds. What I wish to relate to you will smack of unethical practice but I want you to understand something, It is only an outsider to the banking world who finds the internal politics of the banking world aberrational. The world of private banking especially is fraught with huge rewards for those who occupy certain offices and oversee certain portfolios. You should have begun by now to p! ut together the general direction Against this backdrop, my suggestion to you is that I will like you as a foreigner to stand as the next of kin so that you will be able to receive the funds so that the fruits of this old man's labor will not get into the hands of some corrupt government officials just like that. MODALITIES: I want you to know that I have had everything planned out so that we shall come out successful. I shall employ the services of an attorney that will prepare the necessary document that will back you up as the next of kin AT NO COST OF YOURS, and also he will be drafting and tarization the WILL and to obtain the necessary documents and letter of probate/administration in your favor for the transfer. There is a reward for this project and it is a task well worth undertaking. There is no risk involved at all in this transaction as all the paperwork for this transaction will be done by the attorney and my position as the Branch Manager guarantees the successful execution of this transaction. I have evaluated the risks and the only risk I have here is for you refusing to work with me and alerting my bank. I am the only one who knows of this situation, good fortune has blessed you with a name that has planted you into the center of relevance in my life. Please endeavor to observe utmost discretion in all matters concerning this issue. Once the funds have been transferred to your nominated bank account we shall share in the ratio of 50% for me, and 50% for you. I send you this mail not without a measure of fear as to what the consequences, but I know within me that nothing ventured is nothing gained and that success and riches never come easy or on a platter of gold. Please observe this instruction religiously. Should you be interested please send me your, 1, Full Names, 2, Private Phone number(s), 3, Current Contact address, And I will prefer you reach me on my private email address: private.hongwu@gmail.com and finally after that I shall furnish you with more informations about this operation. Your earliest response to this letter will be appreciated. Do not betray my confidence. If we can be of one accord, we should plan a meeting soon after this project is successful. Please observe utmost confidentiality, and rest assured that this transaction would be most profitable for both of us because I shall require your assistance to invest my share in your country. Kind Regards, Hong Wu. private.hongwu@gmail.com From leechinlaing@gmail.com Thu Mar 12 13:49:03 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FROM,FREEMAIL_REPLYTO,MILLION_USD,RAZOR2_CHECK,SPF_NEUTRAL autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=leechinlaing%40gmail.com&ip=69.59.169.94&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9930] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from relay2.mailserve.net (relay2.mailserve.net [69.59.169.94]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2CKn0Ch030043 for ; Thu, 12 Mar 2009 13:49:03 -0700 Received: from relay21.mailserve.net (relay21.mailserve.net [121.241.242.35]) by relay2.mailserve.net (Postfix) with ESMTP id 75EA88CAE3A; Fri, 13 Mar 2009 01:58:01 +0530 (IST) Received: from relay21.mailserve.net (relay [121.241.242.35]) by relay21.mailserve.net (Postfix) with ESMTP id 8B04B3C6D1; Fri, 13 Mar 2009 01:58:00 +0530 (IST) Received: from relay21.mailserve.net (relay [121.241.242.35]) by relay21.mailserve.net (Postfix) with ESMTP id 83292A8036; Fri, 13 Mar 2009 01:58:00 +0530 (IST) Received: from purehrc.com (unknown [121.241.68.228]) by relay21.mailserve.net (Postfix) with ESMTP id 8862C4C058; Fri, 13 Mar 2009 01:57:59 +0530 (IST) Received: from leechinlaing@gmail.com([41.211.226.123]) by IQ Mail Reply-To: MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Subject: [SPAM] Respond Immediately Date: Thu, 12 Mar 2009 20:27:51 -0000 Message-ID: <1236888916875.16508.PostMaster@purehrc.com> X-MailServer: IQuinox v6.0.38-RC8 on [192.168.1.69] Windows 2003 (5.2) From: "Mr. Liang-Chin Lee" To: content-type: text/plain; charset=windows-1251 content-transfer-encoding: 7bit X-Greylist: Delayed for 00:20:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 12 Mar 2009 13:49:03 -0700 (PDT) X-Spam-Prev-Subject: Respond Immediately Status: R X-Status: X-Keywords: X-UID: 180 Greetings, I'm Mr. Liang-Chin Lee Executive Director of the Bank SinoPac, Taiwan, A reputable bank in Taiwan I write to you this brief letter in good faith to inform you about a very lucrative business proposal what $44.5 Million USD if interested Note to indicate your serious interest by providing me with your; FULL CONTACT INFOMATION to my personal email address below. lee2chinlaing@gmail.com Please note to respond to my persoanl email address above. Upon your swift reponse i immediately shall furnish you with more infomation about the business. I await your timely response. Respectfully, Mr. Liang-Chin Lee Personal Email: lee2chinlaing@gmail.com ------------------------------ Pure HRC Services, Pune, India From pro_charles_soludo1@rocketmail.com Fri Mar 13 02:42:06 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************** X-Spam-Status: Yes, score=38.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DNS_FROM_RFC_ABUSE, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM,FREEMAIL_REPLYTO, FROM_HAS_ULINE_NUMS,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,STOX_30,STOX_46,STOX_51,SUBJ_ALL_CAPS, UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 STOX_51 Line Noise message subject * 0.3 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.1 STOX_46 BODY: First Thing Buyday * 0.5 STOX_30 BODY: Stock market stuff - symbol * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9993] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from fep04.mfe.bur.connect.com.au (fep04.mfe.bur.connect.com.au [203.63.86.24]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2D9g24i006197 for ; Fri, 13 Mar 2009 02:42:06 -0700 Received: from mpaust.com.au (mpm142482-1.gw.connect.com.au [210.8.14.209]) by fep04.mfe.bur.connect.com.au (Postfix) with ESMTP id 24DEA10A9D; Fri, 13 Mar 2009 20:20:36 +1100 (EST) Received: from User ([81.199.193.6]) by mpaust.com.au with Microsoft SMTPSVC(6.0.3790.3959); Fri, 13 Mar 2009 19:20:20 +1000 Reply-To: From: "PROF.CHARLES SOLUDO" Subject: [SPAM] DEAR BENEFICIARY,THIS IS TO NOTIFY YOU......... Date: Fri, 13 Mar 2009 10:20:23 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="_iso-2022-jp$ESC" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 Message-ID: X-OriginalArrivalTime: 13 Mar 2009 09:20:21.0396 (UTC) FILETIME=[EEE56540:01C9A3BC] To: undisclosed-recipients:; X-Greylist: Delayed for 00:18:32 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 13 Mar 2009 02:42:06 -0700 (PDT) X-Spam-Prev-Subject: DEAR BENEFICIARY,THIS IS TO NOTIFY YOU......... Status: R X-Status: X-Keywords: X-UID: 181 Content-Length: 2933 OFFICE OF THE GOVERNOR CENTRAL BANK OF NIGERIA Our Ref: CBN/OHG/OXD1/2009 Your Ref: ............... TELEX: CENBANK. PAYMENT FILE: CBN/BEN/09. Attn: Beneficiary, PAYMENT NOTIFICATION. Definitely, I know that this letter will be a surprising one to you. Firstly, I will like to introduce myself formally as Prof. Charles Soludo, The Executive Governor of The Central Bank of Nigeria (CBN). I am officially contacting you today because your Inheritance Funds were Re-deposited into the "Federal Suspense Account" of CBN last week, because you did not forward your Claim as the Right beneficiary. Well known to all, The Central Bank of Nigeria is the mother Bank of all commercial Banks here in Nigeria. Really these men were unexpected by me because their visit was impromptu. I had to ask them why they came to see me in person and they said that they were here to Collect the Inheritance Bill Sum of (US$20,000,000) which rightfully belongs to you, on your behalf. At this development I asked them who authorized them to come down to Nigeria for the Collection of this Payment and they told me that you asked them to come and collect this Funds on your Behalf. In fact this was the biggest shock that this Bank have ever received so far because your Inheritance Funds is still in the "Federal Suspense Account" of CBN, yet you sent these men to come and collect this Funds on your behalf without notifying us. We in this Bank do not understand why you sent these men to come and Collect your Funds on your behalf. If actually you want them to help you collect your Inheritance Bill Sum, at least you should have informed me as the Executive Governor of this Bank. They actually tendered some Vital Documents, which proved that you actually sent them for the Collection of these Fund. Honestly, it really baffles me that you took such decision without my consent. Here are the Documents, which they tendered to this Bank today: 1. LETTER OF ADMINISTRATION. 2. HIGH COURT INJUNCTION. 3. ORDER TO RELEASE. Actually, these Documents, which they tendered to this Noble Bank, is a clear Proof that you sent them to Collect this Funds for you. Finally, I told them to come back tomorrow morning and they promised to come back. As the Governor of this Noble Bank, I was supposed to Release this Funds to them but I refused to do so because I wanted to hear from you first. Due to the Nature of my job, I will not want to make any mistake in Releasing this Funds to anyone except you whom is the Recognized Bonafide Beneficiary to this Funds. Kindly clarify us on this issue before we make this Payment to these foreigners whom came on your behalf. In receipt of this confidential Letter, you are required to respond immediately to this email with your full name, address and phone number for reconfirmation and immediate action or you call me for more clarification. OFFICIALLY SIGNED. PROF. CHARLES SOLUDO From automac@games.com Sat Mar 14 05:07:41 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.0 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, FORGED_OUTLOOK_HTML,HTML_50_60,HTML_MESSAGE,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,LOTTO_AGENT,LOTTO_WINNINGS,LOTTO_WIN_01, LOTTO_YOU_WON_02,MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_LOTTO_SPAM2,THOUS_EMAIL_ADDRS, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from psmtp30.wxs.nl (psmtp30.wxs.nl [195.121.247.32]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2EC7bVH015862 for ; Sat, 14 Mar 2009 05:07:40 -0700 Received: from qz1-PC (ip565c0c43.direct-adsl.nl [86.92.12.67]) by psmtp30.wxs.nl (iPlanet Messaging Server 5.2 HotFix 2.15 (built Nov 14 2006)) with SMTP id <0KGH009I3UHI3Y@psmtp30.wxs.nl> for jhardin@impsec.org; Sat, 14 Mar 2009 12:27:28 +0100 (MET) Date: Sat, 14 Mar 2009 12:26:37 +0100 From: De Lotto Subject: [SPAM] Results ! Reply-to: De Lotto Message-id: <003001c9a4fa$ebbea33f$69edc462@oovuzvdvxltb> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Mailer: Microsoft Outlook Express 6.00.2900.2180 Content-type: text/html; charset=utf-7 Content-transfer-encoding: 8BIT X-Priority: 3 X-MSMail-priority: Normal X-Greylist: Delayed for 00:40:07 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 14 Mar 2009 05:07:41 -0700 (PDT) X-Spam-Prev-Subject: Results ! Status: R X-Status: X-Keywords: X-UID: 182 Content-Length: 5343
De Millionaire
laan van Hoornwijck 55 
2289 DG Rijswijk.
Amsterdam The Netherlands
KvK: 41151075
 
WINNING NOTIFICATION
 
 
The Netherlands Millionaire Lotto wishes to inform you  that the results of the Millionaire lotto Promo is out and 
you are been chosen as the second winner for the programme by the Millionaire Lotto held on the 13th of MARCH 2009. 
Your Email has been picked as a winner of a lump sum pay out of Nine Hundred Thousand euros (9 hundres thounsand).
 
 
The Millionaire Lotto. draws was conducted from an  exclusive list of 13 lucky emails of individual and corporate
bodies picked by an advanced automated random computer search. No tickets were sold.
 
-----------------------------------------------------------
You email address was attached to.
Ref Number: ENL 3910289/ES 856.
Batch Number: ENL 61197431-ZNG/2008.
Ticket Number: ESP 2746372 07421.
Security File Number: 17730.
-----------------------------------------------------------
 
To file for your claims and due remittance of funds contact Mr.Pieter Baart on the information below.
 
Mr Pieter Baart
De Lotto Corporate Officer.
Email:process.pot@games.com
 
 
You are required to claim your winnings by March 27th, 2009 otherwise  it rolls over to the next draw.
 
N.B: Procedures to claiming your prize: 
1. Please quote your Reference number in all correspondence with the claims officer.
2. Indicate your Full Name, Address, Country, Telephone, Mobile, Fax Number, Occupation and Age. 
 
Failure to provide the information above will result to immediate disqualification !!
 
Furthermore, should there be any change of address do Inform the CLAIM AGENT as soon as possible.
 
Congratulations once more from our members of staff.
Once again on behalf of all our staff CONGRATULATIONS!!!
Note: Anybody under the age of 18 is automatically disqualified...
 
For a smooth and safe collection, you are required to keep your Reference Number confidential.
 
Congratulations..
 
Mrs Linda Hof
Winnings Coordinator.
 
 
***************************************************************************** 
This email may contain information which is confidential and/or 
privileged. The information is intendedsolely for the use of the 
individual or entity named above. If you are not the intended recipiet 
be awarethat any disclosure, copying, distribution or use of the contents is 
prohibited. If you have received this electronic transmission in error, 
please notify the sender bytelephone or return email and delete the 
material from your computer. 
fqhdabyb
***************************************************************************
 
 From smithfrederick_20078@yahoo.com.cn Sun Mar 15 01:34:37 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.3 required=5.0 tests=ADDR_NUMS_AT_BIGSITE, ADVANCE_FEE_1,ADVANCE_FEE_2,BAYES_99,BL_COUNTRY_TR_1,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SORBS_WEB,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TR_1 Mail client in Turkey * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [212.57.26.2 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [193.120.116.183 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [212.57.26.2 listed in psbl.surriel.com] [193.120.116.183 listed in psbl.surriel.com] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [193.120.116.183 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADDR_NUMS_AT_BIGSITE Has an address with lots of numbers at a big * ISP * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from yaklasim.com (asy2.asy26.tellcom.com.tr [212.57.26.2] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2F8YTJi014471 for ; Sun, 15 Mar 2009 01:34:36 -0700 Received: from User [193.120.116.183] by yaklasim.com with ESMTP (SMTPD32-8.04) id A7732B10116; Sun, 15 Mar 2009 03:18:43 +0200 Reply-To: From: "Smith Frederick" Subject: [SPAM] Get back to me today please !! Date: Sun, 15 Mar 2009 01:09:49 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200903150319968.SM01704@User> X-Spam-Prev-Subject: Get back to me today please !! Status: R X-Status: X-Keywords: X-UID: 183 Private and Personal Please Good day, I am a senior Auditor and Heading-computing department here in a leading bank in the United Kingdom, in my Bank I discovered an abandoned large sum of money 35Million pounds belonging to one of our late Foreign Customer, since 2000. The owner of this account is late Mr. Thomas Stockley, an American National, a businessman, who involved in air crash along with his family. You can confirm from the website below. http://www.cnn.com/2000/US/02/01/alaska.airlines.list/ No other person knows about this account. The Strategy is to use our influence as a senior Auditor and Heading-computing department to approve the funds to you. If you are interested, please get back to me on my private email address below: Email: smithfrederick_20078@yahoo.com.cn Yours faithfully SmithFrederick From elinorg206@centrum.sk Sun Mar 15 10:04:20 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.7 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DNS_FROM_RFC_ABUSE,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,L_SOME_STD_PROBS,MILLIONS_01,RAZOR2_CHECK,UNPARSEABLE_RELAY autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from farizej.centrum.cz (farizej.centrum.cz [90.183.38.130]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2FH4GoD028483 for ; Sun, 15 Mar 2009 10:04:20 -0700 Received: by mail255.centrum.cz id S50331967AbZCOQnz (ORCPT ); Sun, 15 Mar 2009 17:43:55 +0100 Received: from 81.169.155.246 by mail08-sk.centrum.cz (Centrum Mail) with HTTP Date: Sun, 15 Mar 2009 17:43:55 +0100 From: "lord" X-Mailer: Centrum Mail 5.0 MIME-Version: 1.0 X-Priority: 3 Message-ID: <200903151743.20970@centrum.cz> Subject: [SPAM] From:Mrs.Elinor.J.George Greetings Dearest One, With Due Respect And Humanity, I was compelled to write to you under a humanitarian ground. My name is Mrs. Elinor Goerge Jacob. I was born in Baltimore, Maryland, I am married to Mr.George Jacob Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit To: unlisted-recipients:; (no To-header on input) X-Greylist: Delayed for 00:20:10 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 15 Mar 2009 10:04:20 -0700 (PDT) X-Spam-Prev-Subject: From:Mrs.Elinor.J.George Greetings Dearest One, With Due Respect And Humanity, I was compelled to write to you under a humanitarian ground. My name is Mrs. Elinor Goerge Jacob. I was born in Baltimore, Maryland, I am married to Mr.George Jacob Status: R X-Status: X-Keywords: X-UID: 184 Content-Length: 1894 From:Mrs.Elinor.J.George Greetings Dearest One, With Due Respect And Humanity, I was compelled to write to you under a humanitarian ground. My name is Mrs. Elinor Goerge Jacob. I was born in Baltimore, Maryland, I am married to Mr.George Jacob director J.C Industries Cote d'Ivoire.We were married for 36 years without a child. He died after a Cardiac Arteries Operation. And Recently, My Doctor told me that I would not last for the next six months due to my cancer problem (cancer of the liver and stroke).Before my hutsband died last year there is this sum $8.5 Million Dollars hat he deposited with a Private Finance Company here In Ivory coast. Presently this money is still in the Vault of the Company. Having known my condition I decided to donate this fund to any good God fearing brother or sister that will utilize this fund the way I am going to instruct herein.I want somebody that will use this fund according to the desire of my late husband to help Lessprivilaged people, orphanages,widows and propagating the word of God. I took this decision because I don't have any child that will inherit this fund, And I don't want in away where this money will be used in an un Godly way.This is why I am taking this decision to hand you over this Fund. I am not afraid of death hence I know where I am going.I want you to always remember me in your daily prayers because of my up coming Cancer Surgery. Thank's and God bless you as you comply with me and please don't hesitate to get back to me through this Email id(elinorg21@yahoo.com.ph ) because i don't really know how tommorrow might be because of my health but all my believe is that death is for everyone besides i'm not praying for death but due to my present condition i can't predict if i will survive or not all i know is that God know's what tommorrow will tell. Best regards, Mrs.Elinor George Jacob. From samos@keyofchange.com Sun Mar 15 11:12:55 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************************************** X-Spam-Status: Yes, score=47.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DEAR_SOMETHING,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_SUB_NEED_REPLY,SUBJ_ALL_CAPS, TO_CC_NONE,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.1 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9927] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from chiromedia.com (sollink.sollink.net [216.71.53.124]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2FICqdH030444 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO) for ; Sun, 15 Mar 2009 11:12:55 -0700 Received: from User ([115.67.9.230]) (authenticated (0 bits)) by sollink.sollink.net (8.11.6/8.11.6) with ESMTP id n2BNQMB27318; Wed, 11 Mar 2009 17:26:24 -0600 Message-Id: <200903112326.n2BNQMB27318@sollink.sollink.net> Reply-To: From: "JAMES WALTER" Subject: [SPAM] YOUR URGENT RESPONSE IS NEEDED. Date: Wed, 11 Mar 2009 17:00:45 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:17:44 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 15 Mar 2009 11:12:55 -0700 (PDT) X-Spam-Prev-Subject: YOUR URGENT RESPONSE IS NEEDED. Status: R X-Status: X-Keywords: X-UID: 185 Content-Length: 2425 >From The Desk Of Barrister James Walter, James Walter & Associate Chambers 37 Sathorn Tai Road, Bangkok Thailand Dear Sir/Madam, Please kindly accept my apology for sending unsolicited mail to you I believe you are a highly respected personality considering the fact that I sourced your profile from a human resource profile database on your country. Though, I do not know to what extent you are familiar with events. Well, I am Barrister James Walter, a Solicitor. I am the Personal Attorney to Mr. Steve Anderson, who used to work with SIAMRAK Company Limited in Bangkok Thailand . On the 21st of April 2004, his wife and their three children were involved in a car accident along Sukhumvit Express Road . Unfortunately, they all lost their lives in the event of the accident. Since then I have made several enquiries to your Embassy to locate any of my client's relatives, this has also proved unsuccessful. After these several unsuccessful attempts, I decided to trace his relatives over the Internet to locate any member of his family but to no avail, hence, I contacted you to assist in repatriating the money left behind by my client in a Finance Company. Particularly, the Finance House where the deceased deposited the US$35 Million (Thirty Five Million United States Dollars only). Consequently, this Finance House issued me a notice to provide the Next of Kin to claim the US$35 Million (Thirty Five Million United States Dollars only) in their custody within the next ten official working days. Since I have been unsuccessful in locating the relatives for over 4 years now, I seek your consent to present you as the next of kin of the deceased to claim the fund as the Next of Kin to him so that the fund will be transferred to your account by the Finance House. Upon receipt of the fund, I will come over to your country to meet with you for the disbursement of the fund and then you and I will share the money in this order: 70% will be for me, 30% will be for you. I have all the necessary legal documents that can back our claim we will make with the Finance House. All I require is your honest co-operation to enable us seeing this deal through. I guarantee that this will be executed under a legitimate arrangement that will protect you from any breach of the law. You are needed as a next of kin to inherit your brother left fund. Best regards . Barrister James Walter (Esq.) From opcweb@agd.sa.gov.au Tue Mar 17 11:46:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.4 required=5.0 tests=BAYES_95,BAYES_POISON_02, DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS, FROM_SUBDOMAIN,HTML_90_100,HTML_EMBED_IMG_03,HTML_IMAGE_ONLY_04,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,HTML_ONLY_IMG,HTML_SHORT_LENGTH,HTML_SHORT_LINK_IMG_1, L_SOME_STD_PROBS,MANY_SUBDOM,MIME_HTML_ONLY,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.2 FROM_SUBDOMAIN From address is a third-level domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 0.2 MANY_SUBDOM URI: MANY_SUBDOM * 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML * 1.6 HTML_SHORT_LENGTH BODY: HTML is extremely short * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9807] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 3.6 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words * 0.1 HTML_EMBED_IMG_03 RAW: Contains embedded images * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 HTML_ONLY_IMG no text/plain, mostly an image * 0.9 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image * 2.7 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 0.8 BAYES_POISON_02 Appears to have "bayes poison" unpunctuated text * 1.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 2.5 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from procyon.masche.com (sub5.masche.com [213.133.127.5]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n2HIkMIK008079 for ; Tue, 17 Mar 2009 11:46:26 -0700 Message-Id: <200903171846.n2HIkMIK008079@ga.impsec.org> Received: (qmail 31642 invoked from network); 17 Mar 2009 19:19:40 +0100 Received: from unknown (HELO User) (spam@78.137.161.23) by masche.com with SMTP; 17 Mar 2009 19:19:34 +0100 Reply-To: From: "Office of Parliamentary Counsel" x-spamrejector: V0.08, 20090317191934, was relayclient, accepted immediately after 6 secs Subject: [SPAM] Where's My Refund ? Date: Tue, 17 Mar 2009 18:18:32 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:26:40 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 17 Mar 2009 11:46:26 -0700 (PDT) X-Spam-Prev-Subject: Where's My Refund ? Status: R X-Status: X-Keywords: X-UID: 186 From cpl.allenterry@gmail.com Tue Mar 17 19:15:47 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_60,DNS_FROM_RFC_POST,FREEMAIL_FROM,MILLIONS_01,NA_DOLLARS, NORMAL_HTTP_TO_IP,RCVD_IN_BRBL,SARE_SUB_NEED_REPLY,SPF_NEUTRAL,SUBJ_ALL_CAPS, TO_CC_NONE,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=cpl.allenterry%40gmail.com&ip=203.153.41.85&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 NORMAL_HTTP_TO_IP URI: Uses a dotted-decimal IP address in URL * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7895] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [203.153.41.85 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from mail.pec.ac.in (mail.pec.ac.in [203.153.41.85]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2I2FcCx020344 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Tue, 17 Mar 2009 19:15:45 -0700 Received: (qmail 11247 invoked by uid 509); 18 Mar 2009 06:38:19 +0530 Received: from 127.0.0.1 by mail.pec.ac.in (envelope-from , uid 508) with qmail-scanner-1.25-st-qms (perlscan: 1.25-st-qms. Clear:RC:1(127.0.0.1):. Processed in 0.030658 secs); 18 Mar 2009 01:08:19 -0000 X-Antivirus-MYDOMAIN-Mail-From: cpl.allenterry@gmail.com via mail.pec.ac.in X-Antivirus-MYDOMAIN: 1.25-st-qms (Clear:RC:1(127.0.0.1):. Processed in 0.030658 secs Process 11241) Received: from unknown (HELO mail.pec.ac.in) (127.0.0.1) by mail.pec.ac.in with SMTP; 18 Mar 2009 06:38:19 +0530 Received: from 62.173.44.38 (SquirrelMail authenticated user deanaa) by mail.pec.ac.in with HTTP; Wed, 18 Mar 2009 06:38:19 +0530 (IST) Message-ID: <2840.62.173.44.38.1237338499.squirrel@mail.pec.ac.in> Date: Wed, 18 Mar 2009 06:38:19 +0530 (IST) Subject: [SPAM] I NEED YOUR URGENT RESPONSES From: "Cpl. Terry Allen" Reply-To: cpl.allenterry@gmail.com User-Agent: SquirrelMail/1.4.8-4.0.1.el5 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Greylist: Delayed for 00:25:33 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 17 Mar 2009 19:15:46 -0700 (PDT) X-Spam-Prev-Subject: I NEED YOUR URGENT RESPONSES Status: R X-Status: X-Keywords: X-UID: 187 Content-Length: 3023 Hello With trust and gratitude. I know this letter will definitely come to you as a huge surprise, but I implore you to take time and go through it carefully as the decision you make will go off a long way to determine my future and continued existence. Please allow me to introduce myself. I am Cpl. Terry Allen a US Marine Capt of Multinational Division Center in Iraq and the 10th Mountain Division, serving in the 3rd Battalion, 25th Marine Regiment which Patrols the Amber province in Iraq. I am desperately in need of assistance and I have summoned up courage to contact you. I am presently in Iraq and I found your contact particulars in an address journal. I am seeking your assistance to evacuate the sum of $15,570,000.00 (Fifteen million Five Hundred and Seventy Thousand US dollars) to the States or any safe country of your choice, as far as I can be assured that it will be safe in your care until I complete my service here. This is no stolen money and there are no dangers involved. Clarity on the root of this money. Some money in various currencies was discovered and concealed in barrels with piles of weapons and ammunition at a location near one of Saddam Hussein's old Presidential Palaces during a rescue operation and it was agreed by all party present that the money be shared amongus. This might appear as an illegal thing to do but I tell you what, No compensation can make up for the risks we have taken with our lives in this hell hole. The above figure was given to me as my share and to conceal this kind of money became a problem for me, so with the help of a British contact working with the UN here (his office enjoys some immunity) I was able to get the package out to a safe location and secured storage entirely out of trouble spot. He does not know the real contents of the package as he believes that it belongs to an American who died in an air raid, and before giving up trusted me to hand over the package to his family . I need to get the package out before its too late, for I do not know for how long I will remain here or survive it as I have been lucky to have survived 2 suicide bomb attacks by Pure Divine intervention. This and other reasons put into consideration have prompted me to reach out for help. If it might be of interest to you then Endeavor to contact me and we would work out the necessary formalities but I pray that you are discreet about this mutually benefiting relationship. This news page contains information's about my proposal and i will want you to view and keep my proposal confidential. http://news.bbc.co.uk/2/hi/middle_east/2988455.stm http://74.125.77.132/search?:mBQicxW_AncJ:www.drum.army.mil/sites/tenants/division/CMDGRP/CG/CG.htm+maj+gen+michael+Oates&cd=1&hl=en&ct=clnk Am waiting for your reply so that I can furnish you with more details. u have to contact me on my private email address by clicking reply (cpl.allenterry@gmail.com). Respectfully Yours, Cpl. Terry Allen . United States Marine Corps. IRAQ From lanuzo.aslor@alpharheintal.com Tue Mar 17 23:33:49 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.6 required=5.0 tests=ADVANCE_FEE_1,BAYES_60, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_3,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SUB_HELLO autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7627] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [82.132.136.191 listed in dnsbl.sorbs.net] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [82.132.136.191 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [82.132.136.191 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp4.clear.net.nz (smtp4.clear.net.nz [203.97.37.64]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2I6Xioc027235 for ; Tue, 17 Mar 2009 23:33:48 -0700 Received: from anne.munro ([82.132.136.191]) by smtp4.clear.net.nz (CLEAR Net Mail) with SMTPA id <0KGO000TNNWJTD50@smtp4.clear.net.nz> for jhardin@impsec.org; Wed, 18 Mar 2009 19:18:38 +1300 (NZDT) Date: Wed, 18 Mar 2009 06:18:34 +0000 From: Aslor Lanuzo Subject: [SPAM] Hello To: jhardin@impsec.org Reply-to: lanuzo.aslor@yahoo.com.hk Message-id: <0KGO0008KUV0TDD0@smtp4.clear.net.nz> MIME-version: 1.0 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Content-type: text/plain; charset=us-ascii X-Greylist: Delayed for 00:15:04 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 17 Mar 2009 23:33:48 -0700 (PDT) X-Spam-Prev-Subject: Hello Status: R X-Status: X-Keywords: X-UID: 188 Content-Length: 1085 Hello, I apologize for this intrusion; I decided to contact you through email due to the urgency involved in this matter. My name is Aslor Lanuzo, I work as a portfolio management officer with Alpha Rheintal Bank here in Switzerland. I need your co-operation in receiving and investing USD10.5M. It is very important that the claim is made, as the bank will report to the Swiss banking ombudsman anytime from now if it remains unclaimed. What bother me most is that we have some unscrupulous government official who will embezzle this fund instead of using it for good course. It is because of this I have sought for your assistance for us to both pull this through. I will provide you with detailed information on the modalities of this operation once I have your interest. If I don't hear from you within a certain period I will assume you are not interested and will solicit for a new partner.Accept this by responding to this email with your personal telephone number and contact address. We shall share in the ratio 70:30. I wait to hear from you ASAP. Thank you. Aslor Lanuzo From soliaboga@terra.es Wed Mar 18 03:25:17 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3, MILLIONS_01,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,NO_REAL_NAME, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, SARE_FREE_WEBM_EsTerra,SPF_PASS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 1.7 SARE_FREE_WEBM_EsTerra Sender used free email account - may be * spammer * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from IMPaqm2.telefonica.net (impaqm2.telefonica.net [213.4.149.62]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2IAPCig000520 for ; Wed, 18 Mar 2009 03:25:16 -0700 Message-Id: <200903181025.n2IAPCig000520@ga.impsec.org> Received: from IMPmailhost2.adm.correo ([10.20.102.39]) by IMPaqm2.telefonica.net with bizsmtp id UYmH1b00M0r0BT63Ma8oU5; Wed, 18 Mar 2009 11:08:48 +0100 Received: from User ([81.39.246.137]) by IMPmailhost2.adm.correo with BIZ IMP id Ua8k1b00S2ybnMt1ia8loz; Wed, 18 Mar 2009 11:08:48 +0100 X-TE-authinfo: authemail="soliaboga@terra.es" |auth_email="soliaboga@terra.es" X-TE-AcuTerraCos: auth_cuTerraCos="cosuitera01" Reply-To: From: "Abogad" Subject: [SPAM] Abogad Date: Wed, 18 Mar 2009 11:08:47 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:16:17 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 18 Mar 2009 03:25:16 -0700 (PDT) X-Spam-Prev-Subject: Abogad Status: R X-Status: X-Keywords: X-UID: 189 I am Abogado Y .L.Carlos, an attorney at law.I contacted you for a business transaction to transfer of funds for investment purpose. A deposited Fund valued US$7.5 Million dollars by late client of my in one of the banks here in Europe. Please contact me at once to indicate your interest. I will like you to acknowledge the receipt of this e-mail as soon as possible via my private email :(ldacrls60@gmail.com) and treat with absolute confidentiality and sincerity. I look forward to your quick reply. Best regards, Abogado Y .L.Carlos From egodd872@terra.es Wed Mar 18 05:55:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.1 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,LOTTO_YOU_WON_03,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,NO_REAL_NAME,RBL_POXLAY_01,SARE_FREE_WEBM_EsTerra, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 1.7 SARE_FREE_WEBM_EsTerra Sender used free email account - may be * spammer * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [85.55.55.101 listed in dnsbl.sorbs.net] * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from IMPaqm2.telefonica.net (impaqm2.telefonica.net [213.4.149.62]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2ICtCWA004520 for ; Wed, 18 Mar 2009 05:55:16 -0700 Message-Id: <200903181255.n2ICtCWA004520@ga.impsec.org> Received: from IMPmailhost2.adm.correo ([10.20.102.39]) by IMPaqm2.telefonica.net with bizsmtp id UcXY1b00o0r0BT63Mcepsp; Wed, 18 Mar 2009 13:38:50 +0100 Received: from User ([85.55.55.101]) by IMPmailhost2.adm.correo with BIZ IMP id Uceo1b00P2B1fHh1iceoPE; Wed, 18 Mar 2009 13:38:49 +0100 X-TE-authinfo: authemail="egodd872@terra.es" |auth_email="egodd872@terra.es" X-TE-AcuTerraCos: auth_cuTerraCos="cosuitera01" Reply-To: From: "mail" Subject: [SPAM] Requirement Date: Wed, 18 Mar 2009 13:38:48 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:16:19 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 18 Mar 2009 05:55:16 -0700 (PDT) X-Spam-Prev-Subject: Requirement Status: R X-Status: X-Keywords: X-UID: 190 You have been awarded of the sum of USD$770,000:00 which was won by your E-MAIL Address in our El Gordo Spanish Lottery. Do get back to this office with your requirement below via (consults.rnc@gmail.com) with your: Names :............... Address :................ Conntry :................ Phone No :.............. Occupation :.............. Age :................ Sex :................. Best Regard +34 634 003 898 >From Mr.LOE ANALDO From claim.officer@aol.nl Wed Mar 18 13:40:53 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************************************** X-Spam-Status: Yes, score=42.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_TW_2,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_3,LOTTO_AGENT,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01, MILLION_USD,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_NEUTRAL, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS,UNCLAIMED_MONEY,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=claim.officer%40aol.nl&ip=59.124.15.113&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 2.4 UNCLAIMED_MONEY BODY: People just leave money laying around * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [59.124.15.113 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [59.124.15.113 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from www.sunmateco.com.tw (59-124-15-113.HINET-IP.hinet.net [59.124.15.113]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2IKemJh017260 for ; Wed, 18 Mar 2009 13:40:52 -0700 Received: from User (unknown [62.140.137.152]) by www.sunmateco.com.tw (Postfix) with ESMTP id 50D2758BE7; Wed, 18 Mar 2009 07:32:06 +0800 (GMT-8) Reply-To: From: "LOTTO NL" Subject: [SPAM] AWARD WINNING NOTICE 2009 Date: Wed, 18 Mar 2009 00:48:47 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090317233207.50D2758BE7@www.sunmateco.com.tw> To: undisclosed-recipients:; X-Greylist: Delayed for 04:56:20 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 18 Mar 2009 13:40:53 -0700 (PDT) X-Spam-Prev-Subject: AWARD WINNING NOTICE 2009 Status: R X-Status: X-Keywords: X-UID: 191 Content-Length: 1729 AWARD WINNING NOTICE Ref No.00724/009 Batch No.312/00648NL Ticket/Series No.NL09874893 Amount Won: $2,500,000.00 USD Attn: Internet User, This is to formally inform and congratulate you on the result of the online cyber lotto which was conducted from an exclusive list of 1,000.000 email addresses of individual and corporate bodies selected by an advanced automated random computer ballot system from the internet. Your e-mail address emerged as a winner in the category "A" with the following information enclosed. You are therefore to receive a cash prize of $2,500,000.00. (Two Million Five Hundred Thousand United States Dollars). To file in for the processing of your prize winnings, you are advised to contact our Certified and Accredited claims agent for category "A" winners with the information below: ************************************* Mr.BRAM COOS Tele:+31-616-544-963 Fax: +31-847-393-086 Email:InfoClaim005@aol.com ************************************* You are advice to provide him with the following information and a copy of your international passport or driver's license via email attachment or by fax for vetting process which is a standard practice just to ensure that we are dealing with the right individual. First name: Last Name: Telephone/Fax number: Nationality: Age: Occupation: Winning Email: NOTE: Ensure to quote your Reference Numbers in all your communication with your claims agent. All winnings must be claimed not later than seven working days, thereafter unclaimed funds would be included in the next stake. Congratulations! Thank you for being a user of the World Wide Web. Yours Faithfully, Mrs.VAN CARY http://www.lotto.nl/ Lottery Coordinator. From mitchell.merchandize@live.co.uk Thu Mar 19 19:16:05 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.9 required=5.0 tests=BAYES_99,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,J_CHICKENPOX_44, J_CHICKENPOX_54,J_CHICKENPOX_56,L_SOME_STD_PROBS,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,RAZOR2_CHECK,SPAMMY_WEBMAIL,SPF_SOFTFAIL,SUBJ_ALL_CAPS, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=mitchell.merchandize%40live.co.uk&ip=72.32.158.212&receiver=ga.impsec.org] * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from webmail.pcsgrp.com (mail.brachfeldcollections.com [72.32.158.212]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2K2G1vx000301 for ; Thu, 19 Mar 2009 19:16:05 -0700 Message-Id: <200903200216.n2K2G1vx000301@ga.impsec.org> Received: from server217-174-252-30.live-servers.net [217.174.252.30] by webmail.pcsgrp.com with SMTP; Thu, 19 Mar 2009 18:56:38 -0700 From: "Mitchell Merchandize" Subject: [SPAM] PART TIME JOB OFFER Date: Fri, 20 Mar 2009 01:56:30 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Declude-Sender: mitchell.merchandize@live.co.uk [217.174.252.30] X-Declude-Spoolname: 74908747.eml X-Declude-RefID: X-Declude-Note: Scanned by Declude 4.4.0 "http://www.declude.com/x-note.htm" X-Declude-Scan: Outgoing Score [0] at 18:56:41 on 19 Mar 2009 X-Declude-Tests: Whitelisted X-Country-Chain: X-Declude-Code: 0 X-Declude-Recipcount: 50 X-Identity: 217.174.252.30 | | caramail.com X-Greylist: Delayed for 00:17:47 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 19 Mar 2009 19:16:05 -0700 (PDT) X-Spam-Prev-Subject: PART TIME JOB OFFER Status: R X-Status: X-Keywords: X-UID: 192 Content-Length: 2711 Mitchell Merchandize. Sussex House,London Road East Grinstead West Sussex RH18 1HH United Kingdom Good day, Compliments of the day. My name is Andrew Mitchell, based in the U.K. I deal in sales and production of Electrical Goods. Based on the high level of competition in the fabrics industry, I have decided to travel all over the world to various exhibitions in other to show case my products to physical customers on a one-on-one basis. Despite the fact that this strategy increased my sales by about 25%,I am still facing some problems as regards payments. The major problem is that most of my customers are from the United States and they send payment in form of travellers cheques and certified checks cashable in the U.S. which takes months to clear down here in unitedkingdom I have decided not to turn down this mode of payment so that my sales wont drop but rather increase.! I am in need of sincere people leaving in United.State who will be willing to work as a part time job recieving payment on my behalve , this doesnt affect your current job . All you need is just to recieve payment ,deposit it in your bank and then take out ur share then am going instruct you on how to get the remaining funds to me. If you think you can be of help to me by being my Financial Representative in the U.S,then we can work together. You would be based on 15% commission for every payment you process and you can receive payments from my various customers weekly depending on how much money you would want to make. JOB DESCRIPTION: -Payments would be sent to you from my customers. -You take the payment to your bank for the cashing processes. -Deduct your 15% commission from the total amount after cashing. -Send the remaining to me/suppliers via WESTERN UNION MONEY TRANSFER/MONEYGRAM. You do not need any capital to start neither would you have to spend a dime.All we need from you is just a little bit of commitment sincerity and dedication. If you are interested in this benefiting job offer,then you would have to provide the following information for us to get started: And also i will email you a full passport photograph of myself to you so you know who you dealing with ..and i will also need any form of id from you as well YOUR FULL NAME [as it should appear on checks] YOUR FULL HOME ADDRESS [where payments would be sent to] PHONE NUMBERS: AGE: SEX: OCCUPATION: N.B:If you do not stay in the U.S and you feel you can still be of help,dont hesitate to respond. Please,endeavor to forward all these information to my direct email address: mitchell.merchandize@live.co.uk Hope to hear from you as soon as possible. Thank you and God Bless you. Andrew Mitchell -Manager From claim.officer@aol.nl Thu Mar 19 19:40:52 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,LOTTO_AGENT,LOTTO_YOU_WON_02, MILLIONS_01,MILLION_USD,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_NEUTRAL, THOUS_EMAIL_ADDRS,UNCLAIMED_MONEY,UNDISC_RECIPS,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=claim.officer%40aol.nl&ip=62.64.120.200&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 2.4 UNCLAIMED_MONEY BODY: People just leave money laying around * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from relay01.kiev.sovam.com (relay01.kiev.sovam.com [62.64.120.200]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2K2ehTi000681 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 19 Mar 2009 19:40:52 -0700 Received: from [83.170.209.226] (helo=gate1.novo-farm.com.ua) by relay01.kiev.sovam.com with esmtp (Exim 4.69) (envelope-from ) id 1LkTQ9-000Hac-FD; Fri, 20 Mar 2009 03:21:13 +0200 Received: from User (unknown [62.140.137.138]) by gate1.novo-farm.com.ua (Postfix) with ESMTP id AC9CDBBCE; Fri, 20 Mar 2009 03:33:11 +0200 (EET) Reply-To: From: "Mrs.VAN CARY" Subject: [SPAM] REMINDER,,,, Date: Fri, 20 Mar 2009 02:21:00 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090320013311.AC9CDBBCE@gate1.novo-farm.com.ua> To: undisclosed-recipients:; X-Scanner-Signature: 5e2df25549de819b25d1bfd51e9f52eb X-DrWeb-checked: yes X-Greylist: Delayed for 01:19:04 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 19 Mar 2009 19:40:52 -0700 (PDT) X-Spam-Prev-Subject: REMINDER,,,, Status: R X-Status: X-Keywords: X-UID: 193 Content-Length: 1876 AWARD WINNING NOTICE Ref No.00724/009 Batch No.312/00648NL Ticket/Series No.NL09874893 Amount Won: $2,500,000.00 USD Attn: Internet User, This is to formally inform and congratulate you on the result of the online cyber lotto which was conducted from an exclusive list of 1,000.000 email addresses of individual and corporate bodies selected by an advanced automated random computer ballot system from the internet. Your e-mail address emerged as a winner in the category "A" with the following information enclosed. You are therefore to receive a cash prize of $2,500,000.00. (Two Million Five Hundred Thousand United States Dollars). To file in for the processing of your prize winnings, You are required to Contact the Officer incharge below for confirmation. Endeavour to give him a call immediately on this numeber 0031-616-544-963, or email him back only on this email address : (dayzersloterij9@aol.com ) for urgent response to your claim process. ************************************* Mr.BRAM COOS Tele:+31-616-544-963 Fax: +31-847-393-086 Email:dayzersloterij9@aol.com ************************************* You are advice to provide him with the following information and a copy of your international passport or driver's license via email attachment or by fax for vetting process which is a standard practice just to ensure that we are dealing with the right individual. First name: Last Name: Telephone/Fax number: Nationality: Age: Occupation: Winning Email: NOTE: Ensure to quote your Reference Numbers in all your communication with your claims agent. All winnings must be claimed not later than seven working days, thereafter unclaimed funds would be included in the next stake. Congratulations! Thank you for being a user of the World Wide Web. Yours Faithfully, Mrs.VAN CARY http://www.lotto.nl/ Lottery Coordinator. From saraholmes2006@yahoo.com.cn Thu Mar 19 22:11:41 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************************** X-Spam-Status: Yes, score=53.5 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DATE_IN_PAST_03_06, DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS, MILLIONS_01,MILLION_USD,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, RCVD_IN_SBL,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SARE_FRAUD_X4,SUB_HELLO, TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 2.1 SUB_HELLO Subject starts with "Hello" * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.5 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9983] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.201.166.73 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.72 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.72 listed in psbl.surriel.com] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.72 listed in zen.spamhaus.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.72 listed in dnsbl.sorbs.net] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.nutechsystems.com (nutechsystems.com [64.201.166.73]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2K5BbKx005017 for ; Thu, 19 Mar 2009 22:11:41 -0700 Received: from User ([196.3.183.72]) by mail.nutechsystems.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 19 Mar 2009 14:08:15 -0400 Reply-To: From: "Sarah Holmes" Subject: [SPAM] HELLO Date: Thu, 19 Mar 2009 19:03:42 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="_iso-2022-jp$ESC" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 Bcc: Message-ID: X-OriginalArrivalTime: 19 Mar 2009 18:08:17.0109 (UTC) FILETIME=[AD922050:01C9A8BD] X-Greylist: Delayed for 02:17:53 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 19 Mar 2009 22:11:41 -0700 (PDT) X-Spam-Prev-Subject: HELLO Status: R X-Status: X-Keywords: X-UID: 194 Content-Length: 2341 Dear Beloved, I send my love and greetings to you. I am Mrs Sarah Holmes from United Kingdom. I am married to Late Dr. Fredrick Holmes of blessed memory who was oil explorer in Kuwait and Brunei for ten years before he died in the year 2005. We were married for ten years without a child. He died after a brief illness that lasted for only four days. Before his death we were committed to each other and respect each others interest. Since after his death, I too have been battling with both Cancer and fibroid problems, my doctor told me that I have few months to live due to my cancer problem that lead to a stroke attack. This bothers me so much as it have affected my speach and movement so badly. Having known my condition I decided to seek for your help. I am in search of a honest and sincere individual that will utilize this money the way I am going to instruct herein. When my late Husband was alive he Deposited the sum of $10Million (Ten Million United States Dollars) in a Security Company under my name, the money is deposited as Family Valuables/Treasure for security reasons. So if you are willing to take up this responsibility, you will have 20% of the US$10million to ensure that you are prepared for the task ahead, 75% of it will be used in all sincerity to fund orphanages, widows,research on cancer and also propagating the word of God and to ensure that the society upholds the views and beliefs of human existence, while 5% of the fund will be used for legal and attorney fees. I am taking this decision because the relatives of my husband have confiscated other of our wealth without giving any to the needy.Based on that I don't want to entrust this fund to any of them, and I have no child, I cannot take the fund to the grave. I don't want a situation where this money will be used in inappropriate manner. Since my health is retrogressing by all minute, so my dear please do get back to me and let me know if you are willing to carry out this work. Then I will make arrangement to prepare the Authorization through an Attorney for you to get Possession of this Fund. I pray that this letter bring you and your family good tiding while my dreams to help humanity rest squarely on your shoulders. Do remember me in your prayers because that is what I needed most for now. Remain Blessed, Mrs Sarah Holmes From vjayaprakash@newindia.co.in Fri Mar 20 14:15:04 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,FREEMAIL_FORGED,HTML_10_20,HTML_MESSAGE,L_SOME_STD_PROBS,MILLIONS_01, NORMAL_HTTP_TO_IP,NO_REAL_NAME,SARE_SUB_NEED_REPLY,SPAMMY_WEBMAIL, SUBJ_ALL_CAPS,UNPARSEABLE_RELAY,URG_BIZ,XHTML_01 autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 0.4 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 NORMAL_HTTP_TO_IP URI: Uses a dotted-decimal IP address in URL * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 HTML_10_20 BODY: Message is 10% to 20% HTML * 0.5 XHTML_01 RAW: Has XML-ish tags in HTML body * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.newindia.co.in ([210.212.176.45]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2KLEwE7031241 for ; Fri, 20 Mar 2009 14:15:03 -0700 Received: from av.newindia.co.in ([172.16.10.26]) by smreporter.newindia.co.in with InterScan Message Security Suite; Sat, 21 Mar 2009 01:11:36 +0530 Received: from mail.newindia.co.in (unknown [10.10.251.15])by av.newindia.co.in (Postfix) with ESMTPid 15879CB535; Sat, 21 Mar 2009 01:25:08 +0530 (IST) Received: from 212.100.250.216 (proxying for 62.173.44.38) (SquirrelMail authenticated user vjayaprakash@newindia.co.in) by mail.newindia.co.in with HTTP; Sat, 21 Mar 2009 01:21:46 +0530 (IST) Message-ID: <59155.212.100.250.216.1237578706.squirrel@mail.newindia.co.in> Date: Sat, 21 Mar 2009 01:21:46 +0530 (IST) Subject: [SPAM] I NEED YOUR URGENT RESPONSES From: vjayaprakash@newindia.co.in Reply-To: cpl.allenterry@gmail.com User-Agent: SquirrelMail/1.4.6-7.el3 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_20090321012146_68458" X-Priority: 3 (Normal) Importance: Normal To: undisclosed-recipients: X-imss-version: 2.053 X-imss-result: Passed X-imss-approveListMatch: *@newindia.co.in X-Greylist: Delayed for 01:03:27 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 20 Mar 2009 14:15:04 -0700 (PDT) X-Spam-Prev-Subject: I NEED YOUR URGENT RESPONSES Status: R X-Status: X-Keywords: X-UID: 195 Content-Length: 6703 ------=_20090321012146_68458 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Hello With trust and with gratitude. , I know this letter will definitely come to you as a huge surprise, but I implore you to take time and go through it carefully as the decision you make will go off a long way to determine my future and continued existence. Please allow me to introduce myself. I am Cpl. Terry Allen a US Marine commander of Multinational Division Center in Iraq and the 10th Mountain Division, serving in the 3rd Battalion, 25th Marine Regiment which Patrols the Amber province in Iraq. I am desperately in need of assistance and I have summoned up courage to contact you. I am presently in Iraq and I found your contact particulars in an address journal. I am seeking your assistance to evacuate the sum of $15,570,000.00 (Fifteen million Five Hundred and Seventy Thousand US dollars) to the States or any safe country of your choice, as far as I can be assured that it will be safe in your care until I complete my service here. This is no stolen money and there are no dangers involved. Clarity on the root of this money. Some money in various currencies was discovered and concealed in barrels with piles of weapons and ammunition at a location near one of Saddam Hussein's old Presidential Palaces during a rescue operation and it was agreed by all party present that the money be shared among us. This might appear as an illegal thing to do but I tell you what, No compensation can make up for the risks we have taken with our lives in this hell hole. The above figure was given to me as my share and to conceal this kind of money became a problem for me, so with the help of a British contact working with the UN here (his office enjoys some immunity) I was able to get the package out to a safe location and secured storage entirely out of trouble spot. He does not know the real contents of the package as he believes that it belongs to an American who died in an air raid, and before giving up trusted me to hand over the package to his family . I need to get the package out before its too late, for I do not know for how long I will remain here or survive it as I have been lucky to have survived 2 suicide bomb attacks by Pure Divine intervention. This and other reasons put into consideration have prompted me to reach out for help. If it might be of interest to you then Endeavor to contact me and we would work out the necessary formalities but I pray that you are discreet about this mutually benefiting relationship. This news page contains information's about my proposal and i will want to you view and keep my proposal confidential. http://news.bbc.co.uk/2/hi/middle_east/2988455.stm http://74.125.77.132/search?:mBQicxW_AncJ:www.drum.army.mil/sites/tenants/division/CMDGRP/CG/CG.htm+maj+gen+michael+Oates&cd=1&hl=en&ct=cln k Am waiting for your reply so that I can furnish you with more details. u have to contact me on my private email address by clicking reply to (cpl.allenterry@gmail.com) . Respectfully Yours, Cpl. Terry Allen. United States Marine Corps. IRAQ ------=_20090321012146_68458 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: 8bit


Hello
With trust and with gratitude. , I know this letter will definitely come to you as a huge surprise, but I implore you to take time and go

through it carefully as the decision you make will go off a long way to determine my future and continued existence.

Please allow me to introduce myself. I am Cpl. Terry Allen a US Marine commander of Multinational Division Center in Iraq and the 10th

Mountain Division, serving in the 3rd Battalion, 25th Marine Regiment which Patrols the Amber province in Iraq.

I am desperately in need of assistance and I have summoned up courage to contact you. I am presently in Iraq and I found your contact

particulars in an address journal. I am seeking your assistance to evacuate the sum of $15,570,000.00 (Fifteen million Five Hundred and

Seventy Thousand US dollars) to the States or any safe country of your choice, as far as I can be assured that it will be safe in your care

until I complete my service here. This is no stolen money and there are no dangers involved.

Clarity on the root of this money.

Some money in various currencies was discovered and concealed in barrels with piles of weapons and ammunition at a location near one of

Saddam Hussein's old Presidential Palaces during a rescue operation and it was agreed by all party present that the money be shared among

us. This might appear as an illegal thing to do but I tell you what, No compensation can make up for the risks we have taken with our lives

in this hell hole.

The above figure was given to me as my share and to conceal this kind of money became a problem for me, so with the help of a British

contact working with the UN here (his office enjoys some immunity) I was able to get the package out to a safe location and secured storage

entirely out of trouble spot. He does not know the real contents of the package as he believes that it belongs to an American who died in

an air raid, and before giving up trusted me to hand over the package to his family .

I need to get the package out before its too late, for I do not know for how long I will remain here or survive it as I have been lucky to

have survived 2 suicide bomb attacks by Pure Divine intervention. This and other reasons put into consideration have prompted me to reach

out for help. If it might be of interest to you then Endeavor to contact me and we would work out the necessary formalities but I pray that

you are discreet about this mutually benefiting relationship.

This news page contains information's about my proposal and i will want to you view and keep my proposal confidential.

http://news.bbc.co.uk/2/hi/middle_east/2988455.stm
http://74.125.77.132/search?:mBQicxW_AncJ:www.drum.army.mil/sites/tenants/division/CMDGRP/CG/CG.htm+maj+gen+michael+Oates&cd=1&hl=en&ct=cln

k
Am waiting for your reply so that I can furnish you with more details.

u have to contact me on my private email address by clicking reply to (cpl.allenterry@gmail.com) .

Respectfully Yours,

Cpl. Terry Allen.

United States Marine Corps. IRAQ ------=_20090321012146_68458-- From ack@telefonica.net Sat Mar 21 09:24:34 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************* X-Spam-Status: Yes, score=19.3 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_99,DATE_IN_FUTURE_06_12,DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO,FREEMAIL_FORGED,L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,SARE_FRAUD_X3,SPF_PASS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * -0.0 SPF_PASS SPF: sender matches SPF record * 1.7 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [69.251.116.37 listed in dnsbl.sorbs.net] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout3.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2LGOV0n029544 for ; Sat, 21 Mar 2009 09:24:34 -0700 Received: from User (69.251.116.37) by ctsmtpout3.frontal.correo (7.2.056.6) (authenticated as cialvera@infonegocio.com) id 49B2A14A0055A330; Sat, 21 Mar 2009 16:54:53 +0100 Message-ID: <49B2A14A0055A330@ctsmtpout3.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Chris Veenstra" To: chris.snsnl@rediffmail.com Subject: [SPAM] Regarding your payment Date: Sat, 21 Mar 2009 16:05:29 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:29:31 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 21 Mar 2009 09:24:34 -0700 (PDT) X-Spam-Prev-Subject: Regarding your payment Status: R X-Status: X-Keywords: X-UID: 196 Content-Length: 1488 Reference: NL-583206/SNS/09 YOUR ATTENTION IS REQUIRED ON THIS MATTER I am writing you once more to notify you that i need your consent with respect to payment of US$15,500,000.00 in SNS bank Nv belonging to a deceased customer whose name is not stated in this mail for reasons of privacy. My last check on Investor's deposits revealed an in active account with the above stated amount belonging to a deceased customer. The records for this deposit showed no beneficiary in the event of death of the depositor. In view of the above and my position as head of affairs of payment of benefits to beneficiaries, be notified that your last name identity which is same as that of the deceased can be accepted for a relative/beneficiary to this huge amount of money. For further enquiries/interest in this claim, send to me immediately your full name as they are in your driver's license or international passport, your mobile telephone number, your fax number if confidential and your contact address for the legal documentations of this claim. In receipt of your positive response, i will update you with the entire legal requirement for this claim. Yours faithfully Mr. Chris Veenstra SNS Bank Nv The Netherlands. This message is intended solely for the addressee or email bearer. Do not copy, reproduce, disseminate or distribute its content. If you have received this in error, you are advised to destroy or delete immediately. Going contrary to this warning may be unlawful. From jonathan@jinyun.com.tw Sat Mar 21 12:23:55 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.1 required=5.0 tests=BAYES_60,BL_COUNTRY_TW_2, EARN_PER_WEEK,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_39,LAUNDER_01,MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,RCVD_IN_BRBL,TO_CC_NONE,UNPARSEABLE_RELAY autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines * 1.0 LAUNDER_01 BODY: Money Laundering spam: payment representative * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.4 EARN_PER_WEEK BODY: Contains 'earn $something per week' * 0.6 J_CHICKENPOX_39 BODY: 3alpha-pock-9alpha * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7287] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.17.19.17 listed in b.barracudacentral.org] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.elive.com.tw (dns.elive.com.tw [210.17.19.17]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2LJNn7H002043 for ; Sat, 21 Mar 2009 12:23:54 -0700 Message-Id: <200903211923.n2LJNn7H002043@ga.impsec.org> Received: from User by jinyun.com.tw (MDaemon PRO v9.5.1) with ESMTP id md50000061830.msg for ; Sat, 21 Mar 2009 20:34:03 +0800 Reply-To: From: "Tracy Fines" Subject: [SPAM] PART -TIME WORK WITH IFR(Institute of Food Research) Date: Sat, 21 Mar 2009 21:42:28 +1100 MIME-Version: 1.0 Content-Type: text/plain; charset="koi8-u" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Authenticated-Sender: jonathan@jinyun.com.tw X-MDRemoteIP: 210.8.245.83 X-Return-Path: jonathan@jinyun.com.tw X-Envelope-From: jonathan@jinyun.com.tw X-MDaemon-Deliver-To: jhardin@impsec.org X-Greylist: Delayed for 01:48:01 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 21 Mar 2009 12:23:55 -0700 (PDT) X-Spam-Prev-Subject: PART -TIME WORK WITH IFR(Institute of Food Research) Status: R X-Status: X-Keywords: X-UID: 197 Content-Length: 3251 Greetings, My name is Tracy Fines , I am a freelance researcher. I would be very interested in offering you a part-time paying job in which you could earn a lot. I just resigned my job as a research scientist for IFR (Institute of Food Research) but i still work as a freelance consultant for the institute which gives me very much time to do my own work which is basically being a freelance researcher who could be employed by research institutes to do research projects anywhere in the world. WHAT YOU NEED TO DO FOR US Presently, I have just been granted a funding to head a research project in the tropical regions of West Africa regarding rare and vulnerable plant species and this would be commencing very soon, However my findings were by my American ,Asia,Western Europe counterparts which sent me the bunch of payments mostly in US based money orders. Getting an accountant in the states or opening an account would have been my best choice but I have a deadline to meet and taking any of those choices would cost me time and a whole lot of other requirements I am not ready to deal with as I would be traveling a lot in the meantime. So presently, assuming you would be able to deal with cash, "I would be willing to employ you on contract basis to be my payment representative , this way I could issue and make these money orders out to you, you could then cash them easily, withdraw 10% of the total amount on these money orders as your commission and then send the rest back to me through ! Western Union wire transfer". JOB DESCRIPTION? 1. Receive payment from Clients 2. Cash Payments at your Bank 3. Deduct 10% which will be your percentage/pay on Payment processed. 4. Forward balance after deduction of Percentage/pay to any of the offices you will be contacted to send payment to (Payment is to forwarded by Western Union Money Transfer). HOW MUCH WILL YOU EARN? 10% from each operation! For instance: you receive 7000 USD via cheques or money orders on our behalf. You will cash the money and keep 700usd (10% from 7000usd) for yourself! At the beginning your commission will equal 10%, though later it will increase up to 12%! ADVANTAGES You do not have to go out as you will work as an independent contractor right from your home office. Your job is absolutely legal. You can earn up to 3000usd-4000usd monthly depending on time you will spend for this job. You do not need any capital to start. The employees who make efforts and work hard have a strong possibility to become managers. Anyway our employees never leave us. MAIN REQUIREMENTS 18 years or older Legally capable Responsible Ready to work 3-4 hours per week. With PC knowledge E-mail and internet experience (minimal) And please know that Everything is absolutely legal, that's why You have to fill a contract! I would be glad if you accept my offer and I intend to commence on the job as soon as you are ready. Please note when replying fill the form below: Name: Full Address: (not p . o . box): City: State: Country: Zip code: Phone Number(s): Age: Sex: Current job: Email: Bank Name ONLY- Thanks for your anticipated action and i hope to hear back from you. Tracy Fines IFR(Institute of Food Research) Norwich Research Park Colney Norwich NR4 7UA UK From dammlluf@terra.es Sat Mar 21 16:46:13 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.8 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, SARE_FRAUD_X3,SARE_FREE_WEBM_EsTerra,SPF_PASS,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 1.7 SARE_FREE_WEBM_EsTerra Sender used free email account - may be * spammer * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [84.126.53.77 listed in dnsbl.sorbs.net] * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from IMPaqm2.telefonica.net (impaqm2.telefonica.net [213.4.149.62]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2LNk9AW008734 for ; Sat, 21 Mar 2009 16:46:13 -0700 Message-Id: <200903212346.n2LNk9AW008734@ga.impsec.org> Received: from IMPmailhost4.adm.correo ([10.20.102.125]) by IMPaqm2.telefonica.net with bizsmtp id VyqW1b00e2iL0W23MzVpVp; Sun, 22 Mar 2009 00:29:49 +0100 Received: from User ([84.126.53.77]) by IMPmailhost4.adm.correo with BIZ IMP id VzVl1b0091fwzpg1kzVn9e; Sun, 22 Mar 2009 00:29:49 +0100 X-TE-authinfo: authemail="dammlluf@terra.es" |auth_email="dammlluf@terra.es" X-TE-AcuTerraCos: auth_cuTerraCos="cosuitera01" Reply-To: From: "Business Proposal" Subject: [SPAM] Mr D.Raymond. Date: Sun, 22 Mar 2009 00:29:48 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:16:17 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 21 Mar 2009 16:46:13 -0700 (PDT) X-Spam-Prev-Subject: Mr D.Raymond. Status: R X-Status: X-Keywords: X-UID: 198 I decided to contact you for a business transaction to transfer of funds for investment purpose I am presently the Auditor General of a Bank, located in Madrid, Spain. I have determined to work this deal out if we can do business. This deal is worth taking and highly profitable. Upon your response send your full name and contact telephone numbers to enable me have a voice conversation with you, If this proposa l is acceptable by you, do not take undue advantage of the trust I have bestowed in you, I await your swift response via my personal mail : durayman2000@gmail.com Regards Mr Dulf Raymond. From marketing@ukfotomark.eu Sat Mar 21 17:42:49 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.7 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_3,PLING_PLING,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_SBL,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [83.170.209.226 listed in zen.spamhaus.org] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.3 PLING_PLING Subject has lots of exclamation marks * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from relay03.kiev.sovam.com (relay03.kiev.sovam.com [62.64.120.201]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2M0gh0x010332 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 21 Mar 2009 17:42:49 -0700 Received: from [83.170.209.226] (helo=gate1.novo-farm.com.ua) by relay03.kiev.sovam.com with esmtp (Exim 4.69) (envelope-from ) id 1Lkz7Y-000Cxa-55; Sat, 21 Mar 2009 13:12:08 +0200 Received: from User (212-182-176-138.ip.telfort.nl [212.182.176.138]) by gate1.novo-farm.com.ua (Postfix) with ESMTP id 67C9AC756; Sat, 21 Mar 2009 12:29:38 +0200 (EET) Reply-To: From: "Mrs. Rosemary Wood" Subject: [SPAM] Congratulations!!! Date: Sat, 21 Mar 2009 11:16:34 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090321102938.67C9AC756@gate1.novo-farm.com.ua> To: undisclosed-recipients:; X-Scanner-Signature: b36477657b07eb27dc67b07df918f397 X-DrWeb-checked: yes X-Greylist: Delayed for 13:30:11 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 21 Mar 2009 17:42:49 -0700 (PDT) X-Spam-Prev-Subject: Congratulations!!! Status: R X-Status: X-Keywords: X-UID: 199 E-MAIL Ref No: 77-45-2-12-47-22-4 Reply to Email: info@qiroyal.com Following official publication results of the E-mail electronic On-line Sweepstakes organized by the Euro Millions Lottery Corporation, the Slide circular award and the Heineken prizes in conjunction with the foundation for the promotion of software products, (F.P.S.), held on the 20th of March, 2009,in the Netherlands, Wherein your electronic email address emerged as one of the on-line winning emails in the 1st category, hence your email address was attached to a cash award of 1,000,000.00, (One Million Euro Only) contact person: Mr.Eric Van Der Brok TEL: +31-681-425-840 Fax: +31-847-521-470 Ticket Number 67-21-4-19-27-39,Ref No: 78-45-2-12-47-66-4,Lucky No: 10-20-30-36-40/*3*5,Batch No :JKPN44521412,Serial No: HMML235524453,Your Full Name & Telephone Number, Please note, all winning must be claimed not later than 28th of April 2009 Yours Sincerely MRS.Barbara Adams Reply to Email: info@qiroyal.com From rophinamegh@live.fr Sat Mar 21 23:02:46 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_60,BL_COUNTRY_CN_2,DATE_IN_PAST_06_12,DEAR_NOTHING,FORGED_MUA_OUTLOOK, INVALID_MSGID,J_CHICKENPOX_46,L_SOME_STD_PROBS,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,SPF_SOFTFAIL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_CN_2 Mail client in China * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=rophinamegh%40live.fr&ip=210.177.173.70&receiver=ga.impsec.org] * 0.8 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date * 0.6 J_CHICKENPOX_46 BODY: 4alpha-pock-6alpha * 1.0 DEAR_NOTHING BODY: Dear [nothing] * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7966] * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [116.10.198.42 listed in psbl.surriel.com] * 2.2 INVALID_MSGID Message-Id is not valid, according to RFC 2822 * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.twghintranet.org ([210.177.173.70]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2M62bVF018530 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 21 Mar 2009 23:02:44 -0700 Received: from User ([116.10.198.42]) by mail.twghintranet.org (IceWarp 9.3.2) with ASMTP id CZW87447; Sun, 22 Mar 2009 06:01:47 +0800 Reply-To: From: "Rophina Meigh" Subject: [SPAM] Calvary greeting from Mrs. Rophina Meigh Date: Sat, 21 Mar 2009 22:01:47 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: e8024cfbb0b779a1c3d00b4368a33247 X-Greylist: Delayed for 03:45:40 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 21 Mar 2009 23:02:46 -0700 (PDT) X-Spam-Prev-Subject: Calvary greeting from Mrs. Rophina Meigh Status: R X-Status: X-Keywords: X-UID: 200 Content-Length: 3341 Calvary greeting from Mrs. Rophina Meigh Donation for the House of God. My dear, All the glory, honour and thanksgiving belong to our Almighty God that gives us new day, strength and spiritual blessings. The Lord Jesus is so gracious, full of mercy and love,Praise the Lord; it is my pleasure to know you. Indeed, is so privilege that from among others, God have chosen you to divulge, something so hard to accept. My name is Mrs.Rophina Meigh. married to Late Eng. Pharabis Meigh who was a contractor before his sudden death. We were married for 17 yrs without a child. Due to customs of late husbands community, I was denied all inheritance from my beloved husband and his family pushed me out of my matrimonial home due to my childless. I am now staying in the hospital where I'm undergoing throat/breast cancer treatment which has been given me a sleepless night. But, no matter reports from the doctor, I strongly believe that Jehovah Ralph, the God that Healeth thee, Jehovah Jireh, the great provider will surely confirm his word in 1 Peter 2:24 upon my life because the Holy Scripture has made us to understand that with Faith, we shall sub due every situation in our lives. Dear, since my present condition will not allow me handling my promise to the house of the Lord, I decided to do nate this funds (8.920 million Euros) which is the only inheritance funds from my beloved husband that is under my custody, which his entire family does not know anything about the deposited funds by my husband and will never and never know, hence their evil maltreatments to my life immediately after the funeral of my husband. Now, this money is still with the financial institution where my husband deposited the funds and registered it as charitable belongings. I know that after you finish reading this message, it will be difficult for you to believe due to volume of amount that is involved but as a Christian that worship God in trust and Spirit, I want you to go into prayers, seek the face of God in order to have his confirmation over his divine directions to a sister that you have never seen before in all your life (The Lord is my strength and my shield; my heart trusts in him, Psalm 28:7). I strongly believe that the good God who directed me to you as the rightful person to handle this donation funds will surely speak to your hearing and understanding. Call to me and I will answer you and show you great and mighty things which you do not know (Jeremiah 33:3). I wait for your reply immediately after your communication with God who is able to open things of the secret to everyone that obey his commandments and work in his glorious ways. Praying for my situation is the most essential thing I need from you now as my fellow brethren in the Lord. Thanks and remain blessed. Mrs. Rophina Meigh This email and its attachments may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Tung Wah Group of Hospitals. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error. From agentevandernicks@gmail.com Mon Mar 23 05:56:34 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************************************** X-Spam-Status: Yes, score=46.1 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_BR_1,DNS_FROM_RFC_POST,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_52,LOTTO_ADMITS,LOTTO_AGENT,LOTTO_FROM, LOTTO_MANY,LOTTO_WIN_01,LOTTO_WIN_03,LOTTO_YOU_WON_01,LOTTO_YOU_WON_02, MILLIONS_01,MILLION_USD,NA_DOLLARS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01,SARE_LOTTO_SPAM2, SPF_NEUTRAL,SUBJ_ALL_CAPS,UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 2.0 LOTTO_FROM Admits to being a lottery * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=agentevandernicks%40gmail.com&ip=201.11.36.2&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.5 LOTTO_WIN_03 BODY: Won a prize * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 LOTTO_YOU_WON_01 BODY: You won! * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [201.11.36.2 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 LOTTO_MANY LOTTO_MANY * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from toronto.suldigital.com.br (toronto.suldigital.com.br [201.11.36.2]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2NCuSdg002801 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 23 Mar 2009 05:56:34 -0700 Received: from User (41-208-48-184.mtn.co.za [41.208.48.184]) by toronto.suldigital.com.br (Postfix) with ESMTP id E5869E8989C; Sat, 21 Mar 2009 17:48:17 -0300 (BRT) Reply-To: From: "ONLINE LOTTERY" Subject: [SPAM] YOU ARE A WINNER Date: Sat, 21 Mar 2009 22:49:20 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090321204818.E5869E8989C@toronto.suldigital.com.br> To: undisclosed-recipients:; X-Greylist: Delayed for 20:19:30 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 23 Mar 2009 05:56:34 -0700 (PDT) X-Spam-Prev-Subject: YOU ARE A WINNER Status: R X-Status: X-Keywords: X-UID: 201 Content-Length: 1661 We are happy to inform you that you have won a prize money of Three Million United States Dollars (US$3,000,000) for the month of March 2009 Lottery Win promotion which is organized by ONLINE LOTTERY every month. ONLINE LOTTERY, collects all the mail identity of the people online and among the millions that log on to the internet we only select five people every Month as our winners through electronic balloting System without the winner applying, we are congratulating you for having been one of the people selected. PAYMENT OF PRIZE AND CLAIM You are to contact your Claims Agent on or before your date of Claim, Winners Shall be paid in accordance with his/her Settlement Center. ONLINE LOTTERY Prize must be claimed no later than 7 days from date of Draw Notification after the Draw date in which Prize has won. Any prize not claimed within this period will be forfeited. These are your identification Numbers....................... Batch number..................... JHB/1/08 09102 Lotto number....................... JHBLW35447 Winning number...................JHB/ SA09788 These numbers are your winning identification numbers, that you will send it to your claims agent,Mr. Evander Nicks email address - evandernicks.fiduciary@gmail. com agentevandernicks@gmail.com for identification and further instructions. You are therefore advise to send the following information to the Claims Agent to facilitate them and process the transfer of your fund. 1.Full name 2.Contact Address 3.Telephone Number 4.Marital Status 5.Occupation 6.Date of Birth 7.Nationality Congratulations!! Once more. Yours Faithfully, ONLINE LOTTERY INC., From charitywork@lycos.co.uk Mon Mar 23 18:41:29 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.4 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_RU_1,DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_37,J_CHICKENPOX_44,LOTTO_YOU_WON_02,MILLIONS_01, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3, TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.belnet.ru (mail.belnet.ru [82.151.104.66]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2O1fNsF024015 for ; Mon, 23 Mar 2009 18:41:28 -0700 Received: from User [85.191.34.74] by mail.belnet.ru with ESMTP (SMTPD-10.01) id AC272150; Tue, 24 Mar 2009 02:32:55 +0300 Reply-To: From: "Funds For Work" Subject: [SPAM] Charity Work,good work of humanity Date: Tue, 24 Mar 2009 00:32:56 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090324023346.SM05192@User> X-Mail-Filters-ScanError: ScanError [-17] X-Greylist: Delayed for 00:16:13 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 23 Mar 2009 18:41:28 -0700 (PDT) X-Spam-Prev-Subject: Charity Work,good work of humanity Status: R X-Status: X-Keywords: X-UID: 202 Content-Length: 2761 Dear Beloved, How are you.I hope this email will meet you good heaith My name is Mrs. Maria Bejes I am a dying woman who has decided to donate what I have to charities through you. You may be wondering why I chose you.But someone has to be chosen. I am 59 years old and was diagnosed forcancer about 2 years ago, after the death of my husband who had left me everything he worked for. I have been touched by the Lord to donate from what I have inherited from my late husband to charity through you for the good work of humanity, rather than allow my relatives to use my husband's hard earned funds inappropriately. I have asked the Lord to forgive me all my sins and I believe he has,because He is merciful. I will be going in for an operation, and I pray that I survive the operation. I have decided to Will/Donate the sum of 10,300,000.00 (Ten Million three hundred thousand Dollars) to charities through you for the good work of the Lord, and to help the motherless,lessprivileged and also for the assistance of the widows. Presently, I have informed my consultant about my decision in willing this fund to charity through you. I wish you all the best and may the good Lord bless you abundantly, and please use the funds well and always extend the good work to others. If you are interested in carrying out this task, I will inform my consultant, so that he can arrange the release of the funds to you. I know I have never met you but my mind tells me to do this, and I hope you act sincerely. I decided that 30% of this money should be taken by you from the total sum upon the success release of this fund, because I am now too weak and fragile to do things myself because of my cancer.Presently, I,m in a hospital where I have been undergoing treatment for oesophageal cancerI have since lost my ability to talk. NB:This money has been packed into one box and the consignments"box" were tagged Diplomatic Luggage.You will be given the right to verify this directly with the Finance Security Bank company were the TruckBox is presently deposited. i want you to help me carry out the charity work to the motherless,lessprivileged and also for the assistance of the widows in the World. I will appreciate your utmost confidentiality in this matter until the task is accomplished, as I don't want anything that will jeopardize my last wish, due to the fact that I do not want relatives or family members standing in the way of my last wish. If you ready to carry on this task reply to: email address:bejesbejesn@aim.com God bless you and your family. Mrs.Maria Bejes PLEASE INCLUDE YOUR FULL NAME, ADDRESS, TELEPHONE/FAX NUMBER ON YOUR REPLY FOR EASY AND IMMEDIATE COMMUNICATION WITH MY CONSULTANT.Reply me via this email address:bejesbejesn@aim.com From jayamanna@gsmb.gov.lk Mon Mar 23 19:36:31 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=21.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,FREEMAIL_FORGED,J_CHICKENPOX_25, J_CHICKENPOX_42,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RCVD_IN_BRBL,SUBJ_ALL_CAPS,TO_CC_NONE,URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.6 J_CHICKENPOX_25 BODY: 2alpha-pock-5alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 59] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 59] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [220.247.219.22 listed in b.barracudacentral.org] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) Received: from mail.gsmb.gov.lk (mail.gsmb.gov.lk [220.247.219.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2O2aJhW025549 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 23 Mar 2009 19:36:30 -0700 Received: from mail.gsmb.gov.lk (localhost.localdomain [127.0.0.1]) by mail.gsmb.gov.lk (8.13.1/8.13.1) with ESMTP id n2NKRfeb032287; Tue, 24 Mar 2009 02:27:44 +0600 From: "Sgt Perry Rice" Reply-To: sgtperryrice11@gmail.com Subject: [SPAM] CAN I TRUST YOU ON THIS? Date: Tue, 24 Mar 2009 02:27:41 +0600 Message-Id: <20090323201638.M13670@mail.gsmb.gov.lk> X-Mailer: OpenWebMail 2.53 X-OriginatingIP: 41.217.2.8 (jayamanna) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 X-Greylist: Delayed for 04:36:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 23 Mar 2009 19:36:31 -0700 (PDT) X-Spam-Prev-Subject: CAN I TRUST YOU ON THIS? Status: R X-Status: X-Keywords: X-UID: 203 Content-Length: 1196 Hello friend, I hope my email meets you well. I am in need of your assistance. My name is Sgt Perry Rice. I am in the Engineering military unit here in Ba'qubah in Iraq,we have some amount of funds that we want to move out of the country. My partners and I need a good partner someone we can trust. It is oil money and legal.Basically since we are working for the government we cannot keep these funds, but we want to transfer and move the funds to you, so that you can keep it for us in your safe account or an offshore account. But we are moving it through Diplomatic means, to send it to your house directly or a bank of your choice using Diplomatic Courier Service. The most important thing is that can we trust you? Once the funds get to you, you take your 30% out and keep our own 70%. Your own part of this deal is to find a safe place where the funds can be sent to. Our own part is sending it to you.If you are interested i will furnish you with more details. But the whole process is simple and we must keep a low profile at all times. Waiting for your urgent response via my private email:sgtperryrice11@gmail.com This business is risk free. Regards, Sgt Perry Rice From f.mark@gmx.info Mon Mar 23 22:43:47 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************************** X-Spam-Status: Yes, score=38.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_21,J_CHICKENPOX_32, J_CHICKENPOX_34,J_CHICKENPOX_43,J_CHICKENPOX_44,J_CHICKENPOX_56,MILLIONS_01, MILLION_USD,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SPF_PASS,SUBJ_ALL_CAPS,TO_CC_NONE, URG_BIZ autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 0.4 URG_BIZ BODY: Contains urgent matter * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.gmx.net (mail.gmx.net [213.165.64.20]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n2O5hhAh030687 for ; Mon, 23 Mar 2009 22:43:47 -0700 Message-Id: <200903240543.n2O5hhAh030687@ga.impsec.org> Received: (qmail invoked by alias); 24 Mar 2009 05:23:38 -0000 Received: from unknown (EHLO User) [212.100.70.10] by mail.gmx.net (mp013) with SMTP; 24 Mar 2009 06:23:38 +0100 X-Authenticated: #54792306 X-Provags-ID: V01U2FsdGVkX1+2nCl5gUW25AwvxJFKIB9yg3yg2hrjm3Tk9W4jJK E7LY41yfciNObR Reply-To: From: "Alhaji Umaru Musa Yara'dua." Subject: [SPAM] FROM ANTI-CORRUPTION DEPARTMENT. Date: Tue, 24 Mar 2009 06:23:37 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Y-GMX-Trusted: 0 X-FuHaFi: 0.5 X-Greylist: Delayed for 00:20:01 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 23 Mar 2009 22:43:47 -0700 (PDT) X-Spam-Prev-Subject: FROM ANTI-CORRUPTION DEPARTMENT. Status: R X-Status: X-Keywords: X-UID: 204 Content-Length: 6004 FROM ANTI-CORRUPTION DEPARTMENT. OFFICE OF THE PRESIDENT ALHAJI UMARU MUSA YARA'DUA PRESIDENTAL VILLA GARIKI-ABUJA NIGERIA. DATE:24/03/2009. Our Ref: FGN /SNT/CBNXXCODE. Attn:Sir/Ma, TOPIC: INTERNATIONAL FUND TRANSFER UPDATES AND CONCERN. I, President Umaru Musa Yar'Adua's signed and seal Anti-Corruption War Department to claimed its first major casualty against some Ministers and top goverment officials who have been stealing money from the Federal Goverment Treasury Account which is meant for use to pay fourty eight (48). foreign beneficiary that are yet to receive their Contract Sum worth USD$12.5 Million. Presently we discovered that some certain miscreants pose as Bank/government officials to defraud innocent people off their hard earn money and in attempt to track their activity a monitoring committee was set up in Nigeria,London,United State of America and Holland to monitor the activities of this fraudstars. Presently we have been able to arrest more than fifty five culprits through the assistance and cooperation of their victims among which thirty is presently under going trial while a total of twenty seven is in jail. A total of USD40M have been recovered and handed back to the respective owners and personal properties of these fraudstars impounded. Your email address was extracted from our monitoring device while searching for the names and address of these fraudstars, meaning that you are in contact with one or more of these miscreants who in most cases are Africans and as such we request that you contact us immediately in order for us to get more details that will enable us track and monitor the activities of these fraudstars. For your information, you are not to disclose this information to anybody else they will abandone your proposed transaction and dissappear into tin-air thereby making it difficult for us to get to them. Meanwhile, I have ordered an immediate suspension from office of some Top Goverment Officials / Ministers who did not perform instructions i gave to them while they were still in office and their name have been listed below: (1): Dr. Samsudeen Usman ( Former Minister Of Finance ). (2): Alhaji Nuhu Ribadu ( Former EFCC Chairman ). (3): Mr. Abdulrahaman Ambali ( Former Chief Accountant of the Senate ). (4): Mrs Ebele Okeke ( Former Secreatary to Board of Trustees Senate). (5): Prof. Charles Soludo ( Present CBN Governor ) Still Under Probe. (6): Chief Pius Anyim ( Former Senate President ). (7): Chief Olusegun Obasanjo ( Former President ) Still Under Probe. (8): Mr. Bola Ahmed Tinubu ( Former Governor Of Lagos ) Still Under Probe. (9): Engr. Ebele Okeke ( Former Permanent Secretary in the Federal Ministry of Health). (10): Dr. Muri Akanji ( Former Foreign Affair Minister ). (11): Alhaji Abdulsalam Tunde ( Former Deputy General Nigerian Port ) (12): Mrs. Bisi Akande ( Former Chief Controller IRS). (13): Mr. Scott Williams ( Director General Of Foreign Fund ). (14): Mr. Tunde Lemo ( Former Deputy Governor - Financial Sector Surveillance ). (15): Mr. Ernest Chukwudi Ebi Obi ( Former Secretary to the Vice President ). (16): Mr. Patrick Azziza ( Former Chairman ATM CARD Department of CBN). (17): Chief Joseph Sanusi ( Former CBN Governor ). (18): Rev. Frederick ( Former Chairman Of Fund Borad Of Trustees ). Still Under Probe. (19): Mr. Michael Richard ( Former Director of IRS ). (20): Mr. Francis Nolan ( Former UNO Delegates ). The above listed names are been traced/investigated by my team and some of them have elope the country why some are stil in hideout and note that if any of them is caught and find guilty he/she will go to jail for 25 years(twenty five years) as it is under the Degree 47 of the constituition of Nigeria under section of criminal law,We still have more names which we will check in our DATABASE to confirm upon your response if any of them have taken money from you. As soon as i receive your response i will assign an attorney to you who will in turn update you and ensure that the funds you've already paid out is recovered and handed back to you including your contract sum, and the fraudstar will be persecuted accordingnly. Below are informations needed from you to assist us in our quest. 1) Your Name, Address, email and telephone number 2) The name of the person you are in contact with 3) His/Her email address which is very important because we can monitor where he/she is sending our the mails from (The server) 4) His/her telephone and fax number 5) His/her address if any and the Bank/institution being impersonated Kindly confirm your details which i will use to prepare a Letter Of Fund Release and Security Back-up: (a). Your Full Names: (b). Your Address: (c). Your Tel/Fax: (d). Your Age/Occupation: (e). Your Next Of Kin: I and my office are aware that most of them use fake identity and in most cases uses cell phone as their contact number but with their email address and cooperation from you, we assure you that within a short period of time they will be monitored and arrested using our email tracking device. We applogise on behalf of the Federal Goverment of Nigeria and the good citizens of Nigeria for any delay and lost this must have coursed you and promise that such thing will not happen again.And if you are dealing with any one of them regarding this payment we urge you to STOP because you are taking a big risk and you will never find your money because your funds in the total sum USD$12.5Million (Twelve Million five hunderd thousand United States Dollars) is now under a high security protection which i have signed and agreed to fulfil all foreign payments. Help fight crime to make this earth a better place to live in,I await your urgent response. You are WELCOME!!! Alhaji Umaru Musa Yara'dua GCFR,FRCN,NGR. President Of The Federal Republic Of Nigeria. E-mail: official.umarumusayaradua@gmail.com Private Email: official.umarumusayaradua@presidency.gov.ng From Jmoore102@web2mail.com Tue Mar 24 01:19:00 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.2 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_80,DEAR_FRIEND,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS, FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO,FREEMAIL_FROM,FREEMAIL_REPLYTO, L_SOME_STD_PROBS,MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01, TO_CC_NONE,X_PRIORITY_HIGH autolearn=disabled version=3.1.8 X-Spam-Report: * 0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 MSGID_FROM_MTA_ID Message-Id for external message added locally * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8079] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [78.41.207.192 listed in psbl.surriel.com] * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from rijtesten.rijtesten.be (rijtesten.colocated.redunix.net [78.41.207.192]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2O8IrPt002560 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 24 Mar 2009 01:18:59 -0700 Message-Id: <200903240818.n2O8IrPt002560@ga.impsec.org> Received: from [210.245.85.63] (helo=User) by rijtesten.rijtesten.be with esmtpa (Exim 4.68) (envelope-from ) id 1Lkuom-0008Rk-0u; Sat, 21 Mar 2009 07:36:31 +0100 Reply-To: From: "Mrs. Jane Moore" Subject: [SPAM] About your compensation payment Date: Sat, 21 Mar 2009 06:36:26 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-Greylist: Delayed for 73:41:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 24 Mar 2009 01:19:00 -0700 (PDT) X-Spam-Prev-Subject: About your compensation payment Status: R X-Status: X-Keywords: X-UID: 205 Content-Length: 2520 Dear Friend, I am Mrs Jane Moore. I am a US citizen and i am 48 years Old. I reside here in New Braunfels Texas. My residential address is as follows: 108 Crockett Court. Apt 303, New Braunfels Texas, United States; am thinking of relocating since I am now rich. I am one of those that took part in the United Nations Compensation program in Nigeria many years ago and they refused to pay me, i had paid over $20,000 while in the US, trying to get my payment but all was to no avail. So I decided to travel down to Nigeria with all my compensation documents and I was directed to meet Mrs. Sandra Matthews, who is the member of COMPENSATION PROGRAM COMMITTEE, and i contacted her and she explained everything to me. She said whoever is contacting us through emails are fake. She also took me to the paying bank (UBA BANK) for the claim of my Compensation payment. Right now, i am the happiest woman on earth because I have received my compensation funds of $5,000,000.00 moreover, Mrs. Sandra Matthews, showed me the full information of those that are yet to receive their payments and i saw your email as one of the beneficiaries who have not yet recived the payment under CASE FILE 54AC003, and that is why I decided to email you to stop dealing with those people. They are not with your fund, they are only making money off you. Therefore, i would advise you to contact Mrs. Sandra Matthews for assistance and inform her that your CASE FILE is 54AC003. Contact her directly via the information below. UNITED NATIONS COMPENSATION AWARD PROGRAM Name : Mrs. Sandra Matthews Email: sandramatthews47@web2mail.com Phone: +234-806-615-4068 You really have to stop dealing with those people that are contacting you and telling you that your fund is with them, it is not with them. They are only taking advantage of you and they will dry you up until you have nothing. The only money i paid after i met Mrs. Sandra Johnson was just the bank transfer charges, which is only normal and legitimate as it is in all banks in the world. So please take note of that. Mrs. Sandra Matthews shall ensure that you deal directly with the bank( UBA BANk). Once again stop contacting those people, I will advise you to contact Mrs. Sandra Matthews, so that she can help you in the collection of your transfer payment instead of dealing with those liars that will be turning you around asking for different kind of money to complete your transaction. Thank you and be blessed. Mrs. Jane Moore. From info.optusbb23@optusnet.com.au Tue Mar 24 08:02:34 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.7 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_NG_2,DNS_FROM_RFC_POST,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,J_CHICKENPOX_102,J_CHICKENPOX_33, J_CHICKENPOX_44,J_CHICKENPOX_54,SPF_PASS,SUBJ_ALL_CAPS,TO_CC_NONE, UPPERCASE_75_100 autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.6 J_CHICKENPOX_102 BODY: 10alpha-pock-2alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 UPPERCASE_75_100 message body is 75-100% uppercase * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail11.syd.optusnet.com.au (mail11.syd.optusnet.com.au [211.29.132.192]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2OF2MEE012988 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 24 Mar 2009 08:02:32 -0700 Received: from User ([82.128.35.110]) (authenticated sender info.optusbb23@optusnet.com.au) by mail11.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id n2OEkmBT028248; Wed, 25 Mar 2009 01:48:32 +1100 Message-Id: <200903241448.n2OEkmBT028248@mail11.syd.optusnet.com.au> Reply-To: From: "MR.GEORGE EBUKA" Subject: [SPAM] STRICTLY CONFIDENTIAL. Date: Tue, 24 Mar 2009 07:54:37 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: STRICTLY CONFIDENTIAL. Status: R X-Status: X-Keywords: X-UID: 206 Content-Length: 1509 MY DEAR FRIEND, STRICTLY CONFIDENTIAL. I KNOW THIS WILL COME TO YOU AS A SURPRISE BECAUSE YOU DO NOT KNOW ME.I AM MR. GEORGE EBUK, I WORK IN THE ECO-BANK COTONOU, REPUBLIC OF BENIN,WEST AFRICA, PACKAGING AND COURIER DEPARTMENT. I GOT YOUR CONTACT IN MY SEARCH FOR A HONEST PERSON THROUGH ONE OF MY COLLEAGUES HERE IN THE ECO-BANK WHO SAID THAT I CAN CONFIDE IN YOU. I WANT YOU TO HELP ME CLEAR THIS PACKAGE THAT IS ALREADY IN OVERSEAS WHICH I SHIPPED THROUGH OUR ECO-BANK ACCREDITED COURIER AGENT BUT THE CONTENTS OF THE PACKAGE IS ($20,000,000.0) ALL IN $100.00 BILLS, BELONGING TO OUR LATE COSTOMER WHO DIED EARLIER THIS YEAR, BUT THE COURIER COMPANY DOES NOT KNOW THAT IT IS MONEY THAT I HAVE IN THE PACKAGE. ALL I WANT YOU TO DO FOR ME NOW IS TO FORWARD TO ME THE BELOW INFORMATIONS YOUR CURRENT/PRIVATE MAILING ADDRESS YOUR PRIVATEPHONE AND FAX NUM AND I HOPE THAT AT THE END OF THE DAY,YOU WILL HAVE 40% AND 60% WILL BE FOR ME AND MY COLLEAGUES.MY IDENTITY MUST NOT BEREVEALED TO ANYBODY. IF THIS ARRANGEMENT IS OKAY BY YOU, YOUR DELIVERY INFORMATION SUCH AS ,YOUR FULL NAME,YOUR HOME ADDRESS ,COUNTRY,YOUR TELEPHONE NO, AND AGE E-MAIL ME AT ( georgeebuka111@googlemail.com ) FOR SECURITY REASONS. OTHER MODALITIES WILL BE DISCUSSED AS SOON AS YOU GET BACK TO ME INCLUDING SENDING OF THE KEYS TO THE BOXES TO YOU. NOTE: COMMUNICATION SHOULD BE STRICTLY THROUGH E-MAIL FOR SECURITY REASONS. YOURS FAITHFULLY, MR.GEORGE EBUKA. EMAIL(georgeebuka111@googlemail.com ) From ppostcode@yahoo.com.hk Tue Mar 24 09:07:55 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.6 required=5.0 tests=BAYES_99,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, LOTTO_YOU_WON_02,RCVD_IN_BL_SPAMCOP_NET,SUBJ_ALL_CAPS,TO_CC_NONE,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 TO_CC_NONE No To: or Cc: header * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp3.clear.net.nz (smtp3.clear.net.nz [203.97.33.64]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2OG7oK2014974 for ; Tue, 24 Mar 2009 09:07:54 -0700 Received: from User (ip191-65-210-87.adsl2.static.versatel.nl [87.210.65.191]) by smtp3.clear.net.nz (CLEAR Net Mail) with ESMTPA id <0KH000KT4PE7VC00@smtp3.clear.net.nz> for jhardin@impsec.org; Wed, 25 Mar 2009 04:52:25 +1300 (NZDT) Date: Tue, 24 Mar 2009 16:52:23 +0100 From: "Dr. Van Hans." Subject: [SPAM] POSTCODE ANNOUNCEMENT.NL Reply-to: postcodew@yahoo.com.hk Message-id: <0KH000KT5PEAVC00@smtp3.clear.net.nz> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Content-type: text/plain; charset=Windows-1251 Content-transfer-encoding: 7bit X-Priority: 3 X-MSMail-priority: Normal X-Greylist: Delayed for 00:15:04 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 24 Mar 2009 09:07:54 -0700 (PDT) X-Spam-Prev-Subject: POSTCODE ANNOUNCEMENT.NL Status: R X-Status: X-Keywords: X-UID: 207 POSTCODE ANNOUNCEMENT.NL We are pleased to inform you of the final announcement of Postcode On-line Promo Programme You have won $1,000,000.00 Dollars From Postcode Casino int N.L Urgenly get to the below contact immediately for claim. E:mail: postcodeloterij95@yahoo.com.hk Tell: +31-641-232-991 Fax: +31-847-367-971 Lucky Number 736-2257593-86 Ref:ES/9420X2/689 Contact: Dr. Van Hans. www.postcodeloterij.nl From almama@cantv.net Tue Mar 24 17:22:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.8 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,DNS_FROM_RFC_ABUSE,FORGED_RCVD_HELO, FREEMAIL_FORGED,J_CHICKENPOX_61,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, RCVD_IN_BRBL,SPAMMY_WEBMAIL,SPF_SOFTFAIL,TO_CC_NONE autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=almama%40cantv.net&ip=81.19.120.142&receiver=ga.impsec.org] * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [81.19.120.142 listed in b.barracudacentral.org] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 TO_CC_NONE No To: or Cc: header * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from quake.tukikohta.net (120-142.restricted.gw0.fi [81.19.120.142]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2P0M4ZE028969 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Tue, 24 Mar 2009 17:22:09 -0700 Received: from localhost ([127.0.0.1] helo=webmail.tukikohta.net) by quake.tukikohta.net with esmtp (Exim 4.63) (envelope-from ) id 1Ll4x2-0001JD-5Q; Sat, 21 Mar 2009 19:25:40 +0200 Received: from 41.202.75.235 (SquirrelMail authenticated user joonas) by webmail.tukikohta.net with HTTP; Sat, 21 Mar 2009 18:25:40 +0100 (CET) Message-ID: <1790.41.202.75.235.1237656340.squirrel@webmail.tukikohta.net> Date: Sat, 21 Mar 2009 18:25:40 +0100 (CET) Subject: [SPAM] My Friend? From: "Alex Mamadou" Reply-To: alex2008@alex4all.com User-Agent: SquirrelMail/1.4.9a MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Greylist: Delayed for 78:55:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 24 Mar 2009 17:22:10 -0700 (PDT) X-Spam-Prev-Subject: My Friend? Status: R X-Status: X-Keywords: X-UID: 208 Content-Length: 1497 -- >From Alex How Is Your Health? Thought you may not know me in person,I am Mr Alex Mamadou from Sierra Leone but residing in Ivory Coast in Africa. It is my desire to contact you on honesty and sincerity to assist me in transferring the sum of $8,000,000(Eight Million United States Dollars) inherited from my father late Mr. Kuma to your country for investment. My intention of contacting you is to help me to secure my inherited fund, which my late father packaged in a box and Deposited it with one of the security Company here in nurburgring country Abidjan Cote D 'Ivoire West Africa and declared it to them as (FAMILY VALUABLES) not as money, Due to the crises in my country Sierra Leone my late father moved this fund here and deposited it with a security company as the banks was not working then. I am motivated in contacting you and hope to gradually build trust, relationship and confidence in you as I get to know you better. So please I want to know if you will be of assistance but first I want to get to know you better.I am willing to offer you $1,600,000(One Million Six Hundred Thousand United States Dollars) for your effort input after the successful transfer of this money and investment of the money in your country . Indicate your interest towards assisting me by sending your phone # and address so that I can communicate with you at any time. I will be waiting for your response. Thanks Alex Telephone+00225 45571189 Reply via (alexmm@azet.sk From postcodep@yahoo.com Tue Mar 24 18:35:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=22.0 required=5.0 tests=BAYES_99,DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST,FORGED_MUA_OUTLOOK,FORGED_YAHOO_RCVD,FREEMAIL_FROM, FREEMAIL_REPLYTO,LOTTO_YOU_WON_02,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,TO_CC_NONE, YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.8 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 96] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 96] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 2.0 TO_CC_NONE No To: or Cc: header * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp5.clear.net.nz (smtp5.clear.net.nz [203.97.33.68]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2P1Z7fW030836 for ; Tue, 24 Mar 2009 18:35:11 -0700 Received: from User (ip191-65-210-87.adsl2.static.versatel.nl [87.210.65.191]) by smtp5.clear.net.nz (CLEAR Net Mail) with ESMTPA id <0KH100GLLFO6P730@smtp5.clear.net.nz> for jhardin@impsec.org; Wed, 25 Mar 2009 14:19:47 +1300 (NZDT) Date: Wed, 25 Mar 2009 02:19:44 +0100 From: DE CASINO OESINE INT 2009 Subject: [SPAM] EMAIL ID 2009nl.o Reply-to: postcodew@yahoo.com.hk Message-id: <0KH100GLMFO8P730@smtp5.clear.net.nz> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Content-type: text/plain; charset=Windows-1251 Content-transfer-encoding: 7bit X-Priority: 3 X-MSMail-priority: Normal X-Greylist: Delayed for 00:15:04 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 24 Mar 2009 18:35:11 -0700 (PDT) X-Spam-Prev-Subject: EMAIL ID 2009nl.o Status: R X-Status: X-Keywords: X-UID: 209 You have won $1,000,000.00 Dollars DE CASINO OESINE INT S.L E:mail: postcodeloterij95@yahoo.com.hk Tel: +31-641-232-991 Fax: +31-847-367-971 lucky number 736-22575993-86 Ref:ES/9420X2/68 Contact: Dr.David Van Hans. www.postcodeloterij.nl From info@telefonica.net Wed Mar 25 02:08:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.4 required=5.0 tests=ADVANCE_FEE_1,BAYES_99, BL_COUNTRY_NG_2,DNS_FROM_RFC_ABUSE,FORGED_MUA_OUTLOOK,FORGED_RCVD_HELO, FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,LOTTO_YOU_WON_03, L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_PASS autolearn=disabled version=3.1.8 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * -0.0 SPF_PASS SPF: sender matches SPF record * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ctsmtpout4.frontal.correo (outmailhost.telefonica.net [213.4.149.242]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2P983x2010205 for ; Wed, 25 Mar 2009 02:08:07 -0700 Received: from User (41.220.64.189) by ctsmtpout4.frontal.correo (7.2.056.6) (authenticated as habitatcosta@infonegocio.com) id 49B4D4EC0066AB84; Wed, 25 Mar 2009 09:50:14 +0100 Message-ID: <49B4D4EC0066AB84@ctsmtpout4.frontal.correo> (added by postmaster@telefonica.net) Reply-To: From: "Harry Gow" To: harrygow@rediffmail.com Subject: [SPAM] Another Notice. Date: Wed, 25 Mar 2009 00:50:25 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 081127-0, 11/27/2008), Outbound message X-Antivirus-Status: Clean X-Greylist: Delayed for 00:17:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 25 Mar 2009 02:08:07 -0700 (PDT) X-Spam-Prev-Subject: Another Notice. Status: R X-Status: X-Keywords: X-UID: 210 Content-Length: 1450 Greetings, I understand that through Internet is not the best way to link up with you because of the confidentiality which my proposal demands. However, I have already sent you this same letter one month ago, but I am not sure if it did get to you since I have not heard from you, hence i am constrain to reach you through the Internet which has been abused over the years. I wish to notify you again that You were listed as a Heir to the total sum of (Three Million Six Hundred Thousand British Pounds) in the codicil and last testament of the deceased.(Name now withheld since this is our second letter to you). I contacted you because you bear the surname identity and therefore can present you as the Heir to the inheritance funds. I therefore reckoned that you could receive these funds as you are qualified by your name identity. All the legal papers will be processed in your acceptance. In your acceptance of this deal, we request that you kindly forward to us your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at our high court probate division for the release of this sum of money. Please indicate your interest immediately for us to proceed. I shall feed you with full details of this transaction upon receipt of your reply towards this proposal. I look forward to hearing from you. Yours Faithfully, Mr. Harry Gow (Barrister) Telephone +447024058780. From beauchamp.hery@googlemail.com Thu Mar 26 06:08:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.5 required=5.0 tests=BAYES_99,BL_COUNTRY_CN_1, BL_COUNTRY_CN_2,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RCVD_DOUBLE_IP_LOOSE,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, SARE_RECV_IP_FROMIP1,SPF_NEUTRAL,STOX_58 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.42.159.8 listed in b.barracudacentral.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9974] * 1.7 SARE_RECV_IP_FROMIP1 Received line is IP address from IP address * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [210.42.159.8 listed in cn.countries.nerd.dk] * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.2 STOX_58 BODY: This company * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.8 RCVD_DOUBLE_IP_LOOSE Received: by and from look like IP addresses * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from eyou.net (mail.scuec.edu.cn [210.42.159.8]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n2QD8Vft002372 for ; Thu, 26 Mar 2009 06:08:36 -0700 X-EYOU-SPAMVALUE: 0 X-EYOU-DEALDRC: X-EMDG-VER: [2008-07-28] Received: (eyou anti_spam gateway 3.0); Thu, 26 Mar 2009 17:04:38 +0800 Message-ID: <438058278.17220@eyou.net> X-EYOUMAIL-SMTPAUTH: @ Received: from 216.133.240.233 by 210.42.159.8 with SMTP; Thu, 26 Mar 2009 17:04:36 +0800 Reply-To: From: "BEAUCHAMP INTERIORS" Subject: [SPAM] HELLO Date: Thu, 26 Mar 2009 01:07:41 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 04:00:27 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 26 Mar 2009 06:08:38 -0700 (PDT) X-Spam-Prev-Subject: HELLO Status: R X-Status: X-Keywords: X-UID: 211 Content-Length: 3085 Hello, Compliments, I am Henry Powell of BEAUCHAMP Interiors (wallpapers & fabrics). I have acquired your email address as a person who is actively involved in or is looking for an online business opportunity that would be like a part time job and compliment current earnings. If you will like to work online from home and get paid weekly without leaving or affecting your present job, Email Us Back at (beauchamp.henry@googlemail.com) for more information. If you are interested email back for further information and our attestation form WHAT YOU NEED TO DO FOR US: We presently need a trustworthy individual who would work with us from the USA and help Process payments made out to this company in any of the following forms (Cashiers Checks, Money Orders, Checks generally). This is because here in the UK processing Payments in these forms from the USA Takes quite a while and this delays orders and effectively puts us behind the competition. You would be entitled to 10% of each transaction you handle. This means if you process a payment for a Stock Print Fabric which costs $4000 you would be entitled to $400 which is 10% of the amount processed. The funds which would be sent out by the client in question would be made payable to you as our Executive Trustee. A BASIC JOB DESCRIPTION: 1. Receive payment from Clients 2. Process Payments 3. Deduct Ten percent, which will be your percentage/pay on Payment processed. 4. Forward balance after deduction of percentage/pay to any of the offices you will be contacted to send payment to VIA Western Union or Money Gram. DO YOU NEED TO PAY FOR THE TRANSFER FEE FROM YOUR PERCENTAGE? No you do not have to, all necessary transfer fees should be deducted from the Balance after you must have cashed and deducted your 10% of total money received. This is not a money laundering operation and will not breach any laws, each transfer will be processed in accordance with your countries laws. Do check our site for more information. www.beauchampinteriors.com Summary, I am looking for a trustworthy person who will work for me as a part-time Executive Trustee and I am willing to pay as high as Ten percent of every transaction, never the less this wouldn't affect your present state of work, someone trustworthy that would help me receive payments from my clients in the United States and process according to given instructions Note that no upfront charges are involved If you are interested, kindly get back to me at my private email (beauchamp.henry@googlemail.com) ASAP with the details required below. FULL NAME: HOME ADDRESS (NO P.O. BOXES): CITY: STATE: ZIP CODE: COUNTRY: CELL NUMBER: HOME NUMBER: WORK NUMBER: GENDER: AGE (Optional): CURRENT JOB: What is your preferred mode of communication? Phone/e-mail After which you will be sent a step by step guide and an attestation Form for our records Thanks. Henry Powell Beauchamp Interiors Unit 8-10 Red Rose Court Blackburn, BB2 1PS Ofice Number...+447035975837 Cell Number...+447045700804 www.beauchampinteriors.com Email:beauchamp.henry@googlemail.com From johnbanda07@home.com Thu Mar 26 11:43:35 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************************** X-Spam-Status: Yes, score=30.1 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_80,BL_COUNTRY_KR_1,BL_COUNTRY_KR_2,DEAR_FRIEND, DNS_FROM_RFC_BOGUSMX,DNS_FROM_RFC_DSN,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, J_CHICKENPOX_71,L_SOME_STD_PROBS,MISSING_HEADERS,NA_DOLLARS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01, RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6, SPF_HELO_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.92.140.22 listed in b.barracudacentral.org] * 1.5 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 1.5 DNS_FROM_RFC_DSN RBL: Envelope sender in dsn.rfc-ignorant.org * 0.5 BL_COUNTRY_KR_1 RBL: Mail client in Korea * [210.92.140.22 listed in kr.countries.nerd.dk] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [210.92.140.22 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8638] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ckdpharm.com (mail.ckdpharm.com [210.92.140.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2QIhVuk009063 for ; Thu, 26 Mar 2009 11:43:35 -0700 Received: from User ([41.198.105.2]) by ckdpharm.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 27 Mar 2009 03:25:53 +0900 Reply-To: From: "Gaga" Subject: [SPAM] Good Business Date: Thu, 26 Mar 2009 18:25:45 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 26 Mar 2009 18:25:55.0000 (UTC) FILETIME=[4D03BB80:01C9AE40] X-Greylist: Delayed for 00:15:46 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 26 Mar 2009 11:43:35 -0700 (PDT) X-Spam-Prev-Subject: Good Business Status: R X-Status: X-Keywords: X-UID: 212 Content-Length: 1963 From: John Gaga, Accra-Ghana. Dear Friend, First I must solicit your strictest confidence in this transaction and I pray that my decision to contact you will be given genuine approval considering the facts you and I just meet in the net, I wish to use this opportunity to introduce myself to you. I am John Gaga. from Sierra-Leone. I write you to know my desires to invest in your country; I am the first son of Jonathan P.Gaga, who was the former Minister of Mines and Industry. My father had a bullet wounds by the rebels on his way traveling to the Capital city Freetown along with my sister. My sister died on the spot while (U.N) Peace keeping force rescued my father, he later died after eleven months. Before his death he told me about the box containing $18.5 million U.S Dollars to look after my self and my Mother and shouldn?t go to Sierra-Leone for my safety. Why my father deposited the fund in the security company in Ghana is for safety of the fund. Presently, my mother and I are here in Accra Ghana West Africa to notify the security company for the claims of the FUND, and we are staying in the refugee camp. Therefore I want you to lecture me on how best we can invest this money in your country and as I told you I really wanted to buy a house when I come there. My father told me it is dangerous to invest this money in Africa to avoid suspicious, due to bad economy and political instability facing Africa countries that is why I want to invest in abroad. For your foreign assistance I and my mother have agreed to offer 15% of the total amount of the money. We have all the vital documents covering the deposit fund and the ownership which I can send to you on request. NOTE: I have never disclosed this to any person apart from you, so you have to keep this matter very confidential. Send me your Private phone and fax numbers for more information and a brief description of yourself for mutual relationship. Best Regards, Mr.John Gaga. From fordps@optusnet.com.au Thu Mar 26 19:17:46 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************************************** X-Spam-Status: Yes, score=42.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,BL_COUNTRY_TW_1,BL_COUNTRY_TW_2, DATE_IN_PAST_03_06,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2, L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,MSOE_MID_WRONG_CASE,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SPF_NEUTRAL, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.17.16.97 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [210.17.16.97 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [196.3.183.73 listed in dnsbl.sorbs.net] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.73 listed in zen.spamhaus.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.73 listed in psbl.surriel.com] * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 0.0 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [210.17.16.97 listed in tw.countries.nerd.dk] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ms2.recovery.org.tw (smtpin1.chineeg.com [210.17.16.97] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2R2Hfbj022864 for ; Thu, 26 Mar 2009 19:17:46 -0700 Received: from localhost (localhost.localdomain [127.0.0.1]) by ms2.recovery.org.tw (Postfix) with SMTP id CCC5848B88; Fri, 27 Mar 2009 00:20:05 +0800 (CST) Received: from User (unknown [196.3.183.73]) by ms2.recovery.org.tw (Postfix) with ESMTP id 75AE04807C; Thu, 26 Mar 2009 22:30:59 +0800 (CST) Reply-To: From: "DR. OLIVER JOHNSON" Subject: [SPAM] ATTENTION: BENEFICIARY Date: Thu, 26 Mar 2009 15:36:19 +0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090326143110.75AE04807C@ms2.recovery.org.tw> To: undisclosed-recipients:; X-Greylist: Delayed for 07:23:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 26 Mar 2009 19:17:46 -0700 (PDT) X-Spam-Prev-Subject: ATTENTION: BENEFICIARY Status: R X-Status: X-Keywords: X-UID: 213 Content-Length: 2877 >From The Desk of Dr. Oliver Johnson >From Foreign Remittance Dept of Global Bank Nig plc, Corporate Office. 136, Adeola Odeku Road, Victoria Island, Lagos Branch. Tel: 234-8078-4566-76 Email: oliverjohnson@uku.co.uk Attention:Beneficiary Best compliment of the day. My name is Dr. Oliver Johnson, from foreign remittance dept of Global Bank Nig plc, branch section, in charge of credit and foreign bills of one of the Global Bank Nig plc. However, I got your contact through my internet search. I am writing in respect of a foreign customer of my Bank Engr. Mark Steven, who perished with his whole family of wife and 2 kids along with 144 others which includes the then Nigerian sports minister late Ishaya mark Aku, in an Eas air-line plane crash in Kano northern Nigeria on may 4th 2002.There is an account opened in this Bank in 2002 with account number ats1022002-109 by this great late industrialist who died in the plane crash without a written or oral "will" attached to his account. I am the account manager to the late industrialist and I personally have watched with keen interest to see the next of kin since his death in 2002. This has proved abortive as no one has come up to claim his funds hence there is no next of kin or "will" attached to the account. As a banker to the deceased, I am capable of transferring the credit balance of the late industrialist's account to any foreign bank account of my choice since I have the certificate of deposit for the smooth transfer. The total amount involved is (US$14m million United States dollars). however, I need a foreign partner who will act as the next of kin and beneficiary to the industrialist and provide a reliable offshore bank account where we can transfer the (US$14m million united states dollars).I have already done all the necessary ground works for the smooth transfer of the funds. However, I need you to act as the next of kin to the deceased. Since I have the certificate of deposit that can be used to back up any claim we may make for the smooth transfer, the moment I receive your positive response, it will take us less than 7 banking days to transfer the money into your bank account. For your assistance and co-operation, you will take 40%, 50% to me, while 10% should be for expenses or tax as your government may require of the entire (US$14m million united states dollars), all I require is your honest co-operation to enable us see this deal through . Upon the receipt of your positive response, I shall forward to you a text of application which you will send to the bank for claim, I shall also send the certificate of deposit to you, you may also wish to view this web site on the internet to confirm the plane crash http://www.airdisaster.com/photos/eas-kano/photo.shtml Thank you as I await your Immediate Reply. Gratefully treat as urgent Dr. Oliver Johnson. From lofovasy1@yahoo.co.jp Wed Mar 18 00:54:31 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.9 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_JP_1,DNS_FROM_RFC_POST, FREEMAIL_FROM,HTML_MESSAGE,HTML_STOOPID_02,HTML_TINY_FONT,NO_REAL_NAME, PHISH_05,SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_PASS,YAHOO_SPAM autolearn=disabled version=3.1.8 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.3 HTML_TINY_FONT RAW: body contains 1 or 0-point font * 0.5 HTML_STOOPID_02 RAW: stupid HTML: empty STRONG tag * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.7 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from web4010.mail.ogk.yahoo.co.jp (web4010.mail.ogk.yahoo.co.jp [124.83.200.57]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n2I7sRrZ029019 for ; Wed, 18 Mar 2009 00:54:31 -0700 Received: (qmail 33111 invoked by uid 60001); 18 Mar 2009 07:27:45 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=yj20050223; d=yahoo.co.jp; h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type; b=gE/bIDuBVhViaFIK0nKVh00SFCVfiZ2j+m07Ba7al5cLxUfNrS1rFNa6Ie/J3tH3tJQ/3+0/sNEzwOFMzUyaJ/qkmZfgg2+DEp/kogZC66tR3OTUV7FndIiwbGiKHFtK ; Message-ID: <20090318072745.33109.qmail@web4010.mail.ogk.yahoo.co.jp> Received: from [41.189.51.58] by web4010.mail.ogk.yahoo.co.jp via HTTP; Wed, 18 Mar 2009 16:27:45 JST Date: Wed, 18 Mar 2009 16:27:45 +0900 (JST) From: Subject: [SPAM] Hi Dear, To: lofovasy1@yahoo.co.jp MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-224000578-1237361265=:32813" X-Greylist: Delayed for 00:26:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 18 Mar 2009 00:54:31 -0700 (PDT) X-Spam-Prev-Subject: Hi Dear, Status: R X-Status: X-Keywords: X-UID: 214 Content-Length: 4076 --0-224000578-1237361265=:32813 Content-Type: text/plain; charset=iso-2022-jp Hi Dear, l saw your profil and go through it and willing to contact you, I have to introduce myself for you, I am Mr.Lofo Vasy, the only son of late Chief and Mrs George Vasy, I wish to request for your assistance in my efforts to procure the transfer of my inherited funds for investment ventures. I have ($10.8m) Dollars here in my name with one of the prime banks here and I will require for your assistance in receiving the transfer of the funds in your local bank account for investment purposes. As it is my desire to come over to your country to further my education while you take goodcare of the investment, I will be very glad to give you 20% of the total sum for your co-operation. I will be very appreciative if you can return to me with urgent dispatch to enable me advise you on the modalities. I am waiting for your immediate response. My Kind Regards! Mr.Lofo Vasy --------------------------------- Power up the Internet with Yahoo! Toolbar. --0-224000578-1237361265=:32813 Content-Type: text/html; charset=iso-2022-jp
Hi Dear,
l saw your profil and go through it and willing to contact you, I have to introduce myself for you, I am Mr.Lofo Vasy, the only son of late Chief and Mrs George Vasy, I wish to request for your assistance in my efforts to procure the transfer of my inherited funds for investment ventures.
 
I have ($10.8m)  Dollars here in my name with one of the prime banks here and I will require for your assistance in receiving the transfer of the funds in your local bank account for investment purposes. As it is my desire to come over to your country to further my education while you take goodcare of the investment, I will be very glad to give you 20% of the total sum for your co-operation.
 
I will be very appreciative if you can return to me with urgent dispatch to enable me advise you on the modalities.
 
I am waiting for your immediate response.
 
My Kind Regards!
Mr.Lofo Vasy
 
 

Power up the Internet with Yahoo! Toolbar.
--0-224000578-1237361265=:32813-- From evandern@gmail.com Tue Mar 24 22:51:05 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ga.impsec.org X-Spam-Level: ******************************************* X-Spam-Status: Yes, score=43.6 required=5.0 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, ADVANCE_FEE_3,BAYES_99,BL_COUNTRY_BR_1,DNS_FROM_RFC_POST,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_52,LOTTO_ADMITS,LOTTO_AGENT,LOTTO_FROM,LOTTO_MANY,LOTTO_WIN_01, LOTTO_WIN_03,LOTTO_YOU_WON_01,LOTTO_YOU_WON_02,MILLIONS_01,MILLION_USD, NA_DOLLARS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RBL_PSBL_01,RCVD_IN_BRBL,SARE_LOTTO_SPAM2,SPF_NEUTRAL,SUBJ_ALL_CAPS, UNDISC_RECIPS autolearn=disabled version=3.1.8 X-Spam-Report: * 0.8 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 2.0 LOTTO_FROM Admits to being a lottery * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * [SPF failed: Please see http://www.openspf.org/why.html?sender=evandern%40gmail.com&ip=201.11.36.2&receiver=ga.impsec.org] * 1.0 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.5 LOTTO_WIN_03 BODY: Won a prize * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.8 MILLION_USD BODY: Talks about millions of dollars * 1.0 LOTTO_YOU_WON_01 BODY: You won! * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [201.11.36.2 listed in b.barracudacentral.org] * 2.0 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [201.11.36.2 listed in psbl.surriel.com] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 1.4 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.0 LOTTO_MANY LOTTO_MANY * 3.3 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from toronto.suldigital.com.br (toronto.suldigital.com.br [201.11.36.2]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2P5oxgx005005 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 24 Mar 2009 22:51:05 -0700 Received: from User (unknown [41.30.162.22]) by toronto.suldigital.com.br (Postfix) with ESMTP id ED754EB9DF8; Tue, 24 Mar 2009 21:11:27 -0300 (BRT) Reply-To: From: "ONLINE LOTTERY" Subject: [SPAM] YOU ARE A WINNER Date: Wed, 25 Mar 2009 02:11:22 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090325001127.ED754EB9DF8@toronto.suldigital.com.br> To: undisclosed-recipients:; X-Greylist: Delayed for 01:19:36 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 24 Mar 2009 22:51:05 -0700 (PDT) X-Spam-Prev-Subject: YOU ARE A WINNER Status: R X-Status: X-Keywords: X-UID: 215 Content-Length: 1636 We are happy to inform you that you have won a prize money of Three Million United States Dollars (US$3,000,000) for the month of March 2009 Lottery Win promotion which is organized by ONLINE LOTTERY every month. ONLINE LOTTERY, collects all the mail identity of the people online and among the millions that log on to the internet we only select five people every Month as our winners through electronic balloting System without the winner applying, we are congratulating you for having been one of the people selected. PAYMENT OF PRIZE AND CLAIM You are to contact your Claims Agent on or before your date of Claim, Winners Shall be paid in accordance with his/her Settlement Center. ONLINE LOTTERY Prize must be claimed no later than 7 days from date of Draw Notification after the Draw date in which Prize has won. Any prize not claimed within this period will be forfeited. These are your identification Numbers....................... Batch number..................... JHB/1/08 09102 Lotto number....................... JHBLW35447 Winning number...................JHB/ SA09788 These numbers are your winning identification numbers, that you will send it to your claims agent,Mr. Evander Nicks email address - evandernick@gmail.com evandern@gmail.com for identification and further instructions. You are therefore advise to send the following information to the Claims Agent to facilitate them and process the transfer of your fund. 1.Full name 2.Contact Address 3.Telephone Number 4.Marital Status 5.Occupation 6.Date of Birth 7.Nationality Congratulations!! Once more. Yours Faithfully, ONLINE LOTTERY INC From utpayo09@hotmail.es Fri Mar 27 05:41:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=17.0 required=5.0 tests=BAYES_99,BAYES_POISON_02, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,LOTTO_YOU_WON_02, MISSING_HEADERS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RCVD_IN_BL_SPAMCOP_NET,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 BAYES_POISON_02 Appears to have "bayes poison" unpunctuated text * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp3.clear.net.nz (smtp3.clear.net.nz [203.97.33.64]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2RCfMYp007312 for ; Fri, 27 Mar 2009 05:41:25 -0700 Received: from User (ip191-65-210-87.adsl2.static.versatel.nl [87.210.65.191]) by smtp3.clear.net.nz (CLEAR Net Mail) with ESMTPA id <0KH50081PZQH3X30@smtp3.clear.net.nz> for jhardin@impsec.org; Sat, 28 Mar 2009 01:23:29 +1300 (NZDT) Date: Fri, 27 Mar 2009 13:23:29 +0100 From: "DE CASINO OESINE INT S.L 09" Subject: [SPAM] EMAIL ID 2009nl.k Reply-to: infolacaixabka@aol.com Message-id: <0KH50081RZQJ3X30@smtp3.clear.net.nz> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Content-type: text/plain; charset=Windows-1251 Content-transfer-encoding: 7bit X-Priority: 3 X-MSMail-priority: Normal X-Greylist: Delayed for 00:16:29 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 27 Mar 2009 05:41:26 -0700 (PDT) X-Spam-Prev-Subject: EMAIL ID 2009nl.k Status: R X-Status: X-Keywords: X-UID: 216 You have won $1,500,000.00 Dollars DE CASINO OESINE INT S.L E:mail: n8nfobankn8@yahoo.com.hk Tel: +31-61-909-8936 Fax: +31-84-724-9563 lucky number 736-22575993-86 Ref:ES/9420X2/68 Mr.Walter Jones From benmensinck@hetnet.nl Sat Mar 28 17:45:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n2T0j24j029917 for ; Sat, 28 Mar 2009 17:45:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******* X-Spam-Status: Yes, score=7.7 required=5.0 tests=BAYES_99,HTML_MESSAGE, MIME_QP_LONG_LINE,MISSING_HEADERS,SPAMMY_HEADER_11,SPAMMY_HEADER_12 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.3 SPAMMY_HEADER_11 Found a Thread-Index header * 0.2 SPAMMY_HEADER_12 Found a Content-Class header * 1.3 MISSING_HEADERS Missing To: header * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Sat, 28 Mar 2009 17:45:03 -0700 (PDT) Received: from hpsmtp-eml17.kpnxchange.com (hpsmtp-eml17.KPNXCHANGE.COM [213.75.38.117]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2T0iB4I003107 for ; Sat, 28 Mar 2009 17:44:15 -0700 Received: from hpsmtp-eml27.kpnxchange.com ([213.75.38.127]) by hpsmtp-eml17.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959); Sun, 29 Mar 2009 01:21:40 +0100 Received: from cpbrm-eml17.kpnsp.local ([213.75.38.7]) by hpsmtp-eml27.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959); Sun, 29 Mar 2009 01:20:51 +0100 Received: from hpsmtp-eml28.kpnxchange.com ([10.94.53.250]) by cpbrm-eml17.kpnsp.local with Microsoft SMTPSVC(6.0.3790.3959); Sun, 29 Mar 2009 01:20:41 +0100 Received: from localhost ([10.94.53.250]) by hpsmtp-eml28.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959); Sun, 29 Mar 2009 01:20:35 +0100 Content-class: urn:content-classes:message MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C9B004.0A493143" X-MimeOLE: Produced By Microsoft Exchange V6.5 Subject: [SPAM] Greetings from Hazel Bedford Date: Sun, 29 Mar 2009 01:19:35 +0100 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Greetings from Hazel Bedford Thread-Index: AcmwA/5ywUkP3SPiRwCm9QpZ1OgFJw== From: Bcc: X-OriginalArrivalTime: 29 Mar 2009 00:20:35.0571 (UTC) FILETIME=[2E0CAC30:01C9B004] X-Greylist: Delayed for 00:22:18 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 28 Mar 2009 17:44:15 -0700 (PDT) X-Spam-Prev-Subject: Greetings from Hazel Bedford Status: R X-Status: X-Keywords: X-UID: 217 Content-Length: 1724 This is a multi-part message in MIME format. ------_=_NextPart_001_01C9B004.0A493143 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Greetings from Hazel Bedford Dear Beloved, my name is Hazel Bedford. I reside in the United Kingdom = but presently I am Ill. I need your assistance as a beneficiary to = collect the sum of 15MillionGBP from a security company in Holland. I will like to give you more details about this, so please contact me = back at my private address hazelbedf71@yahoo.com.hk I shall give you the = whole details. Thanks. Mrs. Hazel Bedford ------_=_NextPart_001_01C9B004.0A493143 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =0A= =0A= =0A= =0A=
Greetings from Hazel = Bedford
=0A=
Dear Beloved, my name = is Hazel Bedford. I reside in the United Kingdom but presently I am Ill. = I need your assistance as a beneficiary to collect the sum of = 15MillionGBP from a security company in Holland.
=0A=
I will like to give you = more details about this, so please contact me back at my private address = hazelbedf71@yahoo.com.hk = I shall give you the whole details. Thanks.
=0A=
Mrs. Hazel = Bedford
------_=_NextPart_001_01C9B004.0A493143-- From loto.europe@gmail.com Fri Mar 27 17:05:18 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.7 required=5.0 tests=BAYES_99,BAYES_POISON_02, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,LOTTO_YOU_WON_01, LOTTO_YOU_WON_02,MISSING_HEADERS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET, SPF_NEUTRAL,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [84.120.70.208 listed in dnsbl.sorbs.net] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9998] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.0 LOTTO_YOU_WON_01 BODY: You won! * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 0.8 BAYES_POISON_02 Appears to have "bayes poison" unpunctuated text * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp4.clear.net.nz (smtp4.clear.net.nz [203.97.37.64]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2S05EV3027353 for ; Fri, 27 Mar 2009 17:05:18 -0700 Received: from User (84.120.70.208.dyn.user.ono.com [84.120.70.208]) by smtp4.clear.net.nz (CLEAR Net Mail) with ESMTPA id <0KH600JZPVIZ3410@smtp4.clear.net.nz> for jhardin@impsec.org; Sat, 28 Mar 2009 12:50:08 +1300 (NZDT) Date: Fri, 27 Mar 2009 16:49:54 -0700 From: "Mrs.Walter Jones" Subject: [SPAM] AMT Reply-to: fconsultores44@informaticos.com Message-id: <0KH600JZQVJ13410@smtp4.clear.net.nz> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Content-type: text/plain; charset=Windows-1251 Content-transfer-encoding: 7bit X-Priority: 3 X-MSMail-priority: Normal X-Greylist: Delayed for 00:15:04 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 27 Mar 2009 17:05:18 -0700 (PDT) X-Spam-Prev-Subject: AMT Status: R X-Status: X-Keywords: X-UID: 218 Your Email have won $1,500,000.00 Dollars DE CASINO OESINE INT S.L E:mail: infolacaixadonald@yahoo.com.hk Tel :+34-693-572-703 Fax :+1-518 684-1775 lucky number 736-22575993-86 Ref:ES/9420X2/68 Mr.Walter Jones From johngaga07@gaga.com Fri Mar 27 22:39:02 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************************** X-Spam-Status: Yes, score=30.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_KR_1,BL_COUNTRY_KR_2,DEAR_FRIEND, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,J_CHICKENPOX_71,L_SOME_STD_PROBS, MISSING_HEADERS,NA_DOLLARS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4, SARE_FRAUD_X5,SARE_FRAUD_X6,SPF_HELO_PASS,SPF_NEUTRAL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.92.140.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [210.92.140.22 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_KR_1 RBL: Mail client in Korea * [210.92.140.22 listed in kr.countries.nerd.dk] * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ckdpharm.com (mail.ckdpharm.com [210.92.140.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2S5curb003768 for ; Fri, 27 Mar 2009 22:39:01 -0700 Received: from User ([41.198.105.2]) by ckdpharm.com with Microsoft SMTPSVC(6.0.3790.1830); Sat, 28 Mar 2009 13:15:41 +0900 Reply-To: From: "John" Subject: [SPAM] Good Business Date: Sat, 28 Mar 2009 04:15:20 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 28 Mar 2009 04:15:43.0000 (UTC) FILETIME=[DC51C180:01C9AF5B] X-Greylist: Delayed for 01:22:19 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 27 Mar 2009 22:39:02 -0700 (PDT) X-Spam-Prev-Subject: Good Business Status: R X-Status: X-Keywords: X-UID: 219 Content-Length: 1963 From: John Gaga, Accra-Ghana. Dear Friend, First I must solicit your strictest confidence in this transaction and I pray that my decision to contact you will be given genuine approval considering the facts you and I just meet in the net, I wish to use this opportunity to introduce myself to you. I am John Gaga. from Sierra-Leone. I write you to know my desires to invest in your country; I am the first son of Jonathan P.Gaga, who was the former Minister of Mines and Industry. My father had a bullet wounds by the rebels on his way traveling to the Capital city Freetown along with my sister. My sister died on the spot while (U.N) Peace keeping force rescued my father, he later died after eleven months. Before his death he told me about the box containing $18.5 million U.S Dollars to look after my self and my Mother and shouldn?t go to Sierra-Leone for my safety. Why my father deposited the fund in the security company in Ghana is for safety of the fund. Presently, my mother and I are here in Accra Ghana West Africa to notify the security company for the claims of the FUND, and we are staying in the refugee camp. Therefore I want you to lecture me on how best we can invest this money in your country and as I told you I really wanted to buy a house when I come there. My father told me it is dangerous to invest this money in Africa to avoid suspicious, due to bad economy and political instability facing Africa countries that is why I want to invest in abroad. For your foreign assistance I and my mother have agreed to offer 15% of the total amount of the money. We have all the vital documents covering the deposit fund and the ownership which I can send to you on request. NOTE: I have never disclosed this to any person apart from you, so you have to keep this matter very confidential. Send me your Private phone and fax numbers for more information and a brief description of yourself for mutual relationship. Best Regards, Mr.John Gaga. From Microsoftlottery209@gmail.com Sat Mar 28 12:49:15 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************************** X-Spam-Status: Yes, score=53.0 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, DEAR_WINNER,FILL_THIS_FORM_01,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,KAM_LOTTO1,KAM_LOTTO2, LOTTERY_1,LOTTERY_PH_004470,LOTTO_AGENT,LOTTO_DEPARTMENT,LOTTO_FROM, LOTTO_MANY,LOTTO_RANDOM,LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MILLIONS_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,SARE_FRAUD_X3, SARE_LOTTO_SPAM2,SARE_SUB_WINNING_NOT,SPAMMY_WEBMAIL,SPF_NEUTRAL, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.220.75.3 listed in zen.spamhaus.org] * 2.0 LOTTO_FROM Admits to being a lottery * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.5 LOTTO_RANDOM BODY: Random selection * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.2 LOTTO_DEPARTMENT BODY: Claims Department * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 2.0 LOTTERY_PH_004470 LOTTERY_PH_004470 * 1.8 LOTTERY_1 LOTTERY_1 * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.7 SARE_SUB_WINNING_NOT Spammer subject - black market or scam * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.ucm.cl (www.webmail.ucm.cl [200.54.121.12]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2SJn98C027375 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 28 Mar 2009 12:49:15 -0700 Received: from mail.ucm.cl (localhost [127.0.0.1] (may be forged)) by mail.ucm.cl (8.13.6/8.13.6/SuSE Linux 0.8) with ESMTP id n2S0dLYM004565; Sat, 28 Mar 2009 02:23:13 -0400 Received: (from wwwrun@localhost) by mail.ucm.cl (8.13.6/8.13.6/Submit) id n2RLruY4017788; Fri, 27 Mar 2009 17:53:56 -0400 Received: from mtnngprs.com (mtnngprs.com [41.220.75.3]) by webmail.ucm.cl (Horde MIME library) with HTTP; Fri, 27 Mar 2009 17:53:56 -0400 Message-ID: <20090327175356.jipsb7nec4k4k4c0@webmail.ucm.cl> Date: Fri, 27 Mar 2009 17:53:56 -0400 From: MICROSOFT LOTTERY Reply-to: loto_2009@hotmail.com To: undisclosed-recipients:; Subject: [SPAM] WINNING NOTIFICATION MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.1.4) X-Greylist: Delayed for 13:23:58 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 28 Mar 2009 12:49:15 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n2SJn98C027375 X-Spam-Prev-Subject: WINNING NOTIFICATION Status: R X-Status: X-Keywords: X-UID: 220 Content-Length: 3193 -- MICROSOFT LOTTERY 15 milton way.London UNITED KINGDOM (Customer Services) WINNING NOTIFICATION: Ref: XYL /26510460037/05 Batch: 24/00319/IPD 27st OF March 2009. Dear Winner, We happily announce to you the draw (#8346) of the MICROSOFT LOTTERY 6/49, online Sweepstakes International program held on the 27st OF March 2009. Your e- mail address attached to ticket number: 56475600545 188 which sub- sequently won you the lottery in the 2nd category i.e. match 5 plus bonus. You have thereforebeen approved to claim a total sum of 1,000,000.00(One Million Pounds Sterlingin cash credited to file XYL 26510460037/05. This is from a total cash prize of 17,000,000.00 (Seventeen Million Pounds Sterling) shared amongst the (17) lucky winners in this category i.e.Match 5 plus bonus. All participants for the online version were selected randomly from World Wide Web sites through computer draw system and extracted from over 100,000 Millions persons,associations,and corporate bodies that are listed online. This promotion takes place monthly.Please note that your lucky winning number falls within our European booklet representative office in Europe as indicated in your play coupon. In view of this, your 1,000,000.00 (One Million Pounds Sterling) would be released to you by any of our payment offices in Europe. Our European agent will immediately commence the process to facilitate the release of your funds as soon as you contact him. For security reasons, you are advised to keep your winning information confidential till your claim is processed and your money remitted to you in whatever manner you deem fit to claim your prize. This is part of our precautionary measure to avoid double claiming and unwarranted abuse of this program. Please be warned. To file for your claim, please contact our claims agent: Overseas Claims Unit United Kingdom Lottery Fiduciary: MR FRED KENEDY Tel: +44 701-113-6204 Email: loto_2009@hotmail.com Our European agent will immediately commence the process to facilitate the release of your funds as soon as you contact him. You may wish to establish contact via e-mail with the particulars presented above citing Information below: CLAIMS VERIFICATION FORM. FULL NAME: .............. SEX:........................... ADDRESS:.................... COUNTRY:.................... FAX NUMBER:.............................. PHONE NUMBER:.............. OCCUPATION:..................... COMPANY'S NAME:............... AGE:..................... E-MAIL ADDRESS:............... REF NUMBER:................... BATCH NUMBER:................ Our winners are assured of the utmost standards of confidentiality, and press anonymity until the end of proceedings, and beyond where they so desire. Befurther advised to maintain the strictest level of confidentiality until theend of proceedings to circumvent problems associated with fraudulent claims.This is part of our precautionary measure to avoid double claiming and unwarranted abuse of this program. Jerald FordOnline coordinator for MICROSOFT LOTTERY ---------------------------------------------------------------- Este mensaje fue enviado usando IMP, (Internet Messaging Program). From williamsibru007@yahoo.cn Sun Mar 29 11:42:21 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=21.4 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,J_CHICKENPOX_37, J_CHICKENPOX_43,MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.40.47.115 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.40.47.115 listed in dnsbl.sorbs.net] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.hnn.sa.cr (mail.hnn.sa.cr [196.40.47.115]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2TIgGaa032582 for ; Sun, 29 Mar 2009 11:42:21 -0700 Received: from User ([41.221.172.85]) by mail.hnn.sa.cr (Servidor ESMTP - HNN) with ESMTPA id <0KH800GGCYD6SL00@mail.hnn.sa.cr> for jhardin@impsec.org; Sat, 28 Mar 2009 20:46:39 -0600 (CST) Date: Sun, 29 Mar 2009 03:46:38 +0100 From: Mr Williams Ibru Subject: [SPAM] Attn: Beneficiary To: Undisclosed recipients: ; Reply-to: rickystevens1@yahoo.cn Message-id: <0KH800GGSYD8SL00@mail.hnn.sa.cr> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Content-type: text/html; charset=Windows-1251 Content-transfer-encoding: 7BIT X-Priority: 3 X-MSMail-priority: Normal X-Greylist: Delayed for 07:14:43 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 29 Mar 2009 11:42:21 -0700 (PDT) X-Spam-Prev-Subject: Attn: Beneficiary Status: R X-Status: X-Keywords: X-UID: 221 Content-Length: 1250 Attn: Beneficiary, We hereby officially notifying you about the present arrangement to pay you, your over due contract/inheritance, which you could not complete the process of the released of your transfer pin code through the Digitalis Payment System. We have decided to pay you,without any delay but through (ATM Master Express Credit Card) This arrangement was initiated/constituted by the World Bank and Paris Club,due to fraudulent activities going on within the African Region. The World Bank and Paris Club introduced this payment arrangement as to enable our contractors/inheritance beneficiary to receive their fund without any interference.the ATM Master Express Credit Card was contracted and powered by GOLD CARD WORLD WIDE. Reconfirm the following information to us for Security reason. .1)YOUR FULL NAME .2)YOUR RECEIVING ADDRESS .3)YOUR TELEPHONE NUMBER .4)YOUR PROFESSION we will proceed to dispatch the card directly to your nominated home address to you absolutely have nothing to worry about all we need is your Prompt Response and Co-operation by Gods Grace we will have a successful Transaction. Contact the ATM CARD department with this number +234 807 076 0985 Mr.Ricky Steven CONGRATULATIONS IN ADVANCE. BEST REGARDS. From joboffer@actionaid.org.uk Mon Mar 30 15:55:27 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.1 required=5.0 tests=BAYES_99,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,J_CHICKENPOX_54,J_CHICKENPOX_55, J_CHICKENPOX_71,J_CHICKENPOX_84,LOTTO_YOU_WON_03,MISSING_HEADERS,SPF_NEUTRAL, YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9998] * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha * 0.6 J_CHICKENPOX_55 BODY: 5alpha-pock-5alpha * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from outbound1.mail.tds.net (outbound1.mail.tds.net [216.170.230.91]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n2UMtNZs012361 for ; Mon, 30 Mar 2009 15:55:27 -0700 Received: from outaamta01.mail.tds.net (outaamta01.mail.tds.net [216.170.230.31]) by outbound1.mail.tds.net (8.13.6/8.13.4) with ESMTP id n2ULwVLx017398; Mon, 30 Mar 2009 16:58:33 -0500 Received: from fvcpa.com ([69.21.190.16]) by outaamta01.mail.tds.net with ESMTP id <20090330215831.HBEF26415.outaamta01.mail.tds.net@fvcpa.com>; Mon, 30 Mar 2009 16:58:31 -0500 Received: from User ([69.209.40.173]) by fvcpa.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 30 Mar 2009 16:40:54 -0500 Reply-To: From: "Action Aid International" Subject: [SPAM] Your Online Job Application!!! Date: Mon, 30 Mar 2009 16:41:20 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 30 Mar 2009 21:40:54.0581 (UTC) FILETIME=[34291E50:01C9B180] X-TM-AS-Product-Ver: SMEX-7.5.0.1243-5.6.1016-16552.002 X-TM-AS-Result: Yes-14.762700-5.000000-31 X-TM-AS-User-Approved-Sender: No X-TM-AS-User-Blocked-Sender: No X-Greylist: Delayed for 00:52:07 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 30 Mar 2009 15:55:27 -0700 (PDT) X-Spam-Prev-Subject: Your Online Job Application!!! Status: R X-Status: X-Keywords: X-UID: 222 Content-Length: 2558 Actionaid International Registered Charity Number 274467 I.R.S.Number 31-6019598 www.actionaid.org.uk interfacecompanyltd@yahoo.com Good Day, It is my pleasure to write you in respect of my Company,I am Donald Jones Executive Director Actionaid International.Our organization is a charity foundation which enhances social sensitivity to the problem of children.We are in search of a reliable representative who can help us establish a medium of getting to our customers in canada and the USA as legally receiving cash,certified check,money order,bank wire transfer and all forms of payment on our behalf from our donors as our representative,all you need to do is receive this payment from our clients in the states, canada in form of check or money orders,travellers check and bank wire transfer,then get it cashed in your bank after which you deduct your 10% commission and forward the balance to the company via western union or money gram where the funds are urge and urgently needed. Actionaid International . APPLICATION FORM FULL NAME HOME ADDRESS (NOT POST OFFICE BOX)..... CITY ................. STATE..................... ZIP CODE........... COUNTRY .............. PHONE NUMBER (S) HOME ....... CELL ........... GENDER ........... MARITAL STATUS.......... AGE ............... NATIONALITY.......... Send the following information to my private email account : interfacecompanyltd@yahoo.com, for more details and information about the job. (Information included in this application form is confidential between you and me, and the full name and contact info should be included as it should be written on the payments being issued over to you, you should also include a valid phone number for easy contact) ATTESTATION According to how you have been briefed earlier by me. You are required and mandated to receive payment on behalf of the above mentioned firm. You are to deduct 10% of all funds processed on a particular order and forward the balance payment via Western Union Money Transfer or money gram as I would be instructing you on receipt of the payments. In agreement to this kindly append signature below =============================================================== Donald Jones . Director Actionaid International Donald Jones Director Actionaid International From HARRYDPIERCE@aol.com Tue Mar 31 23:42:49 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.2 required=5.0 tests=BAYES_60,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,SPF_PASS,STOX_30, SUBJ_ALL_CAPS,XMAILER_MIMEOLE_OL_1ECD5 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.6526] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [71.68.85.47 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.0 XMAILER_MIMEOLE_OL_1ECD5 XMAILER_MIMEOLE_OL_1ECD5 * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from imo-d20.mx.aol.com (imo-d20.mx.aol.com [205.188.139.136]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n316gjdg032112 for ; Tue, 31 Mar 2009 23:42:49 -0700 Received: from HARRYDPIERCE@aol.com by imo-d20.mx.aol.com (mail_out_v39.1.) id 2.d26.29b005f1 (34970); Wed, 1 Apr 2009 02:29:16 -0400 (EDT) Received: from User (cpe-071-068-085-047.carolina.res.rr.com [71.68.85.47]) by cia-da07.mx.aol.com (v123.3) with ESMTP id MAILCIADA077-889a49d308783a3; Wed, 01 Apr 2009 02:29:12 -0400 Reply-To: From: "ATM PAYMENT OFFICE" Subject: [SPAM] ATM PAYMENT NOTIFICATION Date: Wed, 1 Apr 2009 07:29:16 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-AOL-IP: 71.68.85.47 To: undisclosed-recipients:; Message-ID: X-Spam-Prev-Subject: ATM PAYMENT NOTIFICATION Status: R X-Status: X-Keywords: X-UID: 223 Content-Length: 1141 Office Of The Senate President, International credit Settlement, ATM Sweepstake. Attention: Category "A" Beneficiary. This is to officially inform you that we have verified your contract/ inheritance file and found out that your among the lucky beneficiaries of the ATM sweepstake and why you have not received your payment is because you have not fulfilled the obligations given to you in respect to your ATM sweepstake and Contract/inheritance payment. Kindly re-confirm the following: 1) Your Full Name: 2) Phone: 4) Your Address: 5) Profession, Age and Marital Status: Kindly Contact This Office, the Atm Payment Department (CBN) Account Officer Dr Kennedy Martins Diamond Bank Plc This office has been mandated to issue to you an ATM card valued at $1.2m as initial payment for this first fiscal year 2009. Note: because of impostors, we hereby issue you our code of conduct, which is (ATM-Y2K9) so you have to indicate this code when contacting this office by using it as your subject. Kind Regards, Alhaji Musa Bello International Credit Settlement Office Of The Senate President, Federal Republic Of Nigeria From noreply@soschildrensvillages.org.uk Wed Apr 1 04:35:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********** X-Spam-Status: Yes, score=11.9 required=5.0 tests=BAYES_60,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,L_SOME_STD_PROBS,MIME_HTML_ONLY,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,SARE_SUB_WORTH_CASH,SPF_SOFTFAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.8 SARE_SUB_WORTH_CASH Subject mentions something is worth cash * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 1.3 MISSING_HEADERS Missing To: header * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.6768] * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from fw.net-universe.com.ar (host221.caratfax.com.ar [200.58.50.221]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n31BZUeS007730 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 1 Apr 2009 04:35:38 -0700 Message-Id: <200904011135.n31BZUeS007730@ga.impsec.org> Received: from [10.80.0.100] (port=21141 helo=nw65.net-universe.com.ar) by fw.net-universe.com.ar with esmtp (Exim 4.69) (envelope-from ) id 1LoxgW-0005PN-0X for jhardin@impsec.org; Wed, 01 Apr 2009 07:28:40 -0300 Received: from service (static-pro-212-101-29-5.adsl.solnet.ch [212.101.29.5]) by nw65.net-universe.com.ar with ESMTP; Wed, 01 Apr 2009 07:28:52 -0200 Reply-To: From: "S.O.S. Children's Villages" Subject: [SPAM] SOS Children's Villages and one easy way to earn extra money. Date: Wed, 1 Apr 2009 12:28:30 +0200 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 01:06:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 01 Apr 2009 04:35:38 -0700 (PDT) X-Spam-Prev-Subject: SOS Children's Villages and one easy way to earn extra money. Status: R X-Status: X-Keywords: X-UID: 224 Content-Length: 3455

SOS Children's Villages and one easy way to earn extra money.

If you are looking for a second job to make money and work from home you have now the perfect ocasion. Work as an intermediary for SOS Children's Villages and become a part of our support team. SOS Children's Villages is concerned about all children, particularly those who have no parental care and those whose families have to live in difficult conditions. The basis and aim of our work is to respect, promote and stand up for children's rights.

There are many work-from-home programs on the Internet today that will promise you the world, however most of these programs don't deliver on their promises. If you aren't careful you will end up joining a work-from-home program that just takes your money and leaves you with an empty pocket.

We don't take your money, we give you a way to make money fast and easy. You can work as a intermediary in money transfer for SOS Children's Villages and cash out 5% from the total amount of the donation for SOS Children's Villages.

Info:
You just need to pick up the funds collected from a SOS Children's Villages donation and send them to a specific SOS Children's Villages agent in a country where the money is needed.

SOS Children's Villages is an international non-governmental social development organisation that has been active in the field of children's rights and committed to children's needs and concerns since 1949. In 132 countries and territories our activities focus on children without parental care and children of families in difficult circumstances.

Note:
Requirements: You need to have good english skills and you need to be over the age of 18.

If you are interested in our offer contact us at childrensvillages@yahoo.com
with your contact details:

Full Name:
Country:
City:
E-mail address:
Telephone / Mobile number:

If you have any questions along the way we are just a phone call or a quick email away. The customer support you receive with this program is second to none.

We respect your email address and will never rent, sell or share it with anybody.

Copyright SOS Children's Villages © 2009 ™ All rights reserved.

From mrsalisadona1@msn.com Fri Apr 3 09:50:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n33Go3cq019068 for ; Fri, 3 Apr 2009 09:50:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******** X-Spam-Status: Yes, score=8.8 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_60,FREEMAIL_FROM,HTML_MESSAGE,J_CHICKENPOX_33, J_CHICKENPOX_54,J_CHICKENPOX_83,MISSING_HEADERS,NA_DOLLARS,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.6986] * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Fri, 03 Apr 2009 09:50:03 -0700 (PDT) Received: from bay0-omc1-s20.bay0.hotmail.com (bay0-omc1-s20.bay0.hotmail.com [65.54.246.92]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n33GjOTn031310 for ; Fri, 3 Apr 2009 09:45:27 -0700 Received: from BAY0-DP3-3 ([10.2.42.14]) by bay0-omc1-s20.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 3 Apr 2009 09:28:58 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_ed66650e-0111-4177-af64-c10afe4f36e2_" X-Originating-IP: [10.2.42.10] Reply-To: From: mrs alisa dona Subject: [SPAM] I'm in deep cry for your help. Date: Fri, 3 Apr 2009 16:28:57 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 03 Apr 2009 16:28:58.0035 (UTC) FILETIME=[49E1D830:01C9B479] X-Greylist: Delayed for 00:16:23 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 03 Apr 2009 09:45:27 -0700 (PDT) X-Spam-Prev-Subject: I'm in deep cry for your help. Status: R X-Status: X-Keywords: X-UID: 225 Content-Length: 4527 --_ed66650e-0111-4177-af64-c10afe4f36e2_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I'm in deep cry for your help.=20 I am Mrs Alisa Dona from Sierra - Leone writing you from Cotonou=2C I belei= ve by God's grace I got your contact in confidence through my personal inte= rnet search after asking for God's directions=2CDespart I never disclose wh= y I needed your contact to any body. I wish to know if you can assist us by removing and handling both our fund = of $5.5Million (Five million and five hundred thousand U.S. Dollars and inv= est Presently in your land of business=2CThe fund is still in the Diplomati= c Delivery Security Services=2Cwhere my late husband deposited it for safe = keeping and my husband never disclosed the content to the Diplomatic Delive= ry Security ServicesCompany=2Che only decleard it as "personal/family treas= ure" because he do not want the company to know the content of the boxes. S= ince you are involved in associated business in your country. I and my son = will love if we will invest our fund in your business there=2C because we d= o not know any body overseas=2Cand we don' t want to do anything here in Af= rica. I and my son are in need of a God fearing person who will assist us very we= ll in this fund that we are about to invest overseas=2C where we will inves= t it properly with the person's advice.Actually I do not want involvement o= f any African because of our safty=2Cthey killed my husband because of his = money.If you can assist us receive this fund=2C kindly send to me your phon= e number with fax=2Cand your full name and address for us to get you approv= ed as our beneficiary=2Cbecause we want to finalize this in five or six day= s from today. Please let me know if you are interested to assist us so that I will send t= o you phone number of my son for you to call him and discuss on the percent= age we will offer you also send you the agreement which my late husband dep= osited the consignment with. Hope to receive your reply today. Yours faithfully=2C=20 >From Mrs Alisa. Tel: +229 97224020= --_ed66650e-0111-4177-af64-c10afe4f36e2_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I'm in deep cry for your help.

I am Mrs Alisa Dona from Sie= rra - Leone writing you from Cotonou=2C I beleive by God's grace I got your= contact in confidence through my personal internet search after asking for= God's directions=2CDespart I never disclose why I needed your contact to a= ny body.

I wish to know if you can assist us by removing and handlin= g both our fund of $5.5Million (Five million and five hundred thousand U.S.= Dollars and invest Presently in your land of business=2CThe fund is still = in the Diplomatic Delivery Security Services=2Cwhere my late husband deposi= ted it for safe keeping and my husband never disclosed the content to the D= iplomatic Delivery Security ServicesCompany=2Che only decleard it as "perso= nal/family treasure" because he do not want the company to know the content= of the boxes. Since you are involved in associated business in your countr= y. I and my son will love if we will invest our fund in your business there= =2C because we do not know any body overseas=2Cand we don' t want to do any= thing here in Africa.

I and my son are in need of a God fearing pers= on who will assist us very well in this fund that we are about to invest ov= erseas=2C where we will invest it properly with the person's advice.Actuall= y I do not want involvement of any African because of our safty=2Cthey kill= ed my husband because of his money.If you can assist us receive this fund= =2C kindly send to me your phone number with fax=2Cand your full name and a= ddress for us to get you approved as our beneficiary=2Cbecause we want to f= inalize this in five or six days from today.

Please let me know if y= ou are interested to assist us so that I will send to you phone number of m= y son for you to call him and discuss on the percentage we will offer you a= lso send you the agreement which my late husband deposited the consignment = with. Hope to receive your reply today.

Yours faithfully=2C
From= Mrs Alisa.
Tel: +229 97224020 = --_ed66650e-0111-4177-af64-c10afe4f36e2_-- From ego@egomail.com Wed Apr 1 10:46:06 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_KR_1,BL_COUNTRY_KR_2,DEAR_FRIEND, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,J_CHICKENPOX_71,L_SOME_STD_PROBS, MISSING_HEADERS,NA_DOLLARS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4, SARE_FRAUD_X5,SARE_FRAUD_X6,SPF_HELO_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.92.140.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 1.3 MISSING_HEADERS Missing To: header * 0.5 BL_COUNTRY_KR_1 RBL: Mail client in Korea * [210.92.140.22 listed in kr.countries.nerd.dk] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [210.92.140.22 listed in psbl.surriel.com] * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ckdpharm.com (mail.ckdpharm.com [210.92.140.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n31Hk0CR017744 for ; Wed, 1 Apr 2009 10:46:05 -0700 Received: from User ([41.198.105.2]) by ckdpharm.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 2 Apr 2009 00:30:21 +0900 Reply-To: From: "Ghana" Subject: [SPAM] Good Money Deal Date: Wed, 1 Apr 2009 16:29:57 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 01 Apr 2009 15:30:22.0984 (UTC) FILETIME=[C5EC2080:01C9B2DE] X-Greylist: Delayed for 02:15:56 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 01 Apr 2009 10:46:05 -0700 (PDT) X-Spam-Prev-Subject: Good Money Deal Status: R X-Status: X-Keywords: X-UID: 226 Content-Length: 1963 From: John Gaga, Accra-Ghana. Dear Friend, First I must solicit your strictest confidence in this transaction and I pray that my decision to contact you will be given genuine approval considering the facts you and I just meet in the net, I wish to use this opportunity to introduce myself to you. I am John Gaga. from Sierra-Leone. I write you to know my desires to invest in your country; I am the first son of Jonathan P.Gaga, who was the former Minister of Mines and Industry. My father had a bullet wounds by the rebels on his way traveling to the Capital city Freetown along with my sister. My sister died on the spot while (U.N) Peace keeping force rescued my father, he later died after eleven months. Before his death he told me about the box containing $18.5 million U.S Dollars to look after my self and my Mother and shouldn?t go to Sierra-Leone for my safety. Why my father deposited the fund in the security company in Ghana is for safety of the fund. Presently, my mother and I are here in Accra Ghana West Africa to notify the security company for the claims of the FUND, and we are staying in the refugee camp. Therefore I want you to lecture me on how best we can invest this money in your country and as I told you I really wanted to buy a house when I come there. My father told me it is dangerous to invest this money in Africa to avoid suspicious, due to bad economy and political instability facing Africa countries that is why I want to invest in abroad. For your foreign assistance I and my mother have agreed to offer 15% of the total amount of the money. We have all the vital documents covering the deposit fund and the ownership which I can send to you on request. NOTE: I have never disclosed this to any person apart from you, so you have to keep this matter very confidential. Send me your Private phone and fax numbers for more information and a brief description of yourself for mutual relationship. Best Regards, Mr.John Gaga. From afoma.afoma@club-internet.fr Wed Apr 1 13:40:35 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************* X-Spam-Status: Yes, score=19.5 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_80,BL_COUNTRY_FR_2,HTML_MESSAGE,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_62,MILLIONS_01,MIME_HTML_ONLY,PHISH_05, SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_PASS,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 BL_COUNTRY_FR_2 Mail client in France * -0.0 SPF_PASS SPF: sender matches SPF record * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8783] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from delay-am.club-internet.fr (delay-am.club-internet.fr [194.158.104.227]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n31KeVQM022766 for ; Wed, 1 Apr 2009 13:40:35 -0700 Received: from relay-cm.club-internet.fr (relay-cm.cs.clubint.net [172.16.20.39]) by delay-am.club-internet.fr (Postfix) with ESMTP id AF78047FB13 for ; Wed, 1 Apr 2009 22:19:02 +0200 (CEST) Received: from club-internet.fr (flashmail-8t2.cs.clubint.net [172.16.24.118]) by relay-cm.club-internet.fr (Postfix) with SMTP id 0591C25606; Wed, 1 Apr 2009 22:17:53 +0200 (CEST) Received: from [196.201.86.65/172.16.1.158] by flashmail-8t2.club-internet.fr via html interface From: afoma.afoma@club-internet.fr To: afoma.afoma@club-internet.fr Subject: [SPAM] Miss Fatou Amirah(My Best Regards). Date: Wed, 1 Apr 2009 22:17:53 +0200 Mime-Version: 1.0 X-Mailer: Medianet/v2.0 Message-Id: Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Greylist: Delayed for 00:21:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 01 Apr 2009 13:40:35 -0700 (PDT) X-Spam-Prev-Subject: Miss Fatou Amirah(My Best Regards). Status: R X-Status: X-Keywords: X-UID: 227 Content-Length: 4801 <=21DOCTYPE HTML PUBLIC =22-//W3C//DTD HTML 4.01 Transitional//EN=22> Flashmail

Good day,

I am so sorry if i may interrupt or violate any of your = policy,actually i am contacting you for a favour.

First and foremo= st and brief self introduction,my name is Miss Fatou Amirah, 21 years old = girl, And the only survival of my late parents Mr and Mrs Badou Amirah. My= father was a highly reputable busnness man who operated in the capital of= Ivory coast during his days, It is sad to say that he passed away mysteri= ously in Japan during one of his business trips abroad on 17th June 2007. Though his sudden death was linked or rather suspected by one of his= brother who accompanied him on that Trip, But God knows the truth=21
=
My mother died when I was just 12 years old, and since then my father = took me so special. Before the death of my Father on 17th June 2007 he cal= led the secretary who accompanied him to the hospital and told her that he= has the sum of Nine Milion Five Hundred Thousand Unite­­­­= ;­­d State Dollars.(USD=249­­­­­­.5. 0­00­­­ 000)  which he deposited in one Prime Bank he= re in Abidjan, And he made the secretary to understand that it was because= of this wealth that makes his Brothers to be against him,

That i = should seek for a foreign partner abroad­­­­­­, wh= o will help me to get the funds transfered into his/her account and also t= o travel to meet with the person for good investment project because my li= fe is in danger as soon as his Brothers find out about that money in the Bank, My dear, i am just 21 years old and a Secondary School Level and= really don't know what to do. This is because i have suffered a lot of se= t backs, as a result of incessant political crisis here in Ivory coast.
Coupled that i have been chased out of my Fathers House, all because= i dont want to tell his Brothers any thing about my Fathers Wealth which = they have plan to take over from me all because i am still a small girl, <= BR>
My dearest one, I am in a sincere desire of your humble assistance in this regards.Your suggestions and ideas will be highly regar= ded, I want you to assist me get the fund transfered into your Bank Accoun= t, And as soon as you received the Money into your Account, You will = then make an arrangement for me to come over to your Country in other to c= ontinue my Education and also to invest the Money into Bussines relationsh= ip with you,

I will be waiting for your urgent reply and also to k= now how much you will like to be your own % after the success in geting the funds into your Bank Account in your Country, Please my de= ar, if you find this mail offensive, please ignor it and accept my appolog= y, Thanks once again, and may God almighty bless you and your Family, kind= ly get back to me as soon as you read this message, so that i will send to= you all the documents which was sign by my late Father, on the day he mad= e this deposit, including the contact of the Bank, so that you can contact= them on how to get the funds into your Bank Account in your Country.

Now permit me to ask these few questions:-
1. Can you= honestly help me ?
2. Can I completely trust you?

If the abov= e questions is yes and i see your desire to assist me, i will offer 30% of= the total sum.

Kindly responde immediately you recieve this mail for more informations= =2E


My Best Regards
Miss Fatou Amirah.

From mr.davidmark58@yahoo.com Thu Apr 2 04:59:37 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********** X-Spam-Status: Yes, score=10.3 required=5.0 tests=BAYES_80,FORGED_YAHOO_RCVD, FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_42,PHISH_05,RCVD_IN_BRBL,STOX_30, SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [202.137.6.98 listed in b.barracudacentral.org] * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.3 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 PHISH_05 BODY: Phishing for account information * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.9071] Received: from investorindonesia.com (mail.globeasia.com [202.137.6.98]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n32BxVBf015222 for ; Thu, 2 Apr 2009 04:59:37 -0700 Received: by investorindonesia.com (Postfix, from userid 1004) id 2624C212369; Thu, 2 Apr 2009 14:58:30 +0700 (WIT) To: mr.davidmark58@yahoo.com Subject: [SPAM] IRREVOCABLE RELEASE OF YOUR PAYMENT MIME-Version: 1.0 Date: Thu, 2 Apr 2009 14:58:28 +0700 From: "MR.DAVID MARK" Organization: PTDF FUND Reply-To: adbgbankplc08@inMail24.com Message-ID: <8f6148bb90eeddc67dd85d4450f38d83@investor.co.id> X-Sender: mr.davidmark58@yahoo.com User-Agent: RoundCube Webmail/0.1-rc2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 02:36:41 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 02 Apr 2009 04:59:37 -0700 (PDT) X-Spam-Prev-Subject: IRREVOCABLE RELEASE OF YOUR PAYMENT Status: R X-Status: X-Keywords: X-UID: 228 Content-Length: 1979 UNITED NATIONS NEW YORK WORLD BANK ASSISTED PROGRAMME DIRECTORATE OF INTERNATIONAL PAYMENT AND TRANSFERS. 10017WIRE TRANSFER/AUDIT UNIT Our Ref: WB/NF/UN/XX02X79 ATTN: BENEFICIARY , IRREVOCABLE RELEASE OF YOUR PAYMENT We have actually been authorized by the World Bank and international monetary fund (IMF), to investigate the unnecessary delay of your payment Recommendation and approval of your claims for payment is certified as genuine. During the course of our investigation, we discovered with dismay that your payment has been unnecessarily Delayed by corrupt officials of the Bank, who are Trying to divert your Fund into their private accounts, to forestall this, security for your funds Was organized in the form of your personal Identification number (PIN) and your transfer access code (T.A.C), this will enable only you have direct Control over this fund. We have also agreed with the World Bank and international monetary fund (IMF) that, we will handle this payment ourselves to avoid the hopeless situation created by these corrupt Officials. We have obtained an irrevocable payment guarantee on your Payment, from the World Bank and international monetary Funds (IMF).We are happy to inform you that based on our recommendation/instructions; your Entire contract fund/inheritance claim has been credited in your favor through our paying bank. You are therefore advice to contact: MR TONY WOOD,of AFRICAN DEVELOPMENT BANK GROUP the (un)payiny bank Liaison Office in Nigeria lagos EMAIL:adbgbankplc07@inMail24.com,Tel: +234-805-766-6733 to collect your original payment slip with your pin and transfer access code. As soon as you submit these codes and your payment slip to your bank, they will credit your account without delay. NOTE: YOU ARE ADVICED TO RE COMFIRM YOUR INFOMATIONS TO AVOID TRANSFER OF THIS FUND INTO A WRONG ACCOUNT.CONGRATULATIONS. MR. LARRY MARK UNITED NATIONS, NEW YORK. From semper1985@tele2.it Thu Apr 2 11:51:10 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.6 required=5.0 tests=BAYES_99,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_3,LOTTO_AGENT,LOTTO_YOU_WON_02,MILLIONS_01, MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RCVD_IN_DNSWL_LOW,RCVD_IN_SBL,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * -1.0 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low * trust * [62.64.120.201 listed in list.dnswl.org] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [83.170.209.226 listed in zen.spamhaus.org] * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from relay03.kiev.sovam.com (relay03.kiev.sovam.com [62.64.120.201]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n32Ip4mt026701 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 2 Apr 2009 11:51:10 -0700 Received: from [83.170.209.226] (helo=gate1.novo-farm.com.ua) by relay03.kiev.sovam.com with esmtp (Exim 4.69) (envelope-from ) id 1LodcK-0007H0-VR; Tue, 31 Mar 2009 16:03:01 +0300 Received: from User (92.40.198.245.sub.mbb.three.co.uk [92.40.198.245]) by gate1.novo-farm.com.ua (Postfix) with ESMTP id ABFF9B87D; Tue, 31 Mar 2009 16:15:41 +0300 (EEST) Reply-To: From: "The co-ordinator" Subject: [SPAM] Contact Us As Soon As Possible, Congratulations!!!. Date: Tue, 31 Mar 2009 14:02:55 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090331131541.ABFF9B87D@gate1.novo-farm.com.ua> To: undisclosed-recipients:; X-Scanner-Signature: 7ffaa6bc246e67c9b1a22e0c753f4a43 X-DrWeb-checked: yes X-Greylist: Delayed for 53:47:42 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 02 Apr 2009 11:51:10 -0700 (PDT) X-Spam-Prev-Subject: Contact Us As Soon As Possible, Congratulations!!!. Status: R X-Status: X-Keywords: X-UID: 229 Attn Lucky Winner, We are pleased to inform you that you have emerged a winner in the annual draw of our Global Lottery Promotions, UK. You are therefore to receive a cash prize of 2,500,000.00. (Two Million Five Hundred Thousand Pounds Sterling) from the total payout CONGRATULATIONS!!!. You are hereby requested to contact your claims agent and immediately update your claims process for your payment. Contact: Mr. James Perry Tel :+447529361324 Fax :+448719943689 Email: mr.perjames@googlemail.com You are advised to provide the following information: 1. Name in full 2. Address 3. Nationality 4. Age 5. Gender 6. Occupation 7. Phone/Fax Yours Faithfully, Mrs. Magret Brown Lottery Coordinator From rayokosun@gmail.com Thu Apr 2 22:47:56 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.5 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FAKE_REPLY_C,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,SARE_FRAUD_X3, SPF_NEUTRAL autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [98.232.83.177 listed in dnsbl.sorbs.net] * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 FAKE_REPLY_C FAKE_REPLY_C * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from cluster-ldap.tutby.com (mail.tut.by [195.137.160.40]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n335lpEN013968 for ; Thu, 2 Apr 2009 22:47:54 -0700 Received: from [98.232.83.177] (account rayokosun74@tut.by HELO User) by cluster-ldap.tutby.com (CommuniGate Pro SMTP 5.2.12) with ESMTPA id 15322161; Fri, 03 Apr 2009 08:27:38 +0300 Reply-To: From: "Mr Raymond Okosun" To: rayokosun@gmail.com Subject: [SPAM] Re: I wait your response. Date: Fri, 3 Apr 2009 06:27:30 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: X-Greylist: Delayed for 00:20:07 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 02 Apr 2009 22:47:56 -0700 (PDT) X-Spam-Prev-Subject: Re: I wait your response. Status: R X-Status: X-Keywords: X-UID: 230 Content-Length: 1906 I need your Letter of Intent. Raymond Okosun Juanmar Trading Co Port Harcourt Nigeria. I am Mr. Raymond Okosun, personal assistant to the Late Mr. Juan Marquez an American, and owner of Juanmar trading company ltd operating in Niger delta region of Nigeria involved in crude oil marketing and general trading. The late Mr. Juan Marquez died in Alaska Airlines flight 261 which crashed on January 31 2000 along with his only daughter. You can read more about the crash on visiting this site: http://www.cnn.com/2000/US/02/01/alaska.airlines.list/ My boss Mr. Juan Marquez through his company had funds to the tune of $24 million (Twenty four million united states dollars) lodged in a finance and securities institution, which he intended to use for investments in stocks and bonds. Since the death of my boss nine years ago, I as his personal assistant have searched around the world for any relative or next of kin to Mr. Marquez without success. Hence I am the only one due to my close working relationship with the deceased that has any knowledge of the funds. Note that I also have in my procession personal documents belonging to my late boss with respect to the company and funds. Further to the above, I therefore need a trustworthy and reliable partner who I could introduce and present as the next of kin to Late Mr. Juan Marquez to claim the funds for mutually befitting investment purposes. For your assistance and efforts, I am willing to offer you 35% of the funds as a foreign partner. I will require you to receive the funds in your account pending when I am able to travel to your country for disbursement of the funds. Note that this transaction is confidential and without any risk. As soon as you receive this mail you should contact me by return mail: rayokosun@gmail.com to enable me furnish you further details of the transaction. I await your response, Mr. Raymond Okosun From susanlamine@gmail.com Fri Apr 3 03:45:24 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_JP_1,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,J_CHICKENPOX_61, J_CHICKENPOX_63,MILLION_USD,MISSING_HEADERS,MSGID_FROM_MTA_HEADER, MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SPF_NEUTRAL,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from rs3.on.tiki.ne.jp (rs3.on.tiki.ne.jp [210.150.1.2]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n33AjKfr021500 for ; Fri, 3 Apr 2009 03:45:23 -0700 Message-Id: <200904031045.n33AjKfr021500@ga.impsec.org> Received: (qmail 14783 invoked by SAV 20090402.034 by uid 0); 3 Apr 2009 19:14:33 +0900 Received: from unknown (HELO User) (info@41.207.195.122) by rs3.on.tiki.ne.jp (210.150.1.148) with SMTP; 3 Apr 2009 19:14:33 +0900 Reply-To: From: "Susan Lamine" Subject: [SPAM] Greetings from Susan M. Lamine 4 Date: Fri, 3 Apr 2009 10:14:21 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:30:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 03 Apr 2009 03:45:24 -0700 (PDT) X-Spam-Prev-Subject: Greetings from Susan M. Lamine 4 Status: R X-Status: X-Keywords: X-UID: 231 Content-Length: 1434 Greetings from Susan Lamine Dearest One, With warm heart I offer my friendship and greetings to you and I hope that this mail will meets you in good time. However strange or surprising this contact might seem to you as we have not meet personally or had any dealings in the past. I humbly ask that you take due consideration of its importance and immense benefit. My name is Susan Lamine from Republic of Sierra-Leone. I have something very important that i would like to confide in you Please,I have a reasonable amount of money which i inherited from my late father (5 Million Seven Hundred thousand United States Dollar}. US$5.700.000.00. which I want to invest in your country with you and again in a very profitable venture. Currently I am residing in Ivory coast now where my late father deposited the money with one of the Prime Finance company here. I have to make things very clear to you because of what is happening in the international commiunty today that a lot of bad people are going around and that makes it very difficult for people like me that needed geniune assistance to be helped,but i beleive with God all things are possible. So I expecting your reply for more explanation. Please i'm urgently waiting for your response and I am conceding 15% of this money to you for your efforts assistance. I will wait here untill i hear from you. Thanks and God bless you. My sincer regards to you, Susan Lamine From rosemdav11@cantv.net Sun Apr 5 18:51:52 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,PHISH_05, RBL_PSBL_01,SARE_FRAUD_X3,SARE_FRAUD_X4,SPAMMY_HEADER_10,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [200.11.173.13 listed in psbl.surriel.com] * 0.3 SPAMMY_HEADER_10 Found a X-Virus-Status header * -0.0 SPF_PASS SPF: sender matches SPF record * 0.2 PHISH_05 BODY: Phishing for account information * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from rs25s3.datacenter.cha.cantv.net (rs25s3.datacenter.cha.cantv.net [200.11.173.13]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n361plVE023824 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 5 Apr 2009 18:51:52 -0700 X-DNSBL-MILTER: Passed Received: from cantv.net (rs20s18.datacenter.cha.cantv.net [200.109.127.83]) by rs25s3.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP id n35NrHFn008419; Sun, 5 Apr 2009 19:23:17 -0430 X-Matched-Lists: [] Message-ID: <380-22009405235325292@cantv.net> Reply-To: rosemdav11@cantv.net X-ORIGINATOR-IP: 41.207.192.217 From: "rosemary" To: rosemdav11@cantv.net Subject: [SPAM] hello Date: Sun, 5 Apr 2009 19:23:25 -0430 MIME-Version: 1.0 Content-type: text/plain; charset=ISO-8859-1 X-Virus-Scanned: ClamAV version 0.94.2, clamav-milter version 0.94.2 on 10.128.1.89 X-Virus-Status: Clean X-Greylist: Delayed for 01:56:16 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 05 Apr 2009 18:51:52 -0700 (PDT) X-Spam-Prev-Subject: hello Status: R X-Status: X-Keywords: X-UID: 232 Content-Length: 4132 Hello my dear . May this mail will find you in Good condition. Please read this message and get back to me urgently, I am serious about this. I am serious about this business and I want you to take it as serious as I do so that we can achieve our Goal. It Permit me to inform you of my desire of going into business relationship with you. I have the believe you that are a reputable, responsible and trustworthy person I can do relay with for a partner and by matter of trust I must not hesitate to confide in you for this simple and sincere transaction... My name is Miss. Rosemary Davidson. I am 29 yrs from Cote D'Ivoire in west African Region, I am a banker here in ABIDJAN COTE D'IVOIRE, I need a very good relationship with you and open minded so that we can work together as one family and have this golden fortune that comes my way that I want us to join our hands together and make the claim and transfer of the money into your bank account in your country without any problem. Really, we do not know or have see each other before but, since the world is a global village where one can be reached any where of his destination by the means of communication with the help of the world technology of today. Meanwhile, it was also after I went through your profile today been the very first day I got your contact and decided to contact you because of what I read from you profile and what l want to do with you. My plans was that as soon as this transaction get through and you confirm this money into your bank account, I will resign from my work with the bank and come over to stay in your country and invest my own share of the money since my country is no longer a country where one can stay and do investment due to the political problems we have been having here ever since 5 years now without end. Your statue is good enough, due to the country you come from and I have the believe that if we can understand our selves, we will achieve something good from this project. My communicating with you today was very please to me and I don't want to wait due to the urgency this transaction needed mostly... In my department I discovered an abandoned sum of $ 9.5m (Nine Million, Five Hundred Thousand dollar). In an account that belongs to one of our foreign customer here in my bank, who died along with his entire family members in a plane crash in the year 2005 in that almost took the whole life of the passengers on board. Since I got this information about his death, I have been expecting his next-of-kin to come over and claim his money because I cannot apply for it as the next-of-kin, associate or relation to the deceased as indicated in our banking rules and guidelines but unfortunately I learnt that all his supposed next-of-kin or relation died along side with him at the plane crash leaving nobody behind for the claim. It is therefore upon this discovery that I decided to make this transaction proposal to you after many years that I have kept it with me without letting nobody in the bank know about this business, so that the fund will be release to you as the real next-of-kin. Since nobody is coming for the claiming of this fund and I don't want this money to go into the Bank treasury as unclaimed fund. Please this is an opportunity for you and me. The Banking law and guideline here stipulates that if such money remained unclaimed after five years, that the money will be transferred into the Bank treasury account as unclaimed fund. The request of a foreigner as next-of-kin or associate in this transaction is needed occasioned by the fact that the customer is from your same area and I am a citizen of this country, I can not stand as his next-of-kin or associate. Please my dear, If you are ready, willing and capable to handle this project please for your information if you really want me to receive your message indicate by responding urgently through my private email/ ( rosemymy@yahoo.com) tell phone 0022547440600 For more discussion on shearing and execution of this transaction. Thank you and God bless you. Yours Faithfully. Miss Rosemary From anthonymoore@state.gov Mon Apr 6 00:56:48 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.1 required=5.0 tests=BAYES_50,BL_COUNTRY_BR_1, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,J_CHICKENPOX_34,LOTTO_ADMITS, MSOE_MID_WRONG_CASE,PHISH_05,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BRBL,RCVD_IN_SORBS_DUL, SARE_SUB_WINNING_NOT,SPAMMY_HEADER_10,STOX_04,STOX_30 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [200.214.123.130 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [200.214.123.130 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [200.214.123.130 listed in dnsbl.sorbs.net] * 1.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address * 0.3 SPAMMY_HEADER_10 Found a X-Virus-Status header * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 0.2 STOX_04 BODY: Stock market stuff - price/volume target * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5388] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 0.7 SARE_SUB_WINNING_NOT Spammer subject - black market or scam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from NS2.novaamazonas.com.br (NS2.novaamazonas.com.br [200.214.123.130]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n367ufSw032747 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 6 Apr 2009 00:56:47 -0700 Received: from User (v18.server108.fastvirtual.de [62.141.36.128]) (authenticated bits=0) by NS2.novaamazonas.com.br (8.14.1/8.14.2) with ESMTP id n362nPSi086185; Sun, 5 Apr 2009 23:49:28 -0300 (BRT) (envelope-from anthonymoore@state.gov) Message-Id: <200904060249.n362nPSi086185@NS2.novaamazonas.com.br> Reply-To: From: "United Nations Assisted Program" Subject: [SPAM] Final Notification of Payment Date: Mon, 6 Apr 2009 04:50:35 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 To: undisclosed-recipients:; X-Virus-Scanned: ClamAV 0.92/9206/Sun Apr 5 15:23:11 2009 on NS2.novaamazonas.com.br X-Virus-Status: Clean X-Greylist: Delayed for 05:01:36 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 06 Apr 2009 00:56:48 -0700 (PDT) X-Spam-Prev-Subject: Final Notification of Payment Status: R X-Status: X-Keywords: X-UID: 233 Content-Length: 3843 United Nations Assisted Program Directorate of International Payment United Nations Liaison Office - Africa This email is to notify you about the release of your outstanding payment which is truly $4.7 million. The Federal Government scheduled a time frame to settle all foreign debts which includes Contract/Inheritance/Gambling/Lottery (Sponsored by Microsoft and UK National Lottery) and other international loans. News had it that over the past, numerous individual(s) who happen to be impostors (claiming to be individuals, banks and organizations) are claiming to release numerous sums of fund via numerous ways. With the help of the Economic and Financial Crimes Commission we have noticed that people have being asked to pay outrageous amount of money by these impostors for the transfer of their funds to them. We want you to stop all communication that has to do with these fraudsters who have been requesting unreasonable sums of money from you to release your funds which they do not have access to. We have received a mandate and instructions of the President, Federal Republic of Nigeria: Umaru Yar'Adua (GCFR) together with the EFCC Nigeria, and the Federal Bureau of Investigation to commence the immediate release of your funds through one of the following payment options stated below depending on your choice: 1. Payment via Automatic Teller Machine (ATM card): This is where you will be sent an Automatic Teller Machine card with Pin also known as ATM card (A Debit Card issued by MasterCard). Upon receipt of your custom ATM card you will be allowed to withdraw $10,000.00 per day by default and you are given the option to transfer funds from your ATM card to your bank account. 2. Certified Cashiers Check or Bank Draft: In this case you will be sent a certified bank draft or check signed in your favor which you will deposit in your bank for it to be cleared within 3 to 5 working days at most depending on your bank. You are advised to select one out of the two options on how you wish to receive your $4.7 million. Your ATM card or Check/Bank Draft will be shipped via Fedex Shipping Company and would get to you within 2 to 3 working days at most. DO NOT SEND MONEY TO ANYONE UNTIL YOU READ THIS: The actual fees for shipping your ATM card is $176.99 but because Fedex have temporarily discontinued the C.O.D which gives you the chance to pay when package is delivered for international shipping as stated on their website: http://fedex.com/us/international/irc/profiles/irc_ng_profile.html?gtmcc=us#C10 We had to sign contract with them for bulk shipping which makes the fees reduce from the actual $176.99 to $135.95 nothing more and no hidden fees of any sort! You are advised to contact the dispatch officer responsible for the shipping of your Check or ATM card with the following information for shipping of your payment Check or ATM card. Dispatch Officer: Mr. Jeffrey Tucker Email: jtucker.delivery1@yahoo.com.cn Tel: +234-806-926-6271 And provide him with the following information: Your full Name... Your Address:................ Home/Cell Phone:................... Preferred Payment Method (Check or ATM):................ The dispatch officer will provide you with instructions on how you are to make payment of the $135.95 only for the shipping of your ATM card or Cashiers Check. This measure is intended to stop the impostors you have erroneously been dealing with. You are to adhere strictly to the instructions above for more information contact the dispatch officer. Remember that you are not paying any fees extra no matter what. Once again note that the actual Fedex Retail Price: $176.99 Your Price (Because of our contract signed): $135.95 ($41.04 Savings!). Yours sincerely, Mr. Anthony Moore Cc: Senate President Cc: All Foreign Payment Offices Cc: Board of Directors [Fpd] From rkklp09@msn.com Mon Apr 6 05:51:37 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.5 required=5.0 tests=BAYES_99,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_MESSAGE,LOTTO_AGENT,LOTTO_AGENT_RPLY,LOTTO_DEPARTMENT, LOTTO_MANY,LOTTO_WIN_01,LOTTO_YOU_WON_02,MISSING_HEADERS,RBL_POXLAY_01, SPF_PASS,THOUS_EMAIL_ADDRS,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9985] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [165.146.49.63 listed in dnsbl.sorbs.net] * 1.0 LOTTO_AGENT_RPLY Claims Agent * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.2 LOTTO_DEPARTMENT BODY: Claims Department * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 LOTTO_MANY LOTTO_MANY Received: from blu0-omc1-s6.blu0.hotmail.com (blu0-omc1-s6.blu0.hotmail.com [65.55.116.17]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n36CpX0I007922 for ; Mon, 6 Apr 2009 05:51:37 -0700 Received: from BLU118-W45 ([65.55.116.7]) by blu0-omc1-s6.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 6 Apr 2009 05:35:08 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_b0b26659-d52a-4348-978b-b04695ef07c9_" X-Originating-IP: [165.146.49.63] Reply-To: From: REDKINGS ONLINE PROMOTION Subject: [SPAM] Reference Number: ZAR/POP-677152/ZA2009 Date: Mon, 6 Apr 2009 12:35:08 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 06 Apr 2009 12:35:08.0215 (UTC) FILETIME=[1EB27470:01C9B6B4] X-Greylist: Delayed for 00:16:23 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 06 Apr 2009 05:51:37 -0700 (PDT) X-Spam-Prev-Subject: Reference Number: ZAR/POP-677152/ZA2009 Status: R X-Status: X-Keywords: X-UID: 234 Content-Length: 3597 --_b0b26659-d52a-4348-978b-b04695ef07c9_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable 271 Kings Street=2C =20 Eastern-Cape=2C8001=20 South Africa.=20 CONGRATULATIONS!!!!=20 "You have won USD$1=2C950=2C000.00 from Redkings Online Promotions"=20 =20 We wish you success in our Redkings Online Promotions/Email Internet Progra= m made today=2C which was held on 13th of March 2009. Your Email Address wa= s attached to Ticket No: 07-12-35-54-55-02 Drew the Lucky No: 15-19-24-27-4= 7 + 11 from 800=2C000 Email Addresses consequently won in the 2nd Category.= You have therefore been=20 approved to claim a Star Prize of $1=2C950=2C000.00 in cash credited to Fil= e No: M1/2007/08/001.=20 =20 Below is your Winning Details=3B=20 Reference Number: ZAR/POP-677152/ZA2009 Batch Number: ZAR/002831323/M222-23 Amount Won: USD$1=2C950=2C000.00=20 =20 "The Validity period of the winnings is (10) Working Days=2C of your reply = to the Agency=3B hence you are expected to make your claims immediately=2C = any claim not made before this date will be returned as UNCLAIMED."=20 =20 To claim your winning prize=2C you are to contact the appointed agent for t= he immediate release of your winnings:=20 =20 Mr. George Kama Tel: +27-737-518-941 E-mail: claimsmanager101@gmail.com http://www.redkings.com/Promotions.html Congratulations' once again from all our Staff and thank you for being part= of our Promotions.=20 =20 Yours Truly=2C=20 Mrs. Mary Rossman=20 Claims Department=20 Copyrights (C) 2009=20 (Reg No: 2000/003778/04) --_b0b26659-d52a-4348-978b-b04695ef07c9_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable 271 Kings Street=2C =3B
Eastern-Cape=2C8001
South Africa.

CONGRATULATIONS!!!!

"You have won USD$1=2C950=2C000.00 from Redkings Online Promotions"  =3B
We wish you success in our Redkings Online Promotions/Email Internet Progra= m made today=2C which was held on 13th of March 2009. Your Email Address wa= s attached to Ticket No: 07-12-35-54-55-02 Drew the Lucky No: 15-19-24-27-4= 7 + 11 from 800=2C000 Email Addresses consequently won in the 2nd Category.= You have therefore been
approved to claim a Star Prize of $1=2C950=2C000.00 in cash credited to Fil= e No: M1/2007/08/001.
 =3B
Below is your Winning Details=3B
Reference Number: ZAR/POP-677152/ZA2009
Batch Number: ZAR/002831323/M222= -23
Amount Won: USD$1=2C950=2C000.00
 =3B
"The Validity period of the winnings is (10) Working Days=2C of your reply = to the Agency=3B hence you are expected to make your claims immediately=2C = any claim not made before this date will be returned as UNCLAIMED."
&nb= sp=3B
To claim your winning prize=2C you are to contact the appointed ag= ent for the immediate release of your winnings:
 =3B
Mr. George = Kama
Tel: +27-737-518-941
E-mail: claimsmanager101@gmail.com
http://www.redkings.com/Promotions.html
Congratulations' once again from all our Staff and thank you for being part= of our Promotions.
 =3B
Yours Truly=2C
Mrs. Mary Rossman Claims Department
Copyrights (C) 2009
(Reg No: 2000/003778/04)
= --_b0b26659-d52a-4348-978b-b04695ef07c9_-- From secure1o@minskcom.com Mon Apr 6 08:33:33 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.7 required=5.0 tests=ADVANCE_FEE_2,BAYES_95, BL_COUNTRY_NG_2,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,J_CHICKENPOX_21,J_CHICKENPOX_34, J_CHICKENPOX_43,J_CHICKENPOX_53,J_CHICKENPOX_82,L_SOME_STD_PROBS,MILLIONS_01, MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,NA_DOLLARS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, RDNS_DYNAMIC,SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [195.190.127.190 listed in b.barracudacentral.org] * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9864] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.snab-resurs.ru (spb-195-190-127-190.sovintel.ru [195.190.127.190] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n36FXQdm012447 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 6 Apr 2009 08:33:32 -0700 Message-Id: <200904061533.n36FXQdm012447@ga.impsec.org> Received: from User ([82.128.45.13]) (authenticated user admin@snab-resurs.ru) by mail.snab-resurs.ru (Kerio MailServer 6.4.0); Mon, 6 Apr 2009 17:32:00 -0700 Reply-To: From: "MR EGO GABIA" Subject: [SPAM] URGENT RESPONCE NEEDED ...... Date: Mon, 6 Apr 2009 14:32:16 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 01:30:49 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 06 Apr 2009 08:33:32 -0700 (PDT) X-Spam-Prev-Subject: URGENT RESPONCE NEEDED ...... Status: R X-Status: X-Keywords: X-UID: 235 Content-Length: 2986 Attn : Sir/Madam The deal is concerning my late client who has similar last name with you and who hails from your country.This client died leaving the sum of $16 million dollars with our bank,and since then the bank is worried about the fund and the bank has asked me (as the account manager to the late customer)to find any relation of the late customer for claim of the fund. But I know that the late customer(Engr.) died with all his immediate family as a result of the incident.This is why I have to conduct a search over the internet to see if I can get some one(worthy) with similar names so that I will present him to the bank as the late customers next of kin to enable us claim the $16 million. So,I have contacted you because the bank board have issued me a notice to provide the next of kin of the deceased customer or the bank will declare the account unservisable and confiscate the funds to the bank treasury. Because I would not want the bank to confiscate the fund and since I have been unsuccessful in locating the relatives for over last 6 years now, I want to seek your consent to present you as the next of kin of the late customer , so that the proceeds of this account valued at ($16.million US dollars) can be paid to you as the late Engineer's next of kin . After the successful transfer I and you will share the money when I come to your country. All I require is your honest co-operation to enable us see this deal through. I guarantee that this deal will be executed under all legitimate arrangement that will protect us from any breach of the law. I am not contacting because you know or you are related to this late Engineer,hence you are aware that all my efforts to locate any direct family member of the late Engineer proved unsucessful for the past years,and this is why I have contacted you to carry on the deal with you(Hope you understand better now?). I want to assure you that I did not just wake up and decide to do this, I have did my proper home work before contacting you and I want to asure you that this is not a joke. I work with Metro Bank Plc Lagos , I am presently the director of Audit & records of my bank. I have worked with this bank for more than 10yrs now and I want to assure you that if I am not sure that this deal will work, I would not have thought of doing it nor contacting you. You should go ahead and send your information/datas(ie:your full names, address, date of birth, telephone and fax numbers) When I receive the information ,I will work on the original account file of the deceased customer to fill your datas as the new next of kin and thereafter forward you an application form which you will send to our bank officially for the claims. I really want us to treat everything concerning this transaction with uttermost secrecy,therefore I will not accept the involvement of third party in this deal. Thank you very much. Mr.Ego Gabia Email:mregogabiagabia@gmail.com Account Officer Metro Bank Plc From sasav_012@msn.com Mon Apr 6 08:54:46 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.7 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE, J_CHICKENPOX_24,J_CHICKENPOX_64,MILLIONS_01,MILLION_USD,MISSING_HEADERS, PHISH_05,PHISH_18,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6, SPF_PASS,US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_18 BODY: Phishing * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha * 0.6 J_CHICKENPOX_24 BODY: 2alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from blu0-omc2-s3.blu0.hotmail.com (blu0-omc2-s3.blu0.hotmail.com [65.55.111.78]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n36Fsg6E012800 for ; Mon, 6 Apr 2009 08:54:45 -0700 Received: from BLU129-W21 ([65.55.111.73]) by blu0-omc2-s3.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 6 Apr 2009 08:38:20 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_29603f0b-e84e-4b08-a4a7-de777d9a0620_" X-Originating-IP: [82.206.193.34] Reply-To: From: vivian sasa Subject: [SPAM] Project From:(Mrs Vivian Sasa. Date: Mon, 6 Apr 2009 15:38:20 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 06 Apr 2009 15:38:20.0060 (UTC) FILETIME=[B658E5C0:01C9B6CD] X-Greylist: Delayed for 00:16:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 06 Apr 2009 08:54:45 -0700 (PDT) X-Spam-Prev-Subject: Project From:(Mrs Vivian Sasa. Status: R X-Status: X-Keywords: X-UID: 236 Content-Length: 4301 --_29603f0b-e84e-4b08-a4a7-de777d9a0620_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Project From:(Mrs Vivian Sasa. Physical Address:=20 350 Church Street=2C=20 Pretoria 004. Jo=2Cburg SOUTH AFRICA. Tel/Fax: +27 866-073-276 =20 I am ( Mrs Vivian Sasa.) the auditor general of ( Firstrand bank LTD) here = in south Africa in one of our auditing I discover about {$56=2C000.000.00 U= sd } Fifty Six Million USDOLLARS in a dormant account WHICH I WILL LIKE US = TO INVEST in your country.=20 =20 Further investigation on the said fund in question proves to me that the a= ccount owner was a foreigner and he is dead with all members of his family = in a plane crash that occour on 31st day of July 2000 all effort to reach h= is people proves abortive.I am contacting your company as a foreign compan= y to stand as next of kin to the deceased so that the fund can be release t= o your account for investment because the former was a foreigner.=20 =20 At the conculsion of the transfer you will take 40% while 60% will be for m= e and my partner. If you are Interested reply me urgently by please forward= ing the following information as stated below:=20 {1} Your Name/company's name and full address=2C=20 {2} Bank Name:............ .......... {3} Bank Address..................... {4} Account No:...................... {5} Swift Code...{if any} {6} Account Holder's Name: .................... {7} Your telephone Number.both Home=2C Office & Cell/Mobile and fax Numbers......................... {8} Your Occupation.............. {9} Your Valid ID ................... Upon the receipt of the above details=2C payment will be activated by the f= eeding of your data into payment system=2C followed by a signal that will b= e sent to the paying bank to remit the funds into your nominated bank accou= nt within 7 official working days of receipt of the above information. Best Regards=2C yours sincerely=2C=20 Mrs Vivian Sasa. --_29603f0b-e84e-4b08-a4a7-de777d9a0620_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Project From:(Mrs Vivian Sasa.
Physical Address:
350 Church Street= =2C
Pretoria 004.
Jo=2Cburg SOUTH AFRICA.
Tel/Fax: +27 866-073-27= 6
 =3B
I am ( Mrs Vivian Sasa.) the auditor general of ( Firstran= d bank LTD) here in south Africa in one of our auditing I discover about {$= 56=2C000.000.00 Usd } Fifty Six Million USDOLLARS in a dormant account WHIC= H I WILL LIKE US TO INVEST in your country.
 =3B
Further =3B= investigation on the said fund in question proves to me that the account o= wner was a foreigner and he is dead with all members of his family in a pla= ne crash that occour on 31st day of July 2000 all effort to reach his peopl= e proves abortive.I am contacting your company =3B as a foreign company= to stand as next of kin to the deceased so that the fund can be release to= your account for investment because the former was a foreigner.
 = =3B
At the conculsion of the transfer you will take 40% while 60% will b= e for me and my partner. If you are Interested reply me urgently by please = forwarding the following
information as stated below:
{1} Your Name/= company's name and full address=2C
{2} Bank Name:............ .........= .
{3} Bank Address.....................
{4} Account No:..............= ........
{5} Swift Code...{if any}
{6} Account Holder's Name: .......= .............
{7} Your telephone Number.both Home=2C Office &=3B
C= ell/Mobile and fax Numbers.........................
{8} Your Occupation.= .............
{9} Your Valid ID ...................
Upon the receipt = of the above details=2C payment will be activated by the feeding of your da= ta into payment system=2C followed by a signal that will be sent to the pay= ing bank to remit the funds into your nominated bank account within 7 offic= ial working days of receipt of the above information.
Best Regards=2Cyours sincerely=2C
Mrs Vivian Sasa.
= --_29603f0b-e84e-4b08-a4a7-de777d9a0620_-- From harryn@yhcargo.com Mon Apr 6 11:53:56 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.8 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_50,BL_COUNTRY_CN_1,BL_COUNTRY_CN_2,FREEMAIL_FORGED, HTML_MESSAGE,HTML_STOOPID_01,J_CHICKENPOX_42,L_SOME_STD_PROBS,MILLIONS_01, MILLION_USD,MIME_BASE64_TEXT,MISSING_HEADERS,RBL_PSBL_01,RCVD_IN_BRBL, RDNS_NONE,SUBJ_ALL_CAPS,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [60.191.61.114 listed in b.barracudacentral.org] * 0.5 BL_COUNTRY_CN_2 Mail client in China * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [60.191.61.114 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [60.191.61.114 listed in cn.countries.nerd.dk] * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5180] * 0.5 HTML_STOOPID_01 RAW: stupid HTML: empty FONT tag * 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from yhcargo.com ([60.191.61.114]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n36IrjKL017751 for ; Mon, 6 Apr 2009 11:53:51 -0700 Received: from WebMail ([127.0.0.1]) (envelope-sender ) by 127.0.0.1 with ESMTP for ; Mon, 06 Apr 2009 20:02:38 +0800 Date: Mon, 6 Apr 2009 20:02:37 +0800 From: "harryn" Reply-To: "harryn" Subject: [SPAM] REQUEST FOR CONFIDENTIAL CO OPERATION X-Priority: 3 X-Mailer: WebMail Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="--=__b_000_f0704b7d624e71ee127795483296c065" MIME-Version: 1.0 X-Greylist: Delayed for 05:37:36 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 06 Apr 2009 11:53:56 -0700 (PDT) X-Spam-Prev-Subject: REQUEST FOR CONFIDENTIAL CO OPERATION Status: R X-Status: X-Keywords: X-UID: 237 Content-Length: 6739 This is a multi-part message in MIME format. ----=__b_000_f0704b7d624e71ee127795483296c065 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 DQpGcm9tIHRoZSBkZXNrIG9mIERyLiBIYXJyeSBOZ3ViYW5lIA0KUHJvamVjdCBNYW5hZ2VtZW50 IERpcmVjdG9yRGVwdC5vZiBNaW5lcmFsIGFuZCBFbmVyZ3lSZXB1YmxpYyBvZiBTb3V0aCBBZnJp Y2EuUFJJVkFURSBlLU1BSUw6aGI2NEByb2NrZXRtYWlsLmNvbU1vYmlsZTogKzI3IDc4NyA2MjYg NTk4RmF4OiArMjcgODY2IDA1OSA1NTENClRoZSBQcmVzaWRlbnQvTWFuYWdpbmcgRGlyZWN0b3Iv Q0VPDQombmJzcDsNClJFUVVFU1QgRk9SIENPTkZJREVOVElBTCBDTyBPUEVSQVRJT04NCiZuYnNw Ow0KU2lyL01hZGFtLA0KSSBXcml0ZSBpbiB5b3VyIGNvbXBhbnksIGFza2luZyBmb3IgeW91ciBp bmR1bGdlbmNlIGluIHJlLXByb2ZpbGluZyBmdW5kcyB0byB0aGUgdHVuZSBvZiBUd2VsdmUgTWls bGlvbiBTaXggSHVuZHJlZCBhbmQgRmlmdHkgVGhvdXNhbmQgVW5pdGVkIFN0YXRlcyBEb2xsYXJz e1VTJDEyLDY1MC4wMDAuMDB9d2hpY2ggd2Ugd2FudCB0byB0cmFuc2ZlciBhbmQga2VlcCBzYWZl bHkgZm9yIGludmVzdG1lbnQgcHVycG9zZSB1bmRlciB5b3VyIGFibGUgc3VwZXJ2aXNpb24uIElu IG90aGVyIHdvcmRzLCB3ZSB3b3VsZCBsaWtlIHlvdSB0byByZWNlaXZlIHRoZSBzYWlkIGZ1bmRz IG9uIG91ciBiZWhhbGYuIFRoaXMgZnVuZHMgd2VyZSBkZXJpdmVkIGZyb20gb3ZlciBpbnZvaWNl IHByb2plY3RzIGF3YXJkZWQgdG8gZm9yZWlnbiBjb250cmFjdG9ycyBieSBteSBjb21taXR0ZWUs IGFuZCBwcmVzZW50bHkgdGhlIGFjdHVhbCBjb250cmFjdCBjb3N0IGhhdmUgYmVlbiBwYWlkIHRv IHRoZSBvcmlnaW5hbCBwcm9qZWN0IGV4ZWN1dG9ycywgbGVhdmluZyB0aGUgYmFsYW5jZSBpbiB0 aGUgdHVuZSBvZiB0aGUgc2FpZCBhbW91bnQgd2hpY2ggd2UgaGF2ZSBpbiBwcmluY2lwYWwgb2J0 YWluZWQgdG8gcmVtaXQgb3ZlcnNlYXMuVGhpcyBjb250cmFjdCBpcyBpbiBwdXJzdWl0IG9mIGFu IGVuYWJsaW5nIGVudmlyb25tZW50IGZvciBhIHN1Y2Nlc3NmdWwgaG9zdGluZyBvZiB0aGUgRklG QSBXT1JMRCBDVVAgRklOQUxTIElOIDIwMTAuV2l0aCBtZSBhcyB0aGUgaGVhZCBvZiB0aGlzIGNv bW1pdHRlZSBzYWRkbGVkIHdpdGggdGhlIHJlc3BvbnNpYmlsaXR5IG9mIHJlY29uY2lsaW5nIGNv bnRyYWN0dWFsIHBheW1lbnRzIGFuZCB0aGUgaW1wbGVtZW50YXRpb24gb2YgcHJvamVjdHMsIHRo ZSB0cmFuc2ZlciB3aWxsIGJlIGxlZ2FsbHkgcHJvY2Vzc2VkIGFuZCBhcHByb3ZlZCBieSB0aGUg TWluaXN0cnkgb2YgRmluYW5jZSBhbmQgRm9yZWlnbiBFeGNoYW5nZSBEZXBhcnRtZW50IGFzIGNv bnRyYWN0dWFsIHBheW1lbnQgZHVlIHRvIHlvdSBvciB5b3VyIGNvbXBhbnkgc3VjY2Vzc2Z1bGx5 LldlIGhhdmUgYWdyZWVkIHRvIG5lZ290aWF0ZSBhIHJlYXNvbmFibGUgY29tcGVuc2F0aW9uIGZv ciB5b3VyIHBhcnRpY2lwYXRpb24gYW5kIGkgcHJvcG9zZSAyMi4yJSBmb3IgeW91LCB3aGlsZSB3 ZSBhbHNvIHByb3Bvc2UgdGhhdCB3ZSByZWNlaXZlIDQ2LjYlIGFuZCAzMS4yJSB3aWxsIGJlIGVt YmFya2VkIGZvciBwdXJwb3NlIG9mIHRheGF0aW9uLiBQbGVhc2UgY29udGFjdCBtZSBpbW1lZGlh dGVseSBvbiB0aGUgdGVsZXBob25lLCBlbWFpbCBhZGRyZXNzIG9yIGZheCBudW1iZXIgYWJvdmUg aWYgdGhpcyBwcm9wb3NhbCBpcyBhY2NlcHRhYmxlIHRvIHlvdSBmb3IgZnVydGhlciBkaXNjdXNz aW9ucyB3aXRoIHlvdS4NCiZuYnNwOw0KSSBhd2FpdHMgaW4gYW50aWNpcGF0aW9uIG9mIHlvdXIg ZnVsbGVzdCBjb29wZXJhdGlvbi4NCiZuYnNwOw0KWW91cnMgU2luY2VyZWx5LA0KJm5ic3A7DQpE ci5IYXJyeSBOZ3ViYW5lDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQpNZXNzYWdlIHNlbnQgdXNpbmcgV2lubWFpbCBNYWlsIFNl cnZlcg0KDQo= ----=__b_000_f0704b7d624e71ee127795483296c065 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: base64 PEhUTUw+PEhFQUQ+PE1FVEEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9aXNvLTg4NTktMSI+PC9IRUFEPjxCT0RZPjxESVY+DQo8UCBjbGFzcz1F Q19Nc29Ob3JtYWwgc3R5bGU9IkxJTkUtSEVJR0hUOiAxNC40cHQiPjxTUEFOIHN0eWxlPSJGT05U LVNJWkU6IDEwcHQ7IENPTE9SOiAjMTExMTExOyBGT05ULUZBTUlMWTogQXJpYWwiPjxGT05UIGZh Y2U9IkNvbWljIFNhbnMgTVMiPjxTVFJPTkc+RnJvbSB0aGUgZGVzayBvZiBEci4gSGFycnkgTmd1 YmFuZSA8L1NUUk9ORz48L1A+DQo8RElWPjxGT05UIHNpemU9MT48U1RST05HPlByb2plY3QgTWFu YWdlbWVudCBEaXJlY3RvcjxCUj5EZXB0Lm9mIE1pbmVyYWwgYW5kIEVuZXJneTxCUj5SZXB1Ymxp YyBvZiBTb3V0aCBBZnJpY2EuPEJSPlBSSVZBVEUgZS1NQUlMOmhiNjRAcm9ja2V0bWFpbC5jb208 QlI+TW9iaWxlOiArMjcgNzg3IDYyNiA1OTg8QlI+RmF4OiArMjcgODY2IDA1OSA1NTE8L1NUUk9O Rz48L0ZPTlQ+PC9ESVY+DQo8RElWPjxGT05UIHNpemU9MT48U1RST05HPlRoZSBQcmVzaWRlbnQv TWFuYWdpbmcgRGlyZWN0b3IvQ0VPPC9TVFJPTkc+PC9GT05UPjwvRElWPg0KPERJVj48U1RST05H PjxGT05UIHNpemU9MT48L0ZPTlQ+PC9TVFJPTkc+Jm5ic3A7PC9ESVY+DQo8RElWPjxVPlJFUVVF U1QgRk9SIENPTkZJREVOVElBTCBDTyBPUEVSQVRJT048L1U+PC9ESVY+DQo8RElWPjxVPjwvVT4m bmJzcDs8L0RJVj4NCjxESVY+PEZPTlQgc2l6ZT0xPjxTVFJPTkc+U2lyL01hZGFtLDwvU1RST05H PjwvRk9OVD48L0RJVj48Rk9OVCBzaXplPTE+PFNUUk9ORz4NCjxESVY+PEJSPkkgV3JpdGUgaW4g eW91ciBjb21wYW55LCBhc2tpbmcgZm9yIHlvdXIgaW5kdWxnZW5jZSBpbiByZS1wcm9maWxpbmcg ZnVuZHMgdG8gdGhlIHR1bmUgb2YgVHdlbHZlIE1pbGxpb24gU2l4IEh1bmRyZWQgYW5kIEZpZnR5 IFRob3VzYW5kIFVuaXRlZCBTdGF0ZXMgRG9sbGFyc3tVUyQxMiw2NTAuMDAwLjAwfXdoaWNoIHdl IHdhbnQgdG8gdHJhbnNmZXIgYW5kIGtlZXAgc2FmZWx5IGZvciBpbnZlc3RtZW50IHB1cnBvc2Ug dW5kZXIgeW91ciBhYmxlIHN1cGVydmlzaW9uLiBJbiBvdGhlciB3b3Jkcywgd2Ugd291bGQgbGlr ZSB5b3UgdG8gcmVjZWl2ZSB0aGUgc2FpZCBmdW5kcyBvbiBvdXIgYmVoYWxmLiBUaGlzIGZ1bmRz IHdlcmUgZGVyaXZlZCBmcm9tIG92ZXIgaW52b2ljZSBwcm9qZWN0cyBhd2FyZGVkIHRvIGZvcmVp Z24gY29udHJhY3RvcnMgYnkgbXkgY29tbWl0dGVlLCBhbmQgcHJlc2VudGx5IHRoZSBhY3R1YWwg Y29udHJhY3QgY29zdCBoYXZlIGJlZW4gcGFpZCB0byB0aGUgb3JpZ2luYWwgcHJvamVjdCBleGVj dXRvcnMsIGxlYXZpbmcgdGhlIGJhbGFuY2UgaW4gdGhlIHR1bmUgb2YgdGhlIHNhaWQgYW1vdW50 IHdoaWNoIHdlIGhhdmUgaW4gcHJpbmNpcGFsIG9idGFpbmVkIHRvIHJlbWl0IG92ZXJzZWFzLjxC Uj5UaGlzIGNvbnRyYWN0IGlzIGluIHB1cnN1aXQgb2YgYW4gZW5hYmxpbmcgZW52aXJvbm1lbnQg Zm9yIGEgc3VjY2Vzc2Z1bCBob3N0aW5nIG9mIHRoZSBGSUZBIFdPUkxEIENVUCBGSU5BTFMgSU4g MjAxMC5XaXRoIG1lIGFzIHRoZSBoZWFkIG9mIHRoaXMgY29tbWl0dGVlIHNhZGRsZWQgd2l0aCB0 aGUgcmVzcG9uc2liaWxpdHkgb2YgcmVjb25jaWxpbmcgY29udHJhY3R1YWwgcGF5bWVudHMgYW5k IHRoZSBpbXBsZW1lbnRhdGlvbiBvZiBwcm9qZWN0cywgdGhlIHRyYW5zZmVyIHdpbGwgYmUgbGVn YWxseSBwcm9jZXNzZWQgYW5kIGFwcHJvdmVkIGJ5IHRoZSBNaW5pc3RyeSBvZiBGaW5hbmNlIGFu ZCBGb3JlaWduIEV4Y2hhbmdlIERlcGFydG1lbnQgYXMgY29udHJhY3R1YWwgcGF5bWVudCBkdWUg dG8geW91IG9yIHlvdXIgY29tcGFueSBzdWNjZXNzZnVsbHkuPEJSPldlIGhhdmUgYWdyZWVkIHRv IG5lZ290aWF0ZSBhIHJlYXNvbmFibGUgY29tcGVuc2F0aW9uIGZvciB5b3VyIHBhcnRpY2lwYXRp b24gYW5kIGkgcHJvcG9zZSAyMi4yJSBmb3IgeW91LCB3aGlsZSB3ZSBhbHNvIHByb3Bvc2UgdGhh dCB3ZSByZWNlaXZlIDQ2LjYlIGFuZCAzMS4yJSB3aWxsIGJlIGVtYmFya2VkIGZvciBwdXJwb3Nl IG9mIHRheGF0aW9uLiBQbGVhc2UgY29udGFjdCBtZSBpbW1lZGlhdGVseSBvbiB0aGUgdGVsZXBo b25lLCBlbWFpbCBhZGRyZXNzIG9yIGZheCBudW1iZXIgYWJvdmUgaWYgdGhpcyBwcm9wb3NhbCBp cyBhY2NlcHRhYmxlIHRvIHlvdSBmb3IgZnVydGhlciBkaXNjdXNzaW9ucyB3aXRoIHlvdS48L0RJ Vj4NCjxESVY+PC9TVFJPTkc+PC9GT05UPiZuYnNwOzwvRElWPg0KPERJVj48Rk9OVCBzaXplPTE+ PFNUUk9ORz5JIGF3YWl0cyBpbiBhbnRpY2lwYXRpb24gb2YgeW91ciBmdWxsZXN0IGNvb3BlcmF0 aW9uLjwvU1RST05HPjwvRk9OVD48L0RJVj4NCjxESVY+PFNUUk9ORz48Rk9OVCBzaXplPTE+PC9G T05UPjwvU1RST05HPiZuYnNwOzwvRElWPg0KPERJVj48Rk9OVCBzaXplPTE+PFNUUk9ORz5Zb3Vy cyBTaW5jZXJlbHksPC9TVFJPTkc+PC9GT05UPjwvRElWPg0KPERJVj4mbmJzcDs8L0RJVj4NCjxE SVY+PEZPTlQgc2l6ZT0xPjxTVFJPTkc+RHIuSGFycnkgTmd1YmFuZTwvU1RST05HPjwvRk9OVD48 L0RJVj48L0ZPTlQ+PC9TUEFOPjwvRElWPjwvQk9EWT48L0hUTUw+DQo8cHJlPg0KDQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCk1lc3Nh Z2Ugc2VudCB1c2luZyBXaW5tYWlsIE1haWwgU2VydmVyDQo8L3ByZT4NCg== ----=__b_000_f0704b7d624e71ee127795483296c065-- From secure1o@minskcom.com Mon Apr 6 17:10:55 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.9 required=5.0 tests=ADVANCE_FEE_2,BAYES_95, BL_COUNTRY_NG_2,BL_COUNTRY_RU_1,DATE_IN_PAST_03_06,FORGED_MUA_OUTLOOK, FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,J_CHICKENPOX_21, J_CHICKENPOX_34,J_CHICKENPOX_43,J_CHICKENPOX_53,J_CHICKENPOX_82, L_SOME_STD_PROBS,MILLIONS_01,MISSING_HEADERS,MSGID_FROM_MTA_HEADER, MSOE_MID_WRONG_CASE,NA_DOLLARS,RBL_POXLAY_01,RCVD_IN_BRBL,RCVD_IN_SORBS_WEB, RDNS_DYNAMIC,SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [195.190.127.190 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [82.128.47.58 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 0.0 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9864] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.snab-resurs.ru (spb-195-190-127-190.sovintel.ru [195.190.127.190] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n370AlPb026283 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 6 Apr 2009 17:10:54 -0700 Message-Id: <200904070010.n370AlPb026283@ga.impsec.org> Received: from User ([82.128.47.58]) (authenticated user admin@snab-resurs.ru) by mail.snab-resurs.ru (Kerio MailServer 6.4.0); Mon, 6 Apr 2009 23:23:16 -0700 X-KWF-FilterProgress: ** Reply-To: From: "MR EGO GABIA" Subject: [SPAM] URGENT RESPONCE NEEDED ...... Date: Mon, 6 Apr 2009 20:23:32 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: URGENT RESPONCE NEEDED ...... Status: R X-Status: X-Keywords: X-UID: 238 Content-Length: 2986 Attn : Sir/Madam The deal is concerning my late client who has similar last name with you and who hails from your country.This client died leaving the sum of $16 million dollars with our bank,and since then the bank is worried about the fund and the bank has asked me (as the account manager to the late customer)to find any relation of the late customer for claim of the fund. But I know that the late customer(Engr.) died with all his immediate family as a result of the incident.This is why I have to conduct a search over the internet to see if I can get some one(worthy) with similar names so that I will present him to the bank as the late customers next of kin to enable us claim the $16 million. So,I have contacted you because the bank board have issued me a notice to provide the next of kin of the deceased customer or the bank will declare the account unservisable and confiscate the funds to the bank treasury. Because I would not want the bank to confiscate the fund and since I have been unsuccessful in locating the relatives for over last 6 years now, I want to seek your consent to present you as the next of kin of the late customer , so that the proceeds of this account valued at ($16.million US dollars) can be paid to you as the late Engineer's next of kin . After the successful transfer I and you will share the money when I come to your country. All I require is your honest co-operation to enable us see this deal through. I guarantee that this deal will be executed under all legitimate arrangement that will protect us from any breach of the law. I am not contacting because you know or you are related to this late Engineer,hence you are aware that all my efforts to locate any direct family member of the late Engineer proved unsucessful for the past years,and this is why I have contacted you to carry on the deal with you(Hope you understand better now?). I want to assure you that I did not just wake up and decide to do this, I have did my proper home work before contacting you and I want to asure you that this is not a joke. I work with Metro Bank Plc Lagos , I am presently the director of Audit & records of my bank. I have worked with this bank for more than 10yrs now and I want to assure you that if I am not sure that this deal will work, I would not have thought of doing it nor contacting you. You should go ahead and send your information/datas(ie:your full names, address, date of birth, telephone and fax numbers) When I receive the information ,I will work on the original account file of the deceased customer to fill your datas as the new next of kin and thereafter forward you an application form which you will send to our bank officially for the claims. I really want us to treat everything concerning this transaction with uttermost secrecy,therefore I will not accept the involvement of third party in this deal. Thank you very much. Mr.Ego Gabia Email:mregogabiagabia@gmail.com Account Officer Metro Bank Plc From michaelcheng@alexandria.cc Mon Apr 6 20:25:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=25.0 required=5.0 tests=BAYES_99,DEAR_SOMETHING, DNS_FROM_RFC_BOGUSMX,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, J_CHICKENPOX_32,J_CHICKENPOX_46,J_CHICKENPOX_82,L_SOME_STD_PROBS, MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB, SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.5 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [74.198.8.57 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.6 J_CHICKENPOX_46 BODY: 4alpha-pock-6alpha * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha * 0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp-outbound03.tor.pathcom.com (esmtp26.pathcom.com [209.250.157.208]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n373PNin031141 for ; Mon, 6 Apr 2009 20:25:26 -0700 Received: from User (unknown [74.198.8.57]) (Authenticated sender: stephenp@pathcom.com) by smtp-outbound03.tor.pathcom.com (Postfix) with ESMTPA id 6E0C0484F3B7; Mon, 6 Apr 2009 22:47:38 -0400 (EDT) Reply-To: From: "michael cheng" Subject: [SPAM] RELIABLE PAYMENT RECIVER/ACCOUNTANT WANTED.... Date: Mon, 6 Apr 2009 22:48:04 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090407024738.6E0C0484F3B7@smtp-outbound03.tor.pathcom.com> To: undisclosed-recipients:; X-Greylist: Delayed for 00:36:53 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 06 Apr 2009 20:25:26 -0700 (PDT) X-Spam-Prev-Subject: RELIABLE PAYMENT RECIVER/ACCOUNTANT WANTED.... Status: R X-Status: X-Keywords: X-UID: 239 Content-Length: 1164 Dear Sir/Madam, I am Mr Michael cheng ,managinig director of JJYENGINE Foreign Trade Co.Ltd.We are a trading company that is into the import and export of goods like Generaing Sets,Engine,and Air Compresso Set etc,we export these equipments in tons into U.S,Canada and Europe. Owing to the large amount of clients that we have in the U.s.a/ Canada we are having difficulty in reaching all of them,therefore we decided to employ representatives in all the states of America,Canada,Europe to help us get to our clients. As our representative,you shall serve as a link between us and our clients and you will also be responsible for the collection of payments on our behalf.Note: that you shall have a 20% commission for every payment that you collect on our behalf.Kindly fill this form below and forward to this E-mail address: michaelcheng@alexandria.cc 1.FIRST NAMES : 2.MIDDLE NAME : 3.CONTACT ADDRESS : 4.PHONE NUMBER : 5.FAX NUMBER: 6.COUNTRY OF RESIDENCE: 7.OCCUPATION: 8.MARITAL STATUS: 9.EMAIL ADDRESS: Subject to your response,we shall have our company's attorney draft out an agreement to seal up this contract. Best Regards, Mr Michae Cheng From tecomodesi@live.com Tue Apr 7 05:20:19 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.0 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FILL_THIS_FORM_01,FREEMAIL_FROM,FREEMAIL_REPLYTO, MILLIONS_01,MILLION_USD,PHISH_05,RAZOR2_CHECK,RBL_POXLAY_01,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_HELO_EQ_DSL_3,SARE_SUB_NEED_REPLY, SPF_SOFTFAIL,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 SARE_HELO_EQ_DSL_3 SARE_HELO_EQ_DSL_3 * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.243.161.106 listed in dnsbl.sorbs.net] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from mail.sunshinecable.com (mail.sunshinecable.com [209.52.200.3]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n37CKEV3008322 for ; Tue, 7 Apr 2009 05:20:19 -0700 Received: from localhost (localhost [127.0.0.1]) by mail.sunshinecable.com (Postfix) with ESMTP id C08A9700698; Mon, 6 Apr 2009 15:36:13 -0700 (PDT) Received: from mail.sunshinecable.com ([127.0.0.1]) by localhost (mail [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 19992-07-2; Mon, 6 Apr 2009 15:36:08 -0700 (PDT) Received: by mail.sunshinecable.com (Postfix, from userid 81) id 094977544C2; Sat, 10 Jan 2009 05:36:25 -0800 (PST) Received: from dsl-243-161-106.telkomadsl.co.za (dsl-243-161-106.telkomadsl.co.za [41.243.161.106]) by mail.sunshinecable.com (Horde MIME library) with HTTP; Sat, 10 Jan 2009 05:36:24 -0800 Message-ID: <20090110053624.c1bhv3knqgowss8g@mail.sunshinecable.com> Date: Sat, 10 Jan 2009 05:36:24 -0800 From: Teco Modesi Reply-to: tecmodesi@jmail.co.za To: undisclosed-recipients:; Subject: [SPAM] Re:Reply Urgently MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.1.2) X-User-Account: gfchambe X-Virus-Scanned: amavisd-new at sunshinecable.com X-Greylist: Delayed for 08:07:36 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 07 Apr 2009 05:20:19 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n37CKEV3008322 X-Spam-Prev-Subject: Re:Reply Urgently Status: R X-Status: X-Keywords: X-UID: 240 Content-Length: 1274 From: Mr.Teco Modesi Direct Line: + 27 -786 233 372 Email: tecomodesi@live.com Attention pleases and complement of the New Year, I am contacting you base on a financial discovery I made by 2008 end f year audit in the bank I am working as the manager on Credit and Foreign Bills hear in South Africa. I am writing in respect of a foreign customer of our bank, whose name is Chung Timothy, (Mr.), an American citizen who died in a plane crash [Korean Air Flight 801] with the whole passengers onboard on August 6, 1997. Your can view this website for more detail. http://www.cnn.com/WORLD/9708/06/guam.passenger.list He died with his next of kin Miss. Chung Lynda leaving US$15.5M (Fifteen Million Five Hundred Thousand United States Dollars) with no one to claim it. I need you as a foreign partner to stand as the beneficiary and receive the money into your account in your country. If interested, please contact me via my private email tecmodesi@jmail.co.za immediately with the under listed personal details; .1).Age.(2) Residential address (3) occupation (4)private telephone. Waiting to hear from you soonest, Teco Modesi ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. From info@centralbanknigeria.org Tue Apr 7 16:02:54 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, INVALID_MSGID,JM_SOUGHT_FRAUD_3,LOTTO_YOU_WON_03,L_SOME_STD_PROBS, MISSING_HEADERS,RDNS_NONE,SARE_FRAUD_X3,SARE_FRAUD_X4,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9950] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 1.9 INVALID_MSGID Message-Id is not valid, according to RFC 2822 * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from primedirec.com ([12.229.87.66]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n37N2nMN024709 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 7 Apr 2009 16:02:54 -0700 Received: from User ([82.128.27.32]) by primedirec.com (IceWarp 9.3.2) with ASMTP id NFX89007; Sun, 05 Apr 2009 18:43:07 -0800 Reply-To: From: "CENTRAL BANK OF NIGERIA" Subject: [SPAM] PAYMENT NOTIFICATION OF YOUR FUNDS Date: Mon, 6 Apr 2009 02:43:16 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: acf273fac5f6586a03eccdde44e1dc0e X-Greylist: Delayed for 38:36:27 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 07 Apr 2009 16:02:54 -0700 (PDT) X-Spam-Prev-Subject: PAYMENT NOTIFICATION OF YOUR FUNDS Status: R X-Status: X-Keywords: X-UID: 241 Content-Length: 2277 OFFICE OF THE GOVERNOR. CENTRAL BANK OF NIGERIA Tinubu square, Lagos- Nigeria. Our ref: Cbn/Ohg/Oxd1/2009 Your ref: ............................... Telex: Cenbank. Payment file: Cbn/Ben/09 PAYMENT NOTIFICATION OF YOUR FUNDS Attn: Beneficiary, Hello. We have decided to bring to your attention, the fact that we have done everything necessary to make sure payments from the debt remittance account are made to the Bonafide Beneficiaries. I am informing you of an attempt by some men to collect your payment on your behalf. I had to ask them why they came to see me in person and they said that they came to collect your inheritance/contract funds payment sum of $5M which rightfully belongs to you as shown in your file with us, on your behalf and by your authorization. However, I am writing you this email to find out from you if you actually sent them. Note that they actually tendered some vital documents which proved that you actually sent them to collect these funds. Below is the list of documents which they presented. 1) Letter of administration 2) Order to release 3) High court injunction Due to the nature of my job, I cannot afford to make any mistake in releasing the funds to anyone except you who is the recognized as true beneficiary to these funds. I want to hear from you before I order the release of the funds to these men who claim to be your representatives because they will be back to my office next week. I decided to carry out this decision based on my work experience and this is a risk I cannot take because I have not heard anything from you. Kindly direct your response to the private email address of my boss, Prof. Charles Soludo, the executive governor of the central bank of Nigeria Cbn, below for quicker deliberation and response from him on the release of your funds to you. Please remember to indicate your personal phone number he can reach you on in your response. Note that for security reasons you have been assigned a code/password which is {TT7270CBN}, please note that this code is the reference number for your transfer and it's being disclosed to you alone, guard this jealously and all your email response should carry this code as the subject. Yours faithfully, Dr Charles soludo Governor.Central bank of Nigeria From secure1o@minskcom.com Wed Apr 8 02:51:55 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.2 required=5.0 tests=ADVANCE_FEE_2,BAYES_95, BL_COUNTRY_NG_2,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,J_CHICKENPOX_21,J_CHICKENPOX_34, J_CHICKENPOX_43,J_CHICKENPOX_53,J_CHICKENPOX_82,L_SOME_STD_PROBS,MILLIONS_01, MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,NA_DOLLARS, RBL_PSBL_01,RCVD_IN_BRBL,RDNS_DYNAMIC,SARE_FRAUD_X3,SARE_FRAUD_X4, SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [195.190.127.190 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [195.190.127.190 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9858] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.snab-resurs.ru (spb-195-190-127-190.sovintel.ru [195.190.127.190] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n389pnWi008387 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 8 Apr 2009 02:51:55 -0700 Message-Id: <200904080951.n389pnWi008387@ga.impsec.org> Received: from User ([82.128.47.157]) (authenticated user admin@snab-resurs.ru) by mail.snab-resurs.ru (Kerio MailServer 6.4.0); Wed, 8 Apr 2009 13:39:57 -0700 X-KWF-FilterProgress: * Reply-To: From: "MR EGO GABIA" Subject: [SPAM] URGENT RESPONCE NEEDED ...... Date: Wed, 8 Apr 2009 10:40:02 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: URGENT RESPONCE NEEDED ...... Status: R X-Status: X-Keywords: X-UID: 242 Content-Length: 2985 Attn : Sir/Madam The deal is concerning my late client who has similar last name with you and who hails from your country.This client died leaving the sum of $16 million dollars with our bank,and since then the bank is worried about the fund and the bank has asked me (as the account manager to the late customer)to find any relation of the late customer for claim of the fund. But I know that the late customer(Engr.) died with all his immediate family as a result of the incident.This is why I have to conduct a search over the internet to see if I can get some one(worthy) with similar names so that I will present him to the bank as the late customers next of kin to enable us claim the $16 million. So,I have contacted you because the bank board have issued me a notice to provide the next of kin of the deceased customer or the bank will declare the account unservisable and confiscate the funds to the bank treasury. Because I would not want the bank to confiscate the fund and since I have been unsuccessful in locating the relatives for over last 6 years now, I want to seek your consent to present you as the next of kin of the late customer , so that the proceeds of this account valued at ($16.million US dollars) can be paid to you as the late Engineer's next of kin . After the successful transfer I and you will share the money when I come to your country. All I require is your honest co-operation to enable us see this deal through. I guarantee that this deal will be executed under all legitimate arrangement that will protect us from any breach of the law. I am not contacting because you know or you are related to this late Engineer,hence you are aware that all my efforts to locate any direct family member of the late Engineer proved unsucessful for the past years,and this is why I have contacted you to carry on the deal with you(Hope you understand better now?). I want to assure you that I did not just wake up and decide to do this, I have did my proper home work before contacting you and I want to asure you that this is not a joke. I work with Metro Bank Plc Lagos , I am presently the director of Audit & records of my bank. I have worked with this bank for more than 10yrs now and I want to assure you that if I am not sure that this deal will work, I would not have thought of doing it nor contacting you. You should go ahead and send your information/datas(ie:your full names, address, date of birth, telephone and fax numbers) When I receive the information ,I will work on the original account file of the deceased customer to fill your datas as the new next of kin and thereafter forward you an application form which you will send to our bank officially for the claims. I really want us to treat everything concerning this transaction with uttermost secrecy,therefore I will not accept the involvement of third party in this deal. Thank you very much. Mr.Ego Gabia Email:e.egogabiaego@gmail.com Account Officer Metro Bank Plc From pro@alpine.nswebhost.com Wed Apr 8 14:14:23 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=21.5 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_60,DATE_IN_PAST_24_48,FREEMAIL_FORGED,FROM_SUBDOMAIN,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_36,J_CHICKENPOX_65,J_CHICKENPOX_74, J_CHICKENPOX_92,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.2 FROM_SUBDOMAIN From address is a third-level domain * 1.2 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date * 0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha * 0.6 J_CHICKENPOX_92 BODY: 9alpha-pock-2alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_36 BODY: 3alpha-pock-6alpha * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7521] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from alpine.nswebhost.com (alpine.nswebhost.com [69.73.185.100]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n38LEJ4N026951 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 8 Apr 2009 14:14:23 -0700 Received: from pro by alpine.nswebhost.com with local (Exim 4.69) (envelope-from ) id 1LqymN-0002lm-Vt for jhardin@impsec.org; Mon, 06 Apr 2009 19:03:03 -0500 To: jhardin@impsec.org Subject: [SPAM] REPLY US X-PHP-Script: 207.210.125.214/~pro/images/3/index.php for 82.128.3.85, 82.128.3.85 From: AFRIBANK PLC Reply-To: afribank_operations2@yahoo.com.hk MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit Message-Id: Date: Mon, 06 Apr 2009 19:03:03 -0500 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - alpine.nswebhost.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [885 885] / [47 12] X-AntiAbuse: Sender Address Domain - alpine.nswebhost.com X-Greylist: Delayed for 45:11:11 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 08 Apr 2009 14:14:23 -0700 (PDT) X-Spam-Prev-Subject: REPLY US Status: R X-Status: X-Keywords: X-UID: 243 Content-Length: 2122 AFRIBANK NIGERIA PLC Afribank Plaza, 51/55 Broad Street, Lagos-Nigeria Reminder Notice We received instruction from the Debt Management office, The Presidency, to have your USD $3.1m currently approved by the contract Review and Payment Committee released to you through our Smart Card Department In a motion filed at the High Court of Justice in respect of your outstanding US$3.1M Contract Payment videCONTRACTNO.:MME/32789XDHGH/2007 currently in an Escrow account of our Bank , be informed that this office have been advised via a Court ruling to revalidate yourpayment transfer since its validity of 8th November,2008 You will receive your payment immediately through our Swift card payment centres in Europe, America,Africa and Asia Pacific,This is part of an instruction/mandate passed by the Senate President,at the Federal House of Senate,Abuja in respect to oversea Debt contract payment and debt re-scheduling plan of the Federal Republic of Nigeria and Fifteen other Economic Communities of West African States. This card centre will send you an ATM CARD which you will use to withdraw your money through an ATM MACHINE in any part of the world, but the maximum is($10,000.00) Ten Thousand US Dollars per transaction of your sum amounting to Three Million, One Hundred Thousand United States Dollars only.(USD$3.1Million ).If you wish to receive your fund this way,Kindly reconfirm your (1) Your Full Name (2) Address where the Card shall be sent to. (3) Your Phone Number (4)Your occupation,National Age and Sex Failure to adhere strictly to this directives as instructed by the Presidency and the Contract Review and Payment Committee will lead to summary seizure of all your funds in Nigeria as interpreted in section 89 article 201 of Central Bank of Nigeria and Ministry of Finance Act 1979. We shall be expecting to receive your information as you have to stop any further communication with any other officials except the Undersigned. Thanks for your co-operation. Best Regards, Mr.Isa Zailani Executive Director Afribank Nigeria Plc Call me +2347026115379 From kenilient@ifrance.com Thu Apr 9 19:20:05 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n3A2K4rD013408 for ; Thu, 9 Apr 2009 19:20:04 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******** X-Spam-Status: Yes, score=8.1 required=5.0 tests=BAYES_99,BL_COUNTRY_FR_2, FREEMAIL_FROM,HTML_MESSAGE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SPF_PASS,XHTML_01 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 XHTML_01 RAW: Has XML-ish tags in HTML body * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 81] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 81] Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Thu, 09 Apr 2009 19:20:04 -0700 (PDT) Received: from mailsender00.ifrance.com (mailsender00.ifrance.com [82.196.5.120]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3A2IL82009238 for ; Thu, 9 Apr 2009 19:18:25 -0700 Received: from localhost (localhost [127.0.0.1]) by mailsender00.ifrance.com (Postfix) with ESMTP id 46D90215487; Fri, 10 Apr 2009 03:42:45 +0200 (CEST) Received: from mailsender00.ifrance.com ([127.0.0.1]) by localhost (mailsender00.ifrance.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 23069-02-2; Fri, 10 Apr 2009 03:42:38 +0200 (CEST) Received: from ifrance00.ifrance.com (ifrance00-int.ifrance.com [10.0.5.20]) by mailsender00.ifrance.com (Postfix) with ESMTP id C575F2154D3; Fri, 10 Apr 2009 03:42:28 +0200 (CEST) Received: by ifrance00.ifrance.com (Postfix, from userid 81) id DF581CBF1C; Fri, 10 Apr 2009 01:58:41 +0200 (CEST) X-Mailer: iEUROP Webmail User-Agent: iEUROP Webmail X-IuserId: 6016002 X-IHash: 52d845c5e740ec1bf856d14c17514e9d X-OrignIP: 41.207.217.215 X-Priority: 3 (Normal) Importance: Normal Date: Fri, 10 Apr 2009 01:58:41 +0200 From: "williamsw19@gmail.com" Subject: [SPAM] traitement d'urgence MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="--------------a735a92630a748394e1337677e01d29f" Message-Id: <20090409235841.DF581CBF1C@ifrance00.ifrance.com> To: undisclosed-recipients:; X-Greylist: Delayed for 00:29:15 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 09 Apr 2009 19:18:25 -0700 (PDT) X-Spam-Prev-Subject: traitement d'urgence Status: R X-Status: X-Keywords: X-UID: 244 Content-Length: 4339 This is a multi-part message in MIME format. ----------------a735a92630a748394e1337677e01d29f Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Q2hlciwgCk5vdXMgdm91cyBzYWx1b25zIGF1IG5vbSBkdSBEaWV1IHRvdXQtcHVpc3NhbnQuIApN b24gbm9tIGVzdCBLZW5uZXRoIFdpbGxpYW1zIGV0IG1hIHNvZXVyIEp1bGlldCBlbiBwcm92ZW5h bmNlIGRlIGxhIFNpZXJyYSBMZW9uZS4gTm91cyB2b3VzIMOpY3JpcyBkZSBSw6lwdWJsaXF1ZSBk ZSBDw7R0ZSBkJ0l2b2lyZSwgb8O5IG5vdXMgYXZvbnMgcHJpcyByZWZ1Z2UgYXByw6hzIGxhIGd1 ZXJyZSBicnV0YWxlIGV0IGxlIG1ldXJ0cmUgZGUgbm9zIHBhcmVudHMgcGFyIGxlcyByZWJlbGxl cyBsb3JzIGRlIGxhIHJlcHJpc2UgZGVzIGNvbWJhdHMgZGFucyBub3RyZSBwYXlzLiAKRW4gcmFp c29uIGRlIGxhIGd1ZXJyZSwgbm90cmUgcmVncmV0dMOpIHDDqHJlIGEgdmVuZHUgc2EgY29tcGFn bmllIGRlIG5hdmlnYXRpb24gZXQgbm91cyBhIGVtbWVuw6lzIMOgIHVuIHBheXMgdm9pc2luIGxh IEPDtHRlIGQnSXZvaXJlLCBvw7kgaWwgYSBkw6lwb3PDqSAxOC4wMDAuMDAwLDAwIG1pbGxpb25z IGRlIFVTICQgZGFucyBzb24gY29tcHRlIGF1cHLDqHMgZCd1biDDqXRyYW5nZXIgZGUgbGEgYmFu cXVlIGljaSBlbiBDw7R0ZSBkJ0l2b2lyZS4gRW4gcmFpc29uIGRlIGxhIHNpdHVhdGlvbiBwb2xp dGlxdWUgYWN0dWVsbGUgZW4gQ8O0dGUgZCdJdm9pcmUsIG5vdXMgc29tbWVzIMOgIGxhIHJlY2hl cmNoZSBkZSB2b3RyZSBhaWRlIHBvdXIgdHJhbnNmw6lyZXIgY2V0IGFyZ2VudCBldCBhdXNzaSBk w6ltw6luYWdlciBkYW5zIHZvdHJlIHBheXMgYWZpbiBkJ2FwcHJvZm9uZGlyIG5vdHJlIMOpdHVk ZSBldCBub3VzIHNvbW1lcyBkaXNwb3PDqXMgw6Agdm91cyBvZmZyaXIgMTUlIGRlIGxhIHNvbW1l IHRvdGFsZSBwb3VyIHZvdHJlIGFpZGUsIG1haXMgbm91cyBwZW5zb25zIHF1ZSB2b3VzIG5lIHBv dXJyZXogcGFzIGZhaXJlIHBhcnRpZSBkZSBjZSBsJ2FyZ2VudCBsb3JzcXVlIGxhIGJhbnF1ZSBk J2ljaSBsZSB0cmFuc2ZlcnQgZGUgdm90cmUgY29tcHRlLCBub3VzIGF0dGVuZG9ucyB2b3MgcsOp cG9uc2VzLCBub3VzIGFsbG9ucyB2b3VzIGRvbm5lciBwbHVzIGQnaW5mb3JtYXRpb25zIHN1ciBs ZSB0cmFuc2ZlcnQuIApDb3JkaWFsZW1lbnQsIApLZW5uZXRoICYgSnVsaWV0IFdpbGxpYW1zLgoK aUZSQU5DRS5jb20gLSBFbWFpbCBHcmF0dWl0CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KaHR0cDovL3dlYi5p ZnJhbmNlLmNvbSAtIEVtYWlsIEdyYXR1aXQ= ----------------a735a92630a748394e1337677e01d29f Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGRpdiBkaXI9Imx0ciIgaWQ9InJlc3VsdF9ib3giPkNoZXIsIDxiciAvPk5vdXMgdm91cyBzYWx1 b25zIGF1IG5vbSBkdSBEaWV1IHRvdXQtcHVpc3NhbnQuIDxiciAvPk1vbiBub20gZXN0IEtlbm5l dGggV2lsbGlhbXMgZXQgbWEgc29ldXIgSnVsaWV0IGVuIHByb3ZlbmFuY2UgZGUgbGEgU2llcnJh IExlb25lLiBOb3VzIHZvdXMgJmVhY3V0ZTtjcmlzIGRlIFImZWFjdXRlO3B1YmxpcXVlIGRlIEMm b2NpcmM7dGUgZCdJdm9pcmUsIG8mdWdyYXZlOyBub3VzIGF2b25zIHByaXMgcmVmdWdlIGFwciZl Z3JhdmU7cyBsYSBndWVycmUgYnJ1dGFsZSBldCBsZSBtZXVydHJlIGRlIG5vcyBwYXJlbnRzIHBh ciBsZXMgcmViZWxsZXMgbG9ycyBkZSBsYSByZXByaXNlIGRlcyBjb21iYXRzIGRhbnMgbm90cmUg cGF5cy4gPGJyIC8+RW4gcmFpc29uIGRlIGxhIGd1ZXJyZSwgbm90cmUgcmVncmV0dCZlYWN1dGU7 IHAmZWdyYXZlO3JlIGEgdmVuZHUgc2EgY29tcGFnbmllIGRlIG5hdmlnYXRpb24gZXQgbm91cyBh IGVtbWVuJmVhY3V0ZTtzICZhZ3JhdmU7IHVuIHBheXMgdm9pc2luIGxhIEMmb2NpcmM7dGUgZCdJ dm9pcmUsIG8mdWdyYXZlOyBpbCBhIGQmZWFjdXRlO3BvcyZlYWN1dGU7IDE4LjAwMC4wMDAsMDAg bWlsbGlvbnMgZGUgVVMgJCBkYW5zIHNvbiBjb21wdGUgYXVwciZlZ3JhdmU7cyBkJ3VuICZlYWN1 dGU7dHJhbmdlciBkZSBsYSBiYW5xdWUgaWNpIGVuIEMmb2NpcmM7dGUgZCdJdm9pcmUuIEVuIHJh aXNvbiBkZSBsYSBzaXR1YXRpb24gcG9saXRpcXVlIGFjdHVlbGxlIGVuIEMmb2NpcmM7dGUgZCdJ dm9pcmUsIG5vdXMgc29tbWVzICZhZ3JhdmU7IGxhIHJlY2hlcmNoZSBkZSB2b3RyZSBhaWRlIHBv dXIgdHJhbnNmJmVhY3V0ZTtyZXIgY2V0IGFyZ2VudCBldCBhdXNzaSBkJmVhY3V0ZTttJmVhY3V0 ZTtuYWdlciBkYW5zIHZvdHJlIHBheXMgYWZpbiBkJ2FwcHJvZm9uZGlyIG5vdHJlICZlYWN1dGU7 dHVkZSBldCBub3VzIHNvbW1lcyBkaXNwb3MmZWFjdXRlO3MgJmFncmF2ZTsgdm91cyBvZmZyaXIg MTUlIGRlIGxhIHNvbW1lIHRvdGFsZSBwb3VyIHZvdHJlIGFpZGUsIG1haXMgbm91cyBwZW5zb25z IHF1ZSB2b3VzIG5lIHBvdXJyZXogcGFzIGZhaXJlIHBhcnRpZSBkZSBjZSBsJ2FyZ2VudCBsb3Jz cXVlIGxhIGJhbnF1ZSBkJ2ljaSBsZSB0cmFuc2ZlcnQgZGUgdm90cmUgY29tcHRlLCBub3VzIGF0 dGVuZG9ucyB2b3MgciZlYWN1dGU7cG9uc2VzLCBub3VzIGFsbG9ucyB2b3VzIGRvbm5lciBwbHVz IGQnaW5mb3JtYXRpb25zIHN1ciBsZSB0cmFuc2ZlcnQuIDxiciAvPkNvcmRpYWxlbWVudCwgPGJy IC8+S2VubmV0aCAmYW1wOyBKdWxpZXQgV2lsbGlhbXMuPC9kaXY+PGJyIC8+PGJyIC8+PGhyIHN0 eWxlPSJiYWNrZ3JvdW5kOiAjY2NjY2NjOyBtYXJnaW4tYm90dG9tOiAxMHB4OyB3aWR0aDogMTAw JTsgYm9yZGVyOiAjY2NjY2NjIiAvPjxhIGhyZWY9Imh0dHA6Ly93ZWIuaWZyYW5jZS5jb20iPmlG UkFOQ0UuY29tPC9hPiAtIEVtYWlsIEdyYXR1aXQ8YnIgLz48YnIgLz48aHIgc3R5bGU9J3dpZHRo OjEwMCU7IGJhY2tncm91bmQ6ICNDQ0NDQ0M7IGJvcmRlcjogI0NDQ0NDQzsgbWFyZ2luLWJvdHRv bTogMTBweCcvPjxhIGhyZWY9Imh0dHA6Ly93ZWIuaWZyYW5jZS5jb20iPmlGUkFOQ0UuY29tPC9h PiAtIEVtYWlsIEdyYXR1aXQ= ----------------a735a92630a748394e1337677e01d29f-- From smithwillia1@yahoo.cn Thu Apr 9 00:15:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.9 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_FR_2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_45,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_SUB_NEED_REPLY,STOX_30,STOX_58,SUBJ_ALL_CAPS,US_DOLLARS_3, YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9937] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.2 STOX_58 BODY: This company * 0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp27.orange.fr (smtp27.orange.fr [80.12.242.95]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n397FC68010477 for ; Thu, 9 Apr 2009 00:15:16 -0700 Received: from smtp27.orange.fr (mwinf2726 [10.232.12.126]) by mwinf2710.orange.fr (SMTP Server) with ESMTP id DE7841C010A2 for ; Thu, 9 Apr 2009 08:54:34 +0200 (CEST) Received: from User (mail.mairie-beaurains.fr [62.160.87.247]) by mwinf2726.orange.fr (SMTP Server) with ESMTP id 31BE21C000A2; Thu, 9 Apr 2009 08:53:52 +0200 (CEST) X-ME-UUID: 20090409065352203.31BE21C000A2@mwinf2726.orange.fr Reply-To: From: "FBI Director Robert S.Mueller" Subject: [SPAM] URGEN T RESPONSE NEEDED (805) Date: Thu, 9 Apr 2009 08:50:16 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090409065352.31BE21C000A2@mwinf2726.orange.fr> To: undisclosed-recipients:; X-Greylist: Delayed for 00:16:13 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 09 Apr 2009 00:15:16 -0700 (PDT) X-Spam-Prev-Subject: URGEN T RESPONSE NEEDED (805) Status: R X-Status: X-Keywords: X-UID: 245 Content-Length: 5134 Federal Bureau of Investigation (FBI) Anti-Terrorist And Monitory Crime Division. Federal Bureau Of Investigation. J.Edgar.Hoover Building Washington Dc Customers Service Hours--Monday To Saturday: Office Hours Monday To Saturday: Attn: Beneficiary, This is to Officially inform you that it has come to our notice and we have thoroughly Investigated with the help of our Intelligence Monitoring Network System that you are having an illegal Transaction with Impostors claiming to be Prof. Charles C. Soludo of the Central Bank Of Nigeria, Mr. Patrick Aziza, Mr Frank Nweke, none officials of Oceanic Bank, Zenith Banks, kelvin Young of HSBC, Ben of FedEx, Ibrahim Sule,Larry Christopher, Dr. Usman Shamsuddeen, Puppy Scammers are impostors claiming to be the Federal Bureau Of Investigation. During our Investigation, we noticed that the reason why you have not received your payment is because you have not fulfilled your Financial Obligation given to you in respect of your Contract/Inheritance Payment. The New American President Barrack Obama have made way to all americans who have not yet received their payment, In recent ages, The American experienced difficulties in receiving their funds because of the former presidents of USA, As you know quite well that Nigeria is a black country and the Past American presidents treats the blacks in the america like slaves, The White americans practice races against the blacks and the Nigerian Government is not happy about this and this is the main reason why your payment have been delayed with one excuse or the other, Your New President Barrack Obama had a meeting with the Nigerian President some weeks ago and for the fact, Barrack Obama is a black man and will stop races in America, All americans are eligible to receive their payment now without anymore headaches. This is a good news to you so act fast and receive your payment now without anymore delay. Please I have taken this measure, having observed and known what you have suffered in your pursuit so far to claim your funds with fake banks IN AFRICA ESPECIALLY NIGERIA(CENTRAL BANK OF NIGERIA/ FAKE SCURITY BANK)e.t.c and I have understood that it would take a long rough journey for you to receive this funds through ATM CARD Payment, this is while we have gone this extra mile in making sure that you receive immediately your deposit through this safe means where there will be no trail and error or stories. Since your deposit was called back to Africa and was converted into the Ecowas treasury after arresting all the people involved in scaming you both from NIGERIA, Benin Republic and UK Therefore, we have contacted the Federal Ministry Of Finance on your behalf and they have brought a solution to your problem by cordinating your payment in total USD$11,000.000.00 in an ATM CARD which you can use to withdraw money from any ATM MACHINE CENTER anywhere in the world with a maximum of $4000 to $5000 United States Dollars daily. You now have the lawful right to claim your fund in an ATM CARD. Since the Federal Bureau of Investigation is involved in this transaction, you have to be rest assured for this is 100% risk free it is our duty to protect the American Citizens. All I want you to do is to contact the ATM CARD CENTER via email for their requirements to proceed and procure your Approval Slip on your behalf which will cost you $320.00 only and note that your Approval Slip which contains details of the agent who will process your transaction. CONTACT INFORMATION NAME: MR. SMITH WILLIAMS EMAIL smithwilliams1001@yahoo.cn Do contact Mr. SMITH WILLIAMS of the ATM CARD CENTRE with your details: FULL NAME: HOME ADDRESS: TELL: CELL: CURRENT OCCUPATION: AGE: So your files would be updated after which he will send the payment informations which you'll use in making payment of $320.00 via Western Union Money Transfer or Money Gram Transfer for the procurement of your Approval Slip after which the delivery of your ATM CARD will be effected to your designated home address without any further delay. We order you get back to this office after you have contacted the ATM SWIFT CARD CENTER and we do await your response so we can move on with our Investigation and make sure your ATM SWIFT CARD gets to you. We assure you that your parcel will arrive your country within 2 days as soon as this company receive the payment of $320.00 by you and the tracking number of your parcel will be sent to you via e-mail immediately so that you can track it yourself to see whether we are competent in the discharge of our duties. Thanks and hope to read from you soon. ROBERT S. MUELLER, DIRECTOR FEDERAL BUREAU OF INVESTIGATION UNITED STATES DEPARTMENT OF JUSTICE WASHINGTON, D.C. 20535 Note: Do disregard any email you get from any impostors or offices claiming to be in possession of your ATM CARD, you are hereby advice only to be in contact with Mr. SMITH WILLIAMS of the ATM CARD CENTRE who is the rightful person to deal with in regards to your ATM CARD PAYMENT and forward any emails you get from impostors to this office so we could act upon and commence investigation. From anetabb@anetabb.concentrichost.com Thu Apr 9 19:26:00 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.5 required=5.0 tests=BAYES_99, DATE_IN_FUTURE_06_12,DEAR_WINNER,FREEMAIL_FORGED,FROM_SUBDOMAIN, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_62,KAM_LOTTO1,KAM_LOTTO2, LOTTO_AGENT,LOTTO_RANDOM,LOTTO_WIN_01,LOTTO_YOU_WON_02,MILLIONS_01, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RCVD_IN_DNSWL_LOW,STOX_51,SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 FROM_SUBDOMAIN From address is a third-level domain * 0.5 STOX_51 Line Noise message subject * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date * 0.5 LOTTO_RANDOM BODY: Random selection * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * -1.0 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low * trust * [207.155.252.70 listed in list.dnswl.org] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 96] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 96] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? Received: from thunderer.cnc.net (thunderer.cnc.net [207.155.252.70]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3A2PuPF009369 for ; Thu, 9 Apr 2009 19:26:00 -0700 Received: (ConcentricHost relay 1.2); with ESMTP id C87F744CB7; Thu, 9 Apr 2009 22:01:57 -0400 (EDT) Received: from [41.174.5.108] (unknown [41.174.5.108]) (Authenticated sender: anetabb@anetabb.concentrichost.com) by thunderer.cnc.net (ConcentricHost(2.70) Relay) with ESMTP id C87F744CB7 for ; Thu, 9 Apr 2009 22:01:48 -0400 (EDT) Content-Type: text/plain; charset="iso-8859-1" MIME-Version: 1.0 Content-Description: Mail message body Subject: [SPAM] WINA MANJE LOTTERY COMPANY CONGRATULATIONS!!!!!!!!! To: jhardin@impsec.org From: anetabb@anetabb.concentrichost.com Date: Fri, 10 Apr 2009 04:02:16 -0700 Reply-To: buckerhaynes@mighty.co.za Message-Id: <20090410020151.C87F744CB7@thunderer.cnc.net> X-Greylist: Delayed for 00:23:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 09 Apr 2009 19:26:00 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n3A2PuPF009369 X-Spam-Prev-Subject: WINA MANJE LOTTERY COMPANY CONGRATULATIONS!!!!!!!!! Status: R X-Status: X-Keywords: X-UID: 246 Content-Length: 1989 WINA MANJE LOTTERY COMPANY SA HEAD OFFICE SUITE 14-10, CENTURY TOWERS MELROSE ARCH JOBURG SOUTH AFRICA Dear Winner, My name is Mrs Sibusiso Kunene and on the behalf of WINA MANJE LOTTERY COMPANY OF SOUTH AFRICA,We wish to inform you that you are one of our lucky winners which were randomly selected from a batch of 50,000,000 international emails. Your email address emerged along side 9 others as 1st category winner in this year's Annual Lottery Draw. Consequently, you have therefore been approved for a total pay out of 850,000.00 US Dollars (Eight Hundred and Fifty Thousand US Dollars only).The following particulars are attached to your lottery payment order: (i) Winning numbers: 8-13-34-55-84-85.BONUS 22. (ii) Email ticket number: WN:754/22/76 (iii) Lottery code number: WN:09622SA Please contact the under listed claims officer as soon as possible for the immediate release of your winnings: MR BUCKER HAYNES CLAIMS AGENT SA HEAD OFFICE SUITE 14-10, CENTURY TOWERS MELROSE ARCH JOBURG SOUTH AFRICA EMAIL:buckerhaynes@mighty.co.za TEL:+27-78-8465-339 FAX:+27-86-5157-352 This email notification is auto-generated and it is valid for Eight weeks. Once again on behalf of all ourstaff, CONGRATULATIONS!!! Sincerely, Mrs Sibusiso Kunene The Free Lotto Awards is proudly sponsored by the Nashua Corporation,the Intel Group, Toshiba, Dell computers Lexmark and a conglomeration of other international IT companies. The free lotto internet draw is held once in a year and is so organized to encourage the use of the internet and computers worldwide. We are proud to say that over 200 Million Dollars are won annually in more than 150 countries worldwide. We also encourage you to visit various website online and take your chance to become part of our daily winners. Millions are won on a daily basis on one of the world's most famous lottery service. Become part of our daily winners. Millions are won on a daily basis on one of the world's most famous lottery service. From newsletter@lotto.galabingo.co.uk Thu Apr 9 20:32:44 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************ X-Spam-Status: Yes, score=36.7 required=5.0 tests=ADVANCE_FEE_2,BAYES_50, BL_COUNTRY_TW_1,BL_COUNTRY_TW_2,DEAR_WINNER,FILL_THIS_FORM_01, FILL_THIS_FORM_02,FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,KAM_LOTTO1,KAM_LOTTO2,LOTTERY_PH_004470,LOTTO_AGENT, LOTTO_FROM,LOTTO_MANY,LOTTO_RANDOM,LOTTO_WIN_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MSOE_MID_WRONG_CASE,RBL_POXLAY_01,RCVD_IN_BRBL, SARE_SUB_WINNING_NOT autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [163.27.242.1 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [163.27.242.1 listed in dnsbl.sorbs.net] * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [163.27.242.1 listed in tw.countries.nerd.dk] * 2.0 LOTTO_FROM Admits to being a lottery * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 0.5 LOTTO_RANDOM BODY: Random selection * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 1.0 FILL_THIS_FORM_02 BODY: Fill in your personal info * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5028] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.0 LOTTERY_PH_004470 LOTTERY_PH_004470 * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 0.7 SARE_SUB_WINNING_NOT Spammer subject - black market or scam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ms1.dlps.ylc.edu.tw (dns.dlps.ylc.edu.tw [163.27.242.1] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3A3WdiN011088 for ; Thu, 9 Apr 2009 20:32:43 -0700 Received: from localhost (ms1 [127.0.0.1]) by ms1.dlps.ylc.edu.tw (Postfix) with ESMTP id C9EC118C1D; Thu, 9 Apr 2009 23:13:54 +0800 (CST) Received: from ms1.dlps.ylc.edu.tw ([127.0.0.1]) by localhost (ms1.dlps.ylc.edu.tw [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 08647-09; Thu, 9 Apr 2009 23:13:54 +0800 (CST) Received: from User (unknown [213.184.172.226]) by ms1.dlps.ylc.edu.tw (Postfix) with ESMTP id DA64618BD4; Thu, 9 Apr 2009 23:13:28 +0800 (CST) Reply-To: From: "GALA BINGO E-MAIL LOTTERY PROMO" Subject: [SPAM] GALA BINGO E-MAIL LOTTERY WINNING NOTIFICATION (contact claim agent) Date: Thu, 9 Apr 2009 17:40:39 +0300 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090409151328.DA64618BD4@ms1.dlps.ylc.edu.tw> To: undisclosed-recipients: ; X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at dlps.ylc.edu.tw X-Greylist: Delayed for 02:02:29 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 09 Apr 2009 20:32:43 -0700 (PDT) X-Spam-Prev-Subject: GALA BINGO E-MAIL LOTTERY WINNING NOTIFICATION (contact claim agent) Status: R X-Status: X-Keywords: X-UID: 247 Content-Length: 3355 >From the Desk of the Head Co-ordinator FREE GALA BINGO E-MAIL LOTTERY PROMO http://lotto.galabingo.co.uk The Square Redford Nottingham shire DN22 6DB United Kingdom. Tel: 08715039878 International + (44)702-407-8997 Fax No: + (44)702-407-7692 Office Hours Monday To Saturdays: Ref: GACSL/988/05 Dear Esteem Winner, Over the years the prestigious GALA BINGO lottery has set out and successfully organized Sweepstakes on annual basis. We have equally maintained a standard unrivaled in the industry as it concerns the pay out of winnings to successful participants. In line with the commemorating event marking our 20th year anniversary we rolled out over 1,800.000.00(One million, Eight hundred thousands British Pounds) for our 20th year Anniversary Draws. Participants for the draws were randomly selected and drawn from a wide range of web hosts which enjoy our patronage. The selection was made through a computer draw system attaching personalized email addresses to ticket numbers. Your email address as indicated was drawn and attached to Ticket Number 2093961 with serial numbers GL193007 and drew the lucky numbers (12)-(52)-(19)-(22)-(30)-(17) with a bonus number (66) which subsequently won you 250,000.00 (Two hundred and Fifty thousand British Pounds) as one of the 4 jackpot winners in this draw. The draws registered as Draw number one was conducted in Nottingham shire, United Kingdom on Wednesday the 8th of April 2009 and credited to file Ref GACSL/6488292-2009/09. This lottery Draws is commemorative and as such special. Please be informed by this Winning Notification to make contact with your designated corresponding claim official who shall by duty guide you through the process to facilitate the release of your winnings. To file for your claim Please Contact your claims agent, Clearance Agent: Mr. Jeff Atkinson Email: jeffatkin-son@windowslive.com Email:jeffatkinson@statelotterypromo.com Tel: 702-409-6560 International + (44)702-409-6560 Fax No: + (44)702-407-7692 You are advised to contact your claims agent with the following details to avoid unnecessary delays and complications. Full Names:................................................ Contact/Mailing Address:................................. Direct Telephone Number/ Cell Phone Number:......................... Fax Numbers:...................... Nationality:.......................... Occupation:......................... Age / Sex:.......................... Ticket Number..................... Serial Number:..................... File Ref................................ Lucky Numbers as indicated in this winning Notification: ..................... Thank you for being part of our commemorative 20th Anniversary Draws. *** Due to possible mix up of some numbers and email contacts, we ask that you keep this award strictly from public notice until your claim has been processed and your money remitted. This is part of our security protocol to avoid double claiming or unscrupulous acts by some participants of this program. *** Congratulations once more from all members and staff of this world promotional lottery programs. Yours Sincerely, Jeff Atkinson. **Customer Support** NB: Any claim not made before (31) working days from the date of notification will indicate that the winner has voluntarily forfeited his/her winnings. From ahmed.atta@ehafconsulting.org Fri Apr 10 04:12:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.8 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_NG_2,DATE_IN_FUTURE_12_24,FILL_THIS_FORM_01, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_14,J_CHICKENPOX_47,J_CHICKENPOX_61,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01, RCVD_IN_BRBL,SUBJ_ALL_CAPS,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [208.43.120.115 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [208.43.120.115 listed in psbl.surriel.com] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.2 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_14 BODY: 1alpha-pock-4alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from server2.securevirtualpages.com (208.43.120.115-static.reverse.softlayer.com [208.43.120.115]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3ABC4eP023877 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 10 Apr 2009 04:12:09 -0700 Message-Id: <200904101112.n3ABC4eP023877@ga.impsec.org> Received: from [82.128.44.20] (helo=User) by server2.securevirtualpages.com with esmtpa (Exim 4.69) (envelope-from ) id 1LsCq8-0003Dk-3U; Fri, 10 Apr 2009 05:15:39 -0400 Reply-To: From: "AMANDA ROSE" Subject: [SPAM] GOOD DAY CALL AGENT BOBBY MARK +234-709-530-5769 Date: Fri, 10 Apr 2009 23:16:34 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server2.securevirtualpages.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ehafconsulting.org X-Source: X-Source-Args: X-Source-Dir: X-Greylist: Delayed for 01:53:35 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 10 Apr 2009 04:12:09 -0700 (PDT) X-Spam-Prev-Subject: GOOD DAY CALL AGENT BOBBY MARK +234-709-530-5769 Status: R X-Status: X-Keywords: X-UID: 248 Content-Length: 2142 Greetings To You My Dear Friend!!! How are you today? Hope all is well with you and your family? I hope this mail meets you in a perfect condition. I am happy to inform you about my success in getting your winning funds under the co-operation of a new partner from Asia . Presently I'm in ASIA CHINA for investment projects with my own share of the total sum. Meanwhile, I did not forget your past efforts and attempts to get your winnings despite that it failed some how. Now contact my secretary in ABUJA his name is Mr Bobby Mark below his contact information. COMPENSATION HEAD OFFICE CONTACT AGENT: Mr Bobby Mark EMAIL: bobbymark@live.com TEL: +234-709-530-5769 Ask him to send you the total sum of US$5,000,000.00 United S)tate Dollars certified bank Cheque, which I raised in your favor for your compensation for all the past efforts and attempt in this matter. I appreciated your efforts at that time very much. So fill free and get in touch with my secretary and give him your address where to send the draft to you. Please do let me know immediately you receive the Cheque to enable us share the joy after all the sufferness at that time. At the moment,I'm very busy here because of the investment projects,which the new partner and me are having at hand,finally, remember that I had forwarded instruction to the secretary on your behalf to Receive that money. So fill free to get in touch with him ( Mr Bobby Mark )without any delay. DO FILL THIS FORM FOR DISPACTHMENT OF YOUR FUNDS. 1) FULL NAME: ..................... 2) COUNTRY : ...................... 3) CONTACT NUMBER: ...................... 4) OCCUPATION: ........................... 5) HOME ADDRESS: ............................. 6) STATE/PROVINCE: .............................. 7) COMPANY NAME: ................................ 8) SEX/AGE: ............................................. 9) OFFICE NUMBER: .................................... 10) COMPANY ADDRESS: .......................... Thanks and God bless you and your family. Best regards, Yours faithfully, MRS AMANDA ROSE ASSISTANT CHAIRMAN, ? 2009/2010. From hngubane@yahoo.com Fri Apr 10 05:55:02 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.8 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,FORGED_YAHOO_RCVD,FREEMAIL_FROM,FREEMAIL_REPLYTO,MILLIONS_01, MILLION_USD,RBL_POXLAY_01,RBL_PSBL_01,SARE_HELO_EQ_DSL_3,SUBJ_ALL_CAPS, US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [209.52.200.3 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.247.96.113 listed in dnsbl.sorbs.net] * 1.0 SARE_HELO_EQ_DSL_3 SARE_HELO_EQ_DSL_3 * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.3 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from mail.sunshinecable.com (mail.sunshinecable.com [209.52.200.3]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3ACswuS026127 for ; Fri, 10 Apr 2009 05:55:02 -0700 Received: from localhost (localhost [127.0.0.1]) by mail.sunshinecable.com (Postfix) with ESMTP id 3129B760C83; Thu, 9 Apr 2009 06:08:25 -0700 (PDT) Received: from mail.sunshinecable.com ([127.0.0.1]) by localhost (mail [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 09478-09; Thu, 9 Apr 2009 06:08:24 -0700 (PDT) Received: by mail.sunshinecable.com (Postfix, from userid 81) id 44B75761BAF; Thu, 9 Apr 2009 00:56:10 -0700 (PDT) Received: from dsl-247-96-113.telkomadsl.co.za (dsl-247-96-113.telkomadsl.co.za [41.247.96.113]) by mail.sunshinecable.com (Horde MIME library) with HTTP; Thu, 09 Apr 2009 00:56:10 -0700 Message-ID: <20090409005610.js1q9acaw400oo0s@mail.sunshinecable.com> Date: Thu, 09 Apr 2009 00:56:10 -0700 From: "Dr. Harry Ngubane" Reply-to: harryhn@rocketmail.com To: undisclosed-recipients:; Subject: [SPAM] REQUEST FOR CONFIDENTIAL CO OPERATION MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.1.2) X-User-Account: gfchambe X-Virus-Scanned: amavisd-new at sunshinecable.com X-Greylist: Delayed for 14:25:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 10 Apr 2009 05:55:02 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n3ACswuS026127 X-Spam-Prev-Subject: REQUEST FOR CONFIDENTIAL CO OPERATION Status: R X-Status: X-Keywords: X-UID: 249 Content-Length: 1895 Date: 09 April 2009 Depts. Mineral and Energy Republic of South Africa. EMAIL Address: hngubane@gmail.com Mobile: +27 787 626 598 Fax: +27866333410 The President/Managing Director/CEO REQUEST FOR CONFIDENTIAL CO OPERATION Sir/Madam, I Write in your company, asking for your indulgence in re-profiling funds to the tune of Twelve Million Six Hundred and Fifty Thousand United States Dollars {US$12,650.000.00} which we want to transfer and keep safely for investment purpose under your able supervision. In other words, we would like you to receive the said funds on our behalf. This funds were derived from over invoice projects awarded to foreign contractors by my committee, and presently the actual contract cost have been paid to the original project executors, leaving the balance in the tune of the said amount which we have in principal obtained to remit overseas. This contract is in pursuit of an enabling environment for a successful hosting of the FIFA World Cup Finals in 2010.With me as the head of this committee saddled with the responsibility of reconciling contractual payments and the implementation of projects, the transfer will be legally processed and approved by the Ministry of Finance and Foreign Exchange Department as contractual payment due to you or your company successfully. We have agreed to negotiate a reasonable compensation for your participation and I propose 22.2% for you, while we also propose that we receive 46.6% and 31.2% will be embarked for purpose of taxation. Please contact me immediately on the telephone, email address or fax number above if this proposal is acceptable to you for further discussions with you. I wait in anticipation of your fullest cooperation. Yours Sincerely, Dr. Harry Ngubane ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. From info@harvey.co.uk Sat Apr 11 17:22:12 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.5 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,DEAR_FRIEND,FREEMAIL_FORGED,J_CHICKENPOX_75,MISSING_HEADERS, RCVD_IN_BRBL,SPAMMY_WEBMAIL,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [203.146.127.65 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from ns3.siamhostmart.com (ns3.siamhostmart.com [203.146.127.65]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3C0M3Vt018305 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 11 Apr 2009 17:22:11 -0700 Received: from www.iturnon.co.th (localhost.localdomain [127.0.0.1]) by ns3.siamhostmart.com (8.12.11/8.12.11) with ESMTP id n3B5d6LU010358; Sat, 11 Apr 2009 12:39:08 +0700 Received: from 41.220.75.3 (SquirrelMail authenticated user sale@iturnon.co.th) by www.iturnon.co.th with HTTP; Sat, 11 Apr 2009 06:39:40 +0100 (BST) Message-ID: <62087.41.220.75.3.1239428380.squirrel@www.iturnon.co.th> Date: Sat, 11 Apr 2009 06:39:40 +0100 (BST) Subject: [SPAM] business proposal From: "Harvey Domenic" Reply-To: harvey_domenic01@yahoo.com.hk User-Agent: SquirrelMail/1.4.4 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Greylist: Delayed for 17:46:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 11 Apr 2009 17:22:11 -0700 (PDT) X-Spam-Prev-Subject: business proposal Status: R X-Status: X-Keywords: X-UID: 250 Dear Friend I am Mr Harvey Domenic,Staff of Standard Life trust Bank Limited. I have a business proposal that has to do with the transfer of funds and I cannot state the exact amount and full details due to security reasons.But I must also state that it is not the type that gets one into trouble as it is extremely secure. It will be of immense benefit to the both of us. If you want to do business kindly reply me so I will give you precise details. Please ensure strict confidentiality on this mail as the nature of this transaction requires strict confidentiality. Contact me via e-mail: harvey_domenic01@yahoo.com.hk For more infomation. Yours Sincerely, Harvey Domenic From euromillottnl@gmail.com Sun Apr 12 21:55:17 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************************* X-Spam-Status: Yes, score=49.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, KAM_LOTTO1,KAM_LOTTO2,LOTTO_AGENT,LOTTO_FROM,LOTTO_MANY,LOTTO_WIN_02, LOTTO_YOU_WON_02,MISSING_HEADERS,MSOE_MID_WRONG_CASE,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_LOTTO_SPAM2,SPF_NEUTRAL, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS,UNCLAIMED_MONEY autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [61.4.63.11 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [61.4.63.11 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [61.4.63.11 listed in psbl.surriel.com] * 2.0 LOTTO_FROM Admits to being a lottery * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 3.1 UNCLAIMED_MONEY BODY: People just leave money laying around * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_02 BODY: * Winner * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.miramartravel.hk (mail.miramartravel.hk [61.4.63.11]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3D4tCki030035 for ; Sun, 12 Apr 2009 21:55:16 -0700 Received: from User [87.211.135.152] by mail.miramartravel.hk with ESMTP (SMTPD32-7.15) id A76271D011C; Sat, 11 Apr 2009 17:48:18 +0800 Reply-To: From: "Euro Millions Lottery" Subject: [SPAM] EURO MILLIONS LOTTERY WINNER !!!!! Date: Sat, 11 Apr 2009 11:48:40 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200904111748531.SM00307@User> X-Greylist: Delayed for 00:18:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 12 Apr 2009 21:55:17 -0700 (PDT) X-Spam-Prev-Subject: EURO MILLIONS LOTTERY WINNER !!!!! Status: R X-Status: X-Keywords: X-UID: 251 Content-Length: 2678 EURO MILLIONS LOTTERY INTERNATIONAL. www.euro-millions.com FROM: INTERNATIONAL PROMOTION/PRIZE AWARD DEPT. REFERENCE: 897/60/IPDHJK662091 BATCH: EU-983-741-2883992MG02 Sir/Madam, The EURO MILLIONS Promotion team is proud to inform you of the Euro Millions Lottery Online International E-mail programs held on the 31ST OF MARCH 2009.And result where release on the 10TH OF April 2009. Your E-mail address attached to ticket number 07 09 31 29 41 07 02 with serial main number 605-990-291-681 which consequently won in the 1ST category, you have therefore been approved for a lump sum pay out of 1.000.000.00 Euro. (One Million Euro). CONGRATULATIONS!!!!!!!!!!!!!!! Due to mix up of some numbers and names, we ask that you keep your winning information confidential until your claims has been processed and your money remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 100,000 company and 50,000,000 individual email addresses and names from all over the world. This lottery was promoted and sponsored by European Union Lottery Board in order to enhance and promote the use of Internet Explorer Users and Microsoft-wares around the globe. This promotional program takes place once in a week . We hope with part of your winning you will take part in our middle of year 28 million Euro International Jackpot. To file in for the processing and release of your money, you are advised to contact our accredited claims agent with the information stated below: *************************************************************************** *********** Name: Mr. John Raymer Tel/Fax: +31 84 755 2015 Email: claimsoffic@aol.nl *************************************************************************** ********** You are to furnish them with the following: 1.First Name: 2. Last Name: 3. Telephone: 4. Fax number: 5. Address: 6. Nationality:: 7. Reference Number: 8. Batch Number: NOTE: All winnings must be claimed not later than 15 days, thereafter unclaimed funds would be forfeited after a trio repeated forwarding of this message to you without your response. Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform us as soon as possible. Congratulations once more from our members of staff and thank you for being part of our promotional program. Sincerely yours, Mrs. Maria Van Plessis (Coordinator) Euro Millions International. From diwadgarang1@cantv.net Mon Apr 13 02:06:36 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********** X-Spam-Status: Yes, score=11.8 required=5.0 tests=BAYES_50,FORGED_MUA_OUTLOOK, J_CHICKENPOX_54,J_CHICKENPOX_63,J_CHICKENPOX_75,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,PHISH_05,SARE_FRAUD_X3, SARE_FRAUD_X4,SPF_SOFTFAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5445] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from vps1.brilliant.ltd.uk (vps1.brilliant.ltd.uk [85.233.166.150]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3D96VwS003886 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Mon, 13 Apr 2009 02:06:36 -0700 Message-Id: <200904130906.n3D96VwS003886@ga.impsec.org> Received: (qmail 23836 invoked from network); 12 Apr 2009 23:23:05 -0000 Received: from unknown (HELO User) (41.202.92.176) by vps1.brilliant.ltd.uk with SMTP; 12 Apr 2009 23:23:05 -0000 Reply-To: From: "Diwad Garang" Subject: [SPAM] From Diwad John Garang. Date: Sun, 12 Apr 2009 23:23:02 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 05:23:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 13 Apr 2009 02:06:36 -0700 (PDT) X-Spam-Prev-Subject: From Diwad John Garang. Status: R X-Status: X-Keywords: X-UID: 252 Content-Length: 2756 >From Diwad John Garang. Address: No 5B Bank RD South Khartoum Sudan Greetings, It is true that we do not know each other in person but please bear in mind that this mail and the classified information contained therein are very confidential. The source through which I got your contact gave me the confidence to reach you. I am Diwad John Garang the son of late John Garang who was untill his death the vice president of Sudan in Africa. In brief, my late father was a strong opposition for over 20yrs untill he was appointed the vice president on the 9th of July 2005 by the United Nations Peace Team as an avenue to quench the 20yrs civil war in Sudan.He died on the 31st of July 2005 following a helicopter crash alongside with 12 others just 22days after his appointment as the vice president. What led to the helicopter crash is still unclear but I know that my father was the target. Please what you are about to hear is TOP SECRET,For more informations in relation to what I am telling you I will want you to check this site: http://news.bbc.co.uk/1/hi/in_pictures/4737661.stm and since then, my mother has been under strict surveillance by the Sudan government. Please permit me to go into details. After the death of my father that culminated to a chaotic atmosphere that resulted to a one-week civil disturbances and ethnic violence in Sudan,Just as we were making arrangements to mark my father's annull remembrance this month end, I conducted a search in his secret underground vault right inside the family house which hasn't been accessed since his death, I made some interesting discoveries, Bank documents of ( 6.5Million Euro) deposited in a Swiss Bank, and a cash deposit of (5 Million Euro) deposited with a Prime bank in Abidjan,coted'ivoire. Not quit few months after the death of my father, the president of Sudan placed embargo on my late father's assets during his speach, Unfortunately the Swiss account has been shutdown, which made me to leave the country immediately with the bank papers to Abidjan, cote d'ivoire to seek refuge and to find a reliable person to assist claim the fund on behalf on my family , I will explain more when we talk on phone. My aim of contacting you is to assist me claim this fund from the BANK as a co-beneficiary of this (5 Million Euro) deposited with the Bank in Abidjan Cote d'Ivoire for the transfer of this money to your account ,which my family has intend to invest in a lucrative business out there and my mother is aware of this arrangement and have agreed to offer 20% of this fund for your assistance. If this offer is acceptable by you notify me immediately with your full contact details to enable me reach you for more discussions. Remain blessed . Diwad John Garang. From me@you.com Mon Apr 13 02:30:10 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.1 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_KR_1,BL_COUNTRY_KR_2,DEAR_FRIEND, DNS_FROM_RFC_BOGUSMX,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2, J_CHICKENPOX_71,L_SOME_STD_PROBS,MISSING_HEADERS,NA_DOLLARS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SPF_HELO_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.92.140.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.5 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 0.5 BL_COUNTRY_KR_1 RBL: Mail client in Korea * [210.92.140.22 listed in kr.countries.nerd.dk] * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ckdpharm.com (mail.ckdpharm.com [210.92.140.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3D9U5mv004566 for ; Mon, 13 Apr 2009 02:30:09 -0700 Received: from User ([77.220.7.205]) by ckdpharm.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 13 Apr 2009 18:08:00 +0900 Reply-To: From: "Gaga" Subject: [SPAM] Good Business Date: Mon, 13 Apr 2009 10:07:00 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 13 Apr 2009 09:08:01.0828 (UTC) FILETIME=[58E28640:01C9BC17] X-Greylist: Delayed for 00:22:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 13 Apr 2009 02:30:10 -0700 (PDT) X-Spam-Prev-Subject: Good Business Status: R X-Status: X-Keywords: X-UID: 253 Content-Length: 1963 From: John Gaga, Accra-Ghana. Dear Friend, First I must solicit your strictest confidence in this transaction and I pray that my decision to contact you will be given genuine approval considering the facts you and I just meet in the net, I wish to use this opportunity to introduce myself to you. I am John Gaga. from Sierra-Leone. I write you to know my desires to invest in your country; I am the first son of Jonathan P.Gaga, who was the former Minister of Mines and Industry. My father had a bullet wounds by the rebels on his way traveling to the Capital city Freetown along with my sister. My sister died on the spot while (U.N) Peace keeping force rescued my father, he later died after eleven months. Before his death he told me about the box containing $18.5 million U.S Dollars to look after my self and my Mother and shouldn?t go to Sierra-Leone for my safety. Why my father deposited the fund in the security company in Ghana is for safety of the fund. Presently, my mother and I are here in Accra Ghana West Africa to notify the security company for the claims of the FUND, and we are staying in the refugee camp. Therefore I want you to lecture me on how best we can invest this money in your country and as I told you I really wanted to buy a house when I come there. My father told me it is dangerous to invest this money in Africa to avoid suspicious, due to bad economy and political instability facing Africa countries that is why I want to invest in abroad. For your foreign assistance I and my mother have agreed to offer 15% of the total amount of the money. We have all the vital documents covering the deposit fund and the ownership which I can send to you on request. NOTE: I have never disclosed this to any person apart from you, so you have to keep this matter very confidential. Send me your Private phone and fax numbers for more information and a brief description of yourself for mutual relationship. Best Regards, Mr.John Gaga. From atmcard567009@aol.com Mon Apr 13 04:19:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.8 required=5.0 tests=ADVANCE_FEE_2,BAYES_60, BL_COUNTRY_NG_2,DEAR_SOMETHING,FILL_THIS_FORM_01,FREEMAIL_FROM, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,KAM_LOTTO1, LOTTERY_PH_004470,LOTTO_AGENT,LOTTO_MANY,LOTTO_WINNINGS,LOTTO_WIN_01, LOTTO_WIN_02,LOTTO_YOU_WON_02,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_FRAUD_X6,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 LOTTO_WIN_01 BODY: Winning * * 1.0 LOTTO_WIN_02 BODY: * Winner * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7023] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.0 LOTTERY_PH_004470 LOTTERY_PH_004470 * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.0 LOTTO_MANY LOTTO_MANY * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam Received: from omr-d33.mx.aol.com (omr-d33.mx.aol.com [205.188.249.131]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3DBJ80a007638 for ; Mon, 13 Apr 2009 04:19:11 -0700 Received: from imo-da04.mx.aol.com (imo-da04.mx.aol.com [205.188.169.202]) by omr-d33.mx.aol.com (8.14.1/8.14.1) with ESMTP id n3DBDUJu010796; Mon, 13 Apr 2009 07:13:30 -0400 Received: from atmcard567009@aol.com by imo-da04.mx.aol.com (mail_out_v40_r1.5.) id e.d56.23c196c9 (34991); Mon, 13 Apr 2009 07:13:27 -0400 (EDT) Received: from smtprly-da01.mx.aol.com (smtprly-da01.mx.aol.com [205.188.249.144]) by cia-db01.mx.aol.com (v123.3) with ESMTP id MAILCIADB014-5bab49e31e5330c; Mon, 13 Apr 2009 07:13:27 -0500 Received: from webmail-dd13 (webmail-dd13.webmail.aol.com [205.188.104.13]) by smtprly-da01.mx.aol.com (v123.3) with ESMTP id MAILSMTPRLYDA012-5bab49e31e5330c; Mon, 13 Apr 2009 07:13:24 -0400 X-MB-Message-Source: WebUI Content-Transfer-Encoding: 7bit Subject: [SPAM] The Lucky Winner Date: Mon, 13 Apr 2009 07:13:23 -0400 X-AOL-IP: 196.220.9.226 X-MB-Message-Type: User MIME-Version: 1.0 From: atmcard567009@aol.com Content-Type: text/plain; charset="us-ascii"; format=flowed X-Mailer: AOL Webmail 42402-STANDARD Received: from 196.220.9.226 by webmail-dd13.sysops.aol.com (205.188.104.13) with HTTP (WebMailUI); Mon, 13 Apr 2009 07:13:23 -0400 Message-Id: <8CB8A3FFEA0D5F1-B98-2E09@webmail-dd13.sysops.aol.com> To: undisclosed-recipients:; X-Spam-Prev-Subject: The Lucky Winner Status: R X-Status: X-Keywords: X-UID: 254 Content-Length: 3380 O2 TELECOMMUNICATIONS LONDON PLC. Ref: 475061725 Batch: 7056490902/18 Winning No: GB8701/LPRC Dear Sir/Madam The Lucky Winner We are delighted to inform you of your prize released on the 13th of APRIL. 2009 from the 02TELECOMMUNICATIONS..International Email Address Draw. Which is fully based on an electronic selection of winners using their Email Address.Your number was attached to ticket number; 47061725 07056490902, Serial number 7741137002 This batch draws the lucky numbers as follows 5-13-33-37-4 2bonus number 17, which consequently won the Email Address draw in the category B. You here by have been approved a lump sum pay of GBP550,000.00 pounds (FIVE HUNDRED AND FIFTY THOUSAND POUNDS) in cash credit file ref: ILP/HW 47509/08. From the total cash prize shared amongst Ten lucky winners in this category B. All participant were selected through a computer balloting system drawn from Nine hundred thousand Phone numbers arround the world, as part of our international promotions program which is conducted annually. This promotion was sponsored by a conglomerate of multinational companies as part of their social responsibility to her citizens in the communities where they have operational base. Further more your details (EMAIL ADDRESS) falls within our European representative office in UNITED KINGDOM, as indicated in your play coupon and your prize of GBP(550,000.00) will be released to you from this regional branch office. HOW TO CLAIM YOUR PRIZE: Simply contact our fiduciary agent, DR GREG EDWARD E-MAIL: royalscotland@live.co.uk TEL: +44-7031917686 --------- to file for your claim. Please quote your reference, batch and winning number which can be found on the top left corner of this notification as well as your full name, address and telephone number to help locate your file easily. For security reasons, we advice all winners to keep this information confidential from the public until your claim is processed and your prize released to you. This is part of our security protocol to avoid double claiming and unwarranted taking advantage of this programme by non-participant or unofficial personnel. Note, All winnings MUST be claimed by the 30t of APRIL, 2009; otherwise all funds will be returned as Unclaimed and eventually donated to charity organizations. Congratulations once again on your wining. PLEASE REPLY THIS EMAIL CONTACT YOUR CLAIMS AGENT AT royalscotland@live.co.uk WINNER APPLICATION FORM OF PAYMENT. THIS FORM WILL ENABLE US HAVE A COMPREHENSIVE INFORMATION ABOUT THE PRIZE WINNER. FILL IT AND RETURN BACK TO OUR CLAIM AGENT AT royalscotland@live.co.uk 1)FULL NAME....................................... 2)ADDRESS........................................ 3)DATE OF BIRTH ..................................... 4)SEX............................................ 5)NATIONALITY.................................... 6)OCCUPATION..................................... 7)TELEPHONE NUMBER......................................... 8)WINNER NUMBER............ ....................... 9)REF NUMBER.................................. 10) YOUR VALID BANK DETAILS WHERE TO TRANSFER YOUR PRIZE............................................... Best Regards Mr Bright Klingon (For coordinator) THANKS MANAGEMENT, 02-TELECOMMUNICATIONS Past winners round the world with full of excitment From nelsoncoleman2020a@yahoo.co.jp Mon Apr 13 09:33:54 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=21.3 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, SPF_SOFTFAIL,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [209.90.77.25 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from cp5.heritagewebdesign.com (cp5.heritagewebdesign.com [209.90.77.25]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3DGXl0w015509 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 13 Apr 2009 09:33:53 -0700 Message-Id: <200904131633.n3DGXl0w015509@ga.impsec.org> Received: from [82.128.47.168] (helo=User) by cp5.heritagewebdesign.com with esmtpa (Exim 4.69 (FreeBSD)) (envelope-from ) id 1LtBeC-0009D3-Ow; Sun, 12 Apr 2009 20:11:48 -0600 Reply-To: From: "Mr.Nelson Coleman" Subject: [SPAM] Thanks as I expect to hear from you. Date: Mon, 13 Apr 2009 03:11:27 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cp5.heritagewebdesign.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [26 6] / [26 6] X-AntiAbuse: Sender Address Domain - yahoo.co.jp X-Source: X-Source-Args: X-Source-Dir: X-Greylist: Delayed for 14:20:50 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 13 Apr 2009 09:33:53 -0700 (PDT) X-Spam-Prev-Subject: Thanks as I expect to hear from you. Status: R X-Status: X-Keywords: X-UID: 255 >From Mr.Nelson Coleman I need your services in a confidential matter regarding consignment(fund)outof a family beneficiary deposit. This requires a private arrangement. You will receive these funds under legal claims; all legal documents will be carefully worked out to ensure a risk free transfer. I am willing to pay a generous management fee as well as appreciation as soon as this transaction is completed. I have all the details. The funds in question are quite large. I will expect a straight answer from you. If you are willing to assist, indly furnish me with your personal information which must include your direct cell phone and fax number, your address and company name, then lets work out the modalities. Please get back to me through my private email:nelsoncoleman2020c@yahoo.co.jp Thanks as I expect to hear from you. Mr.Nelson Coleman From mrstbergroth@terra.com Mon Apr 13 15:12:54 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.7 required=5.0 tests=BAYES_60,BL_COUNTRY_RU_1, FB_WORD1_END_DOLLAR,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_3,MILLIONS_01,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_SBL, SARE_SUB_NEED_REPLY,SPF_FAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.207.0.232 listed in zen.spamhaus.org] * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=mrstbergroth%40terra.com&ip=85.236.7.98&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.0 FB_WORD1_END_DOLLAR BODY: Looks like a word ending with a $ * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7275] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.adventis.ru (mail.adventis.ru [85.236.7.98]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3DMCnHe024662 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 13 Apr 2009 15:12:54 -0700 Message-Id: <200904132212.n3DMCnHe024662@ga.impsec.org> Received: from Yugo ([41.207.0.232]) (authenticated user test@adventis.ru) by mail.adventis.ru; Tue, 14 Apr 2009 01:08:58 +0400 Reply-To: From: "Capt. Daniel Saffe" To: capt.danielsaffe@msn.com Subject: [SPAM] I Am Still Waiting For Your Reply. Date: Mon, 13 Apr 2009 22:11:20 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:22:53 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 13 Apr 2009 15:12:54 -0700 (PDT) X-Spam-Prev-Subject: I Am Still Waiting For Your Reply. Status: R X-Status: X-Keywords: X-UID: 256 With due respect, I am Capt. Daniel F. Saffe, an American soldier in peace keeping force in Iraq, I am serving in the military of the 1st Armoured Division in Iraq, as you know insurgents everyday and car bombs are attacking us. We managed to move funds belonging to Saddam Hussein's family in the tune of USD$ 45 Million Dollars in cash. We want to move this money to you, so that you may keep our share for us till when we will come over to meet you. You are to take 40% of the total 45 Million Dollars and keep 60% for me and my partners. Please No strings attached, we plan on using diplomatic courier and shipping the money out of Iraq in three large silver boxes using diplomatic immunity. The boxes can be shipped out in 48hrs,so If you are interested kindly send me an e-mail signifying your interest including your most confidential telephone numbers for quick communication, then we can send to you the shipment details and the fright number and labels. Respectfully, Capt. Daniel F. Saffe. From delivery@admin.org Mon Apr 13 15:28:59 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=32.0 required=5.0 tests=BAYES_99,DEAR_WINNER, JM_SOUGHT_3,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,KAM_LOTTO1,KAM_LOTTO2, LOTTO_AGENT,LOTTO_FROM,LOTTO_WIN_01,LOTTO_YOU_WON_02,MILLIONS_01, RBL_POXLAY_01,SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 LOTTO_FROM Admits to being a lottery * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 LOTTO_WIN_01 BODY: Winning * * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.94.183.227 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 4.0 JM_SOUGHT_3 Body contains frequently-spammed text patterns Received: from cm3.dnsmadeeasy.com (cm3.dnsmadeeasy.com [66.231.182.6]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3DMSrF8024902 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 13 Apr 2009 15:28:58 -0700 Received: (qmail 4885 invoked by uid 1008); 13 Apr 2009 22:28:35 -0000 Received: from 213-94-183-227-dynamic.b-ras1.lmk.limerick.eircom.net (213-94-183-227-dynamic.b-ras1.lmk.limerick.eircom.net [213.94.183.227]) by cm3.dnsmadeeasy.com (Horde Framework) with HTTP; Mon, 13 Apr 2009 22:28:32 +0000 Message-ID: <20090413222832.15712lwar9jh9twk@cm3.dnsmadeeasy.com> Date: Mon, 13 Apr 2009 22:28:32 +0000 From: "EUROPEAN LOTTERY DRAW" Reply-to: official09@live.ie To: undisclosed-recipients: ; Subject: [SPAM] OFFICIAL INFORMATION MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.2) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n3DMSrF8024902 X-Spam-Prev-Subject: OFFICIAL INFORMATION Status: R X-Status: X-Keywords: X-UID: 257 Content-Length: 2032 EUROPEAN LOTTO COMPANY 9th Floor 34 The Aldwych London WC2B 4DN, Dear Winner, My name is Mr.Ernest s. Haley, and on the behalf of EUROPEAN LOTTO COMPANY OF UNITED KINGDOM, I wish to announce you as one of the 10 lucky winners in the EUROPEAN LOTTO draw held on the 10th of April 2009. Your email address emerged alongside 9 others as a 2nd category winner in this year's Annual EUROPEAN LOTTO Draw. Consequently, you have therefore been approved for a total payout of ?870,000.00 UK Pounds (EIGHT HUNDRED & SEVENTY THOUSAND POUNDS STERLINGS).The following particulars are attached to your lotto payment order: (i) Winning numbers: 01-07-09-23-39. (ii) Email ticket number: NY/R145/09/13 (iii) Lotto code number: EL02247UK (iv) The file Ref number: EL/04/07-17-28-32/GB-UK Please contact the under listed claims officer as soon as possible for the immediate release of your winnings: MR WILLIAM MORRIS DEPARTMENT OF CLAIMS TEL: +44-752-965-2904 FAX: +44-203-031-1069 EMAIL: official09@live.ie This email notification is auto-generated and it is valid for four weeks. Once again on behalf of all our staff, CONGRATULATIONS!!! Regards, Mr.Ernest S. Haley. ONLINE CO-ORDINATOR. The EUROPEAN LOTTO COMPANY is proudly sponsored by the Microsoft Corporation, the Intel Group, Toshiba, Dell computers Mackintosh and a conglomeration of other international IT companies. The European LOTTO internet draw is held once in a year and is so organized to encourage the use of the internet and computers worldwide. We are proud to say that over ?257 Million pounds are won annually in more than 150 countries worldwide. We also encourage you to visit various website online and take your chance to become part of our daily winners. Millions are won on a daily basis on one of the world's most famous free lotto service. Become part of our daily winners. Have a nice day, Good Luck. ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. From mrstbergroth@terra.com Mon Apr 13 17:35:35 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.7 required=5.0 tests=BAYES_60,BL_COUNTRY_RU_1, FB_WORD1_END_DOLLAR,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_3,MILLIONS_01,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_SBL, SARE_SUB_NEED_REPLY,SPF_FAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=mrstbergroth%40terra.com&ip=85.236.7.98&receiver=ga.impsec.org] * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.0 FB_WORD1_END_DOLLAR BODY: Looks like a word ending with a $ * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7275] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.207.0.232 listed in zen.spamhaus.org] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.adventis.ru (mail.adventis.ru [85.236.7.98]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3E0ZTvF028267 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 13 Apr 2009 17:35:34 -0700 Message-Id: <200904140035.n3E0ZTvF028267@ga.impsec.org> Received: from Yugo ([41.207.0.232]) (authenticated user test@adventis.ru) by mail.adventis.ru; Tue, 14 Apr 2009 02:47:45 +0400 Reply-To: From: "Capt. Daniel Saffe" To: capt.danielsaffe@msn.com Subject: [SPAM] I Am Still Waiting For Your Reply. Date: Mon, 13 Apr 2009 23:50:07 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: I Am Still Waiting For Your Reply. Status: R X-Status: X-Keywords: X-UID: 258 With due respect, I am Capt. Daniel F. Saffe, an American soldier in peace keeping force in Iraq, I am serving in the military of the 1st Armoured Division in Iraq, as you know insurgents everyday and car bombs are attacking us. We managed to move funds belonging to Saddam Hussein's family in the tune of USD$ 45 Million Dollars in cash. We want to move this money to you, so that you may keep our share for us till when we will come over to meet you. You are to take 40% of the total 45 Million Dollars and keep 60% for me and my partners. Please No strings attached, we plan on using diplomatic courier and shipping the money out of Iraq in three large silver boxes using diplomatic immunity. The boxes can be shipped out in 48hrs,so If you are interested kindly send me an e-mail signifying your interest including your most confidential telephone numbers for quick communication, then we can send to you the shipment details and the fright number and labels. Respectfully, Capt. Daniel F. Saffe. From mr.colemanw@yahoo.com Mon Apr 13 19:01:57 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.8 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_AR_1,DATE_IN_PAST_03_06,DEAR_SOMETHING, FORGED_MUA_OUTLOOK,FORGED_YAHOO_RCVD,FREEMAIL_FROM,FREEMAIL_REPLYTO, J_CHICKENPOX_66,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9977] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [200.123.149.229 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [200.123.149.229 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_AR_1 Mail client in Argentina * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.0 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.3 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.6 J_CHICKENPOX_66 BODY: 6alpha-pock-6alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.agroespigar.com.ar (mail.agroespigar.com.ar [200.123.149.229]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3E21rZ7030218 for ; Mon, 13 Apr 2009 19:01:57 -0700 Received: from User (unknown [98.126.29.42]) by mail.agroespigar.com.ar (Postfix) with ESMTP id DA557E9C10; Mon, 13 Apr 2009 16:56:40 -0300 (ART) X-KWF-FilterProgress: * Reply-To: From: " Mr.W .Coleman" Subject: [SPAM] From Mr.Coleman- Date: Mon, 13 Apr 2009 16:00:10 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090413195649.DA557E9C10@mail.agroespigar.com.ar> To: undisclosed-recipients:; X-Greylist: Delayed for 02:06:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 13 Apr 2009 19:01:57 -0700 (PDT) X-Spam-Prev-Subject: From Mr.Coleman- Status: R X-Status: X-Keywords: X-UID: 259 >From Mr.Coleman, Dear Sir, I need your services in a confidential matter regarding consignment (fund) out of a family beneficiary deposit. This requires a private arrangement. You will receive these funds under legal claims; all legal documents will be carefully worked out to ensure a risk free transfer. 30% of the total sum would be your own potion at the end of this deal. I have all the details. The funds in question are quite large ($36.8M).I will expect a straight answer from you. If you are willing to assist,kindly furnish me with your personal information which must include your direct cell phone and fax number, your address and company name. Please get back to me through my private email: Thanks as I expect to hear from you. Mr.Williams Coleman From lucaszonge@yahoo.ca Tue Apr 14 17:39:42 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.7 required=5.0 tests=BAYES_99,FREEMAIL_FROM, FREEMAIL_REPLYTO,MILLIONS_01,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET, SARE_HELO_EQ_DSL_3,US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [209.52.200.3 listed in psbl.surriel.com] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [209.52.200.3 listed in dnsbl.sorbs.net] * 1.0 SARE_HELO_EQ_DSL_3 SARE_HELO_EQ_DSL_3 * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 55] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 55] * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from mail.sunshinecable.com (mail.sunshinecable.com [209.52.200.3]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3F0dZb4001525 for ; Tue, 14 Apr 2009 17:39:41 -0700 Received: from localhost (localhost [127.0.0.1]) by mail.sunshinecable.com (Postfix) with ESMTP id 88E5077E999; Tue, 14 Apr 2009 06:35:20 -0700 (PDT) Received: from mail.sunshinecable.com ([127.0.0.1]) by localhost (mail [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 24892-09; Tue, 14 Apr 2009 06:35:19 -0700 (PDT) Received: by mail.sunshinecable.com (Postfix, from userid 81) id 28AC7738DDD; Tue, 14 Apr 2009 06:34:13 -0700 (PDT) Received: from dsl-247-109-252.telkomadsl.co.za (dsl-247-109-252.telkomadsl.co.za [41.247.109.252]) by mail.sunshinecable.com (Horde MIME library) with HTTP; Tue, 14 Apr 2009 06:34:12 -0700 Message-ID: <20090414063412.9pqt7lgb3ksogowg@mail.sunshinecable.com> Date: Tue, 14 Apr 2009 06:34:12 -0700 From: lucaszonge Reply-to: l.zonge@yahoo.com To: undisclosed-recipients:; Subject: [SPAM] Group Finance Director MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline Content-Transfer-Encoding: 7bit User-Agent: Internet Messaging Program (IMP) H3 (4.1.2) X-User-Account: gfchambe X-Virus-Scanned: amavisd-new at sunshinecable.com X-Greylist: Delayed for 07:31:00 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 14 Apr 2009 17:39:41 -0700 (PDT) X-Spam-Prev-Subject: Group Finance Director Status: R X-Status: X-Keywords: X-UID: 260 -- DR.LUCAS ZONGE. Group Finance Director FIRST NATIONAL BANK SOUTH AFRICA Tel: +27-73-598-9758 I discovered a dormant account in my office, as Group finance director with FNB bank SOUTH AFRICA. It will be in my interest to transfer this fund worth $10,000,000 million dollars in an account offshore. If you can assist in getting the money transferred, contact me immediately. Remember this is absolutely confidential. Your contact phone numbers and name will be necessary for this effect. Regards and respect, DR.LUCAS ZONGE. ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. From francisfitzpatrick-0051@msn.com Thu Apr 16 14:10:07 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n3GLA78D022394 for ; Thu, 16 Apr 2009 14:10:07 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******* X-Spam-Status: Yes, score=7.9 required=5.0 tests=BAYES_50,BL_COUNTRY_NG_2, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE,LOTTO_YOU_WON_03,MISSING_HEADERS, RCVD_IN_BL_SPAMCOP_NET,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5994] Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Thu, 16 Apr 2009 14:10:07 -0700 (PDT) Received: from blu0-omc4-s24.blu0.hotmail.com (blu0-omc4-s24.blu0.hotmail.com [65.55.111.163]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3GL8KGu010006 for ; Thu, 16 Apr 2009 14:08:24 -0700 Received: from BLU114-W28 ([65.55.111.135]) by blu0-omc4-s24.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 16 Apr 2009 13:51:57 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_be155b1a-2bd6-4b88-a0cd-8f8872d6cfe2_" X-Originating-IP: [213.255.218.244] Reply-To: From: Francis Fitzpatrick Subject: [SPAM] Unclaimed Family Deposited Fund Date: Thu, 16 Apr 2009 20:51:57 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 16 Apr 2009 20:51:57.0802 (UTC) FILETIME=[2EB9F4A0:01C9BED5] X-Greylist: Delayed for 00:16:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 16 Apr 2009 14:08:24 -0700 (PDT) X-Spam-Prev-Subject: Unclaimed Family Deposited Fund Status: R X-Status: X-Keywords: X-UID: 261 Content-Length: 2133 --_be155b1a-2bd6-4b88-a0cd-8f8872d6cfe2_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Francis Fitzpatrick 11 New Square Lincoln's Inn London WC2A 3QB United Kingdom +44-7511102125 =20 Greetings once again from here. Sequel to your non response of our earlier letter to you on behalf of the Trustees and Executors to the Will of our Late Client=2C you were listed as a beneficiary to the sum of 4=2C800=2C000.00GBP. =20 You can receive this fund as you are qualified by your name identity. We request that you kindly forward to us your immediate response=2C to re-assure us that we are dealing with the right person. =20 Please do get back to us immediately so that we can commence with the process of working towards the release of the inheritance to you. you can reach me directly via Email Yours Faithfully=2C Francis Fitzpatrick (Esq.) --_be155b1a-2bd6-4b88-a0cd-8f8872d6cfe2_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Francis Fitzpatrick
11 New Square
Lincoln's Inn
London WC2A 3QBUnited Kingdom
+44-7511102125
 =3B
Greetings once again from here.
Sequel to your non response of our earlier letter to
you on behalf of th= e Trustees and Executors to the
Will of our Late Client=2C you were list= ed as a
beneficiary to the sum of 4=2C800=2C000.00GBP.
 =3B
Yo= u can receive this fund as you are qualified by your
name identity. We r= equest that you kindly forward to
us your immediate response=2C to re-as= sure us that we
are dealing with the right person.
 =3B
Please= do get back to us immediately so that we can
commence with the process = of working towards the
release of the inheritance to you. you can reach = me
directly via =3B Email

Yours Faithfully=2C
Francis Fitzpatrick (Esq.)

= --_be155b1a-2bd6-4b88-a0cd-8f8872d6cfe2_-- From jhardin@impsec.org Fri Apr 17 06:25:04 2009 -0700 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_CN_1,BL_COUNTRY_CN_2,BL_COUNTRY_NG_2, FORGED_HOTMAIL_RCVD2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,L_SOME_STD_PROBS, MILLIONS_01,MILLION_USD,MISSING_HEADERS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL,RDNS_NONE,SARE_FRAUD_X3, SPF_SOFTFAIL,SUBJ_ALL_CAPS,UPPERCASE_75_100 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [58.211.94.94 listed in b.barracudacentral.org] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [58.211.94.94 listed in cn.countries.nerd.dk] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.5 FORGED_HOTMAIL_RCVD2 hotmail.com 'From' address, but no 'Received:' * 1.3 MISSING_HEADERS Missing To: header * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 1.5 UPPERCASE_75_100 message body is 75-100% uppercase * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mailserver.jan-ann.com ([58.211.94.94]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n39C3rAb017741 for ; Thu, 9 Apr 2009 05:03:58 -0700 Received: from User ([82.128.26.45] RDNS failed) by mailserver.jan-ann.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 9 Apr 2009 19:30:23 +0800 Reply-To: From: "James Goodman Jr." Subject: [SPAM] HELLO CAN YOU RECEIVE A LARGE SUM OF MONEY FOR ME? Date: Thu, 9 Apr 2009 04:39:41 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 09 Apr 2009 11:30:30.0250 (UTC) FILETIME=[967D34A0:01C9B906] X-Spam-Prev-Subject: HELLO CAN YOU RECEIVE A LARGE SUM OF MONEY FOR ME? Status: R X-Status: X-Keywords: X-UID: 262 GREETINGS TO YOU, I KNOW THIS MAIL MAY REACH YOU BY SURPRISE SINCE WE NEVER HAD ANY FORMAL CORRESPONDANCE BUT YOU DON'T HAVE TO WORRY BECAUSE IT'S ALL FOR GOOD. I AM JAMES GOODMAN JR., A NIGERIAN AND I WORK WITH THE APEX BANK IN NIGERIA. A LARGE SUM OF MONEY WAS DEPOSITED BY ME IN A PRIVATE SECURITY COMPANY HERE IN NIGERIA. THE AMOUNT IS $10.5M USD (TEN MILLION FIVE HUNDRED THOUSAND UNITED STATE DOLLARS ONLY) I WANT TO KNOW IF YOU CAN RECEIVE THE FUND ON MY BEHALF AS THE BENEFICIARY.A COMPREHENSIVE INFORMATION WILL BE GIVEN TO YOU ON HOW I GOT THE LARGE SUM OF MONEY AND HOW IT WILL BE DELIVERED TO YOU THROUGH A DIPLOMATIC CURRIER SERVICE. PLEASE NOTE THAT YOU ARE NOT GOING TO SEND ANY MONEY TO ME FOR ANY REASON. I AM GOING TO TAKE CARE OF ALL EXPENSES OVER HERE IN MY COUNTRY BUT I WANT YOU TO INFORM ME IMMEDIATELY IF YOU WILL BE ABLE TO CLEAR THE CONSIGNMENT (TRUNK BOX) IN YOUR COUNTRY BEFORE THE FUND WILL BE DELIVERED TO ANY ADDRESS OF YOUR CHOICE. YOUR RESPONSE NEEDED. REGARDS, JAMES GOODMAN JR. From drpetersidea11@msn.com Fri Apr 17 13:45:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n3HKj2fl010931 for ; Fri, 17 Apr 2009 13:45:02 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********* X-Spam-Status: Yes, score=9.9 required=5.0 tests=BAYES_99,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_MESSAGE,HTML_STOOPID_05,HTML_STOOPID_06, HTML_VERY_STOOPID,MISSING_HEADERS,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 HTML_STOOPID_05 RAW: stupid HTML: FONT churn 1 * 0.5 HTML_STOOPID_06 RAW: stupid HTML: FONT churn 2 * 1.0 HTML_VERY_STOOPID Lots of stupid HTML Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Fri, 17 Apr 2009 13:45:02 -0700 (PDT) Received: from blu0-omc2-s23.blu0.hotmail.com (blu0-omc2-s23.blu0.hotmail.com [65.55.111.98]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3HKgCX0016986 for ; Fri, 17 Apr 2009 13:42:15 -0700 Received: from BLU127-W6 ([65.55.111.71]) by blu0-omc2-s23.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 17 Apr 2009 13:25:48 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_a31e42f3-4f2e-4384-bfc9-d766bc52f871_" X-Originating-IP: [203.55.231.100] Reply-To: From: "Dr.Peterside Adolph" Subject: [SPAM] Your Assistance Pls! Date: Fri, 17 Apr 2009 20:25:48 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 17 Apr 2009 20:25:48.0518 (UTC) FILETIME=[B1C5F860:01C9BF9A] X-Greylist: Delayed for 00:16:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 17 Apr 2009 13:42:15 -0700 (PDT) X-Spam-Prev-Subject: Your Assistance Pls! Status: R X-Status: X-Keywords: X-UID: 263 Content-Length: 8593 --_a31e42f3-4f2e-4384-bfc9-d766bc52f871_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable A.U.PETERSIDE & CO.(BARRISTERS AND SOLICITORS) Adolph Peterside Esq. 57 Woolwich Road=2C Charlton London=20 SE7 8LN=2C United Kingdom Tel: +44 703 190 4912. =20 17-04-2009. =20 =20 Greetings=2C =20 I am Adolph U. Peterside. I am reaching out to you as regards the handling = of an investment portfolio. =20 I am soliciting your assistance in repatriating the funds and property left= behind by my late client before it is confiscated by the government and de= clared unserviceable by the bank where the huge deposit is lodged.=20 =20 My Client died intestate and every attempt to trace any member of his famil= y has proved unsuccessful and abortive. =20 Do note that your identity or country of origin does not matter.=20 =20 I will give you more information upon your response. =20 You should respond by sending the following information: =20 1. YOUR FULL NAMES 2. TELE & FAX NUMBERS 3. COMPLETE ADDRESS 4. OCCUPATION AND YOUR AGE =20 I humbly look forward to your soonest response. =20 Yours Faithfully=2C Peterside A. U.= --_a31e42f3-4f2e-4384-bfc9-d766bc52f871_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

A.U.PETERSIDE &=3B C= O.(BARRISTERS AND SOLICITORS)=

Adolph Peterside Esq.

57 Woolwich Road=2C

Charlton London

SE7 8LN=2C

United Kingdom

Tel: +44 703 190 4912.<= o:p>

 =3B=

17-04-2009.<= /STRONG>

 =3B=

 =3B=

Greetings=2C=

 =3B=

I am Adolph U. Petersid= e. I am reaching out to you as regards the handling of an investment portfo= lio.

 =3B=

I am soliciting your as= sistance in repatriating the funds and property left behind by my late clie= nt before it is confiscated by the government and declared unserviceable by= the bank where the huge deposit is lodged.

 =3B=

My Client died intestat= e and every attempt to trace any member of his family has proved unsuccessf= ul and abortive.

 =3B=

Do note that your ident= ity or country of origin does not matter.

 =3B=

I will give you more in= formation upon your response.

 =3B=

You should respond by s= ending the following information:<= /P>

 =3B=

1. YOUR FULL NAMES=

2. TELE &=3B FAX NUM= BERS

3. COMPLETE ADDRESS

4. OCCUPATION AND YOUR = AGE

 =3B=

I humbly look forward t= o your soonest response.

 =3B=

Yours Faithfully=2C

Peterside A. U.

= = --_a31e42f3-4f2e-4384-bfc9-d766bc52f871_-- From gloriawamakomrs_ng@yahoo.co.jp Wed Apr 15 06:53:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.3 required=5.0 tests=BAYES_99,BL_COUNTRY_JP_1, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE,JM_SOUGHT_FRAUD_2, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, SARE_PROLOSTOCK_SYM3,SPF_PASS,SUBJ_ALL_CAPS,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.6 SARE_PROLOSTOCK_SYM3 BODY: Last week's hot stock scam * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from web4007.mail.ogk.yahoo.co.jp (web4007.mail.ogk.yahoo.co.jp [124.83.200.54]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n3FDrYtx022976 for ; Wed, 15 Apr 2009 06:53:38 -0700 Received: (qmail 69569 invoked by uid 60001); 15 Apr 2009 13:22:43 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=yj20050223; d=yahoo.co.jp; h=Message-ID:Received:X-RocketDSI:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=MVqYcddjDYeBEL/7NKH0iNr5Ek/q8b441bhbwyMcw/wERQsmzRaMoLu/1G4G8fbmL6o6oPov92dE83Ue8ZTXK9mSBFTUEzLOGVslhH+SC5Z4tvhM9qJkysh6TQNSbQ3T ; Message-ID: <20090415132243.69567.qmail@web4007.mail.ogk.yahoo.co.jp> Received: from [41.198.100.166] by web4007.mail.ogk.yahoo.co.jp via HTTP; Wed, 15 Apr 2009 22:22:43 JST X-RocketDSI: i=124.83.200.54;s=w Date: Wed, 15 Apr 2009 22:22:43 +0900 (JST) From: "I.M.F" Reply-To: int.monetaryfund@sify.com Subject: [SPAM] YOUR PAYMENT IS READY. $3.8M To: jhardin@impsec.org MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="0-777022467-1239801763=:68196" X-Greylist: Delayed for 00:30:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 15 Apr 2009 06:53:38 -0700 (PDT) X-Spam-Prev-Subject: YOUR PAYMENT IS READY. $3.8M Status: R X-Status: X-Keywords: X-UID: 264 Content-Length: 1404 --0-777022467-1239801763=:68196 Content-Type: text/plain; charset=iso-2022-jp $B?7$7$$%a!<%k%"%I%l%9$r$*CN$i$;$7$^$9?7$7$$%a!<%k%"%I%l%9!'(B gloriawamakomrs_ng@yahoo.co.jp Your name was short listed by NNPC in conjunction with IMF to pay you the sum of $3.8million as part payment aproved for contract/inheritance transfer.Contact : Mr.Gerald Igbo Foreign payment transfer unit. ECO BANK E-Mail:infoecobankcashier@yahoo.com Tel: 234-805-356-8678 - I.M.F --0-777022467-1239801763=:68196 Content-Type: text/html; charset=iso-2022-jp
$B?7$7$$%a!<%k%"%I%l%9$r$*CN$i$;$7$^$9(B
$B?7$7$$%a!<%k%"%I%l%9!'(B gloriawamakomrs_ng@yahoo.co.jp



Your name was short listed by NNPC in conjunction with IMF to pay you the sum of $3.8million as part payment aproved for contract/inheritance transfer.Contact : Mr.Gerald Igbo Foreign payment transfer unit. ECO BANK E-Mail:infoecobankcashier@yahoo.com Tel: 234-805-356-8678

- I.M.F
--0-777022467-1239801763=:68196-- From karim.karoui7@googlemail.com Wed Apr 15 07:21:10 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************** X-Spam-Status: Yes, score=38.7 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,DATE_IN_PAST_03_06,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,L_SOME_STD_PROBS,MILLIONS_01, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,NA_DOLLARS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_BRBL,RCVD_IN_SBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_FRAUD_X6,SARE_SUB_NEED_REPLY,SPF_NEUTRAL,URG_BIZ,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [200.74.218.204 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [83.229.48.149 listed in zen.spamhaus.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9972] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [83.229.48.149 listed in psbl.surriel.com] * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 0.0 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.wonderl.com (vesselland.com [200.74.218.204]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3FEL3CB024126 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO) for ; Wed, 15 Apr 2009 07:21:08 -0700 Message-Id: <200904151421.n3FEL3CB024126@ga.impsec.org> Received: from User ([83.229.48.149]) by mail.wonderl.com (Merak 6.1.0) with ASMTP id MWK37904; Wed, 15 Apr 2009 09:50:26 -0430 Reply-To: From: "Karim Karoui" To: karim.karoui7@googlemail.com Subject: [SPAM] Your Reply Needed Urgently.. Date: Wed, 15 Apr 2009 15:20:15 +0400 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 74:01:56 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 15 Apr 2009 07:21:10 -0700 (PDT) X-Spam-Prev-Subject: Your Reply Needed Urgently.. Status: R X-Status: X-Keywords: X-UID: 265 Content-Length: 2530 Greetings, This letter must come to you as a big surprise, but I believe it is only a day that people meet and become great friends and business partners. I am Mr.Karim Karoui, Chief Investment Officer with a reputable bank here in U. A. E. I write you this proposal in good faith, believing that I can trust you with the information I am about to reveal to you. I have an urgent and very confidential business proposition for you. On March 15, 2004, an Iraqi Foreign Oil consultant/contractor with the CHEVRON PETROLEUM CORPORATION, Mohammad Al Nasser made a fixed deposit with my bank in 2004 for 36 calendar months, valued at US$17,500,000.00 (Seventeen Million, Five Hundred Thousand US Dollars) the mature date for this deposit contract was this 14 of March 2007. Sadly he was among the death victims in the May 27 2006 Earthquake disaster in Jawa, Indonesia that killed over 5,000 people. He was in Indonesia on a business trip and that was how he met his end. My bank management is yet to know about his death, I knew about it because he was my friend and I am his account officer. Mohammad did not mention any Next of Kin/Heir when the account was opened. He told me that he was married with two children but he lost all his family member during Gulf war. Last week my Bank Management requested that i should give instructions on what to do about his funds as his account officer, if to renew the contract. I know this will happen and that is why I have been looking for a means to handle the situation, because if my Bank Directors happens to know that Mohammad is dead and do not have any Heir, they will take the funds for their personal use, so I don't want such to happen. That is why I am now seeking your co-operation to present you as Next of Kin to the account and my bank headquarters will release the account to you. There is no risk involved; the transaction will be executed under a legitimate arrangement that will protect you from any breach of law. It is better that we claim the money, than allowing the Bank Directors to take it, they are rich already. I am not a greedy person, so I am suggesting we share the funds equal, 50/50% to both parties, my share will assist me to start my own company which has been my dream. Let me know your mind on this and please do treat this information as TOP SECRET. We shall go over the details once I receive your urgent response. Have a nice day and God bless. Anticipating your communication. Regards, Karim Karoui. From abdul_abdel_110@msn.com Thu Apr 16 03:01:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.5 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,FREEMAIL_FROM,FREEMAIL_REPLYTO, HTML_MESSAGE,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_41, J_CHICKENPOX_71,LOTTO_YOU_WON_03,MISSING_HEADERS,PHISH_05,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SPF_PASS,TVD_PH_SUBJ_URGENT,URG_BIZ, US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.8 TVD_PH_SUBJ_URGENT TVD_PH_SUBJ_URGENT * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from blu0-omc1-s34.blu0.hotmail.com (blu0-omc1-s34.blu0.hotmail.com [65.55.116.45]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3GA15v4023494 for ; Thu, 16 Apr 2009 03:01:08 -0700 Received: from BLU114-W8 ([65.55.116.7]) by blu0-omc1-s34.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 16 Apr 2009 02:42:28 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_ccb47ca0-536f-45ae-94ea-66d2bd96e2d4_" X-Originating-IP: [41.203.239.37] Reply-To: From: abdul abdel Subject: [SPAM] urgent business proposal Date: Thu, 16 Apr 2009 09:42:28 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 16 Apr 2009 09:42:28.0490 (UTC) FILETIME=[A7F35EA0:01C9BE77] X-Greylist: Delayed for 00:18:35 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 16 Apr 2009 03:01:08 -0700 (PDT) X-Spam-Prev-Subject: urgent business proposal Status: R X-Status: X-Keywords: X-UID: 266 Content-Length: 7243 --_ccb47ca0-536f-45ae-94ea-66d2bd96e2d4_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable DUTHE DESK OF:MR.ABDUL ABDEL.=20 BANK OF AFRICA(B.O.A)=20 OUAGADOUGOU BURKINA-FASO=2C=20 WEST AFRICA.=20 =20 Dear Friend=2C=20 =20 (PRIVATE/CONFIDENTIAL).=20 =20 I am Mr.ABDUL ABDEL. the Director in charge of Auditing section Bank Of Afr= ica(.B.O.A)Ouagadougou Burkina-Faso in West Africa. Forgive my indignation = if this message comes to you as a surprise. AS IT MAY INTEREST YOU TO KNOW= =2C I GOT YOUR IMPRESSIVE INFORMATION THROUGH THE INTERNET SEARCH HERE IN O= UAGADOUGOU BURKINA-FASO. I have decided to contact you on a project that wi= ll be very beneficial to both of us. During our auditing in this Bank=2CI c= ame across some amount of money belonging to a deceased foreigner Mr.Sheu Y= uan-dong who died with his wife and their only daughter on February 16=2C19= 98 in a plane crash.=20 =20 The fund has been dormant in his account with this Bank without any claim o= f the fund in our custody from his relation before my discovery to this dev= elopment. He was the Governor of Taiwan Central(Reserve)Bank. The said amou= nt is U.S $14=2C000=2C000(FOURTEEN MILLION UNITED STATE OF AMERICA DOLLAR).= I want you to know that I never master minded the death of the deceased fe= llow. Their death occured Naturally. Please View this website:=20 =20 http://www.cnn.com/WORLD/9802/16/taiwan.crash.update2/=20 FOR YOUR INFORMATION BEEN YOU NOT A TAIWANESE WILL NOT POSE ANY PROBLEM FOR= THE SUCESSFUL TRANSFER ON THIS FUND INTO YOUR ACCOUNT. All the whole arran= gement to put claim over this fund as the Bonafide next of kin to the decea= sed has been put in place and directives will be relayed to you as soon as = you indicate your interest and willingness to assist me and also benefit yo= ur self to this great business opportunity. In this country as a civil serv= ant(A Banker)=2Cwe are not allowed to operate a foreign account. This is th= e actual reason why it will require a second party or fellow who will forwa= rd claims as the next of kin to the Bank and also present a foreign account= where he will need the money to be re-transferred into on his request.=20 =20 Our Banking law stipulates that if such money remained unclaimed after Ten = years=2C the money will be transferred into the Bank treasury as unclaimed = fund.The request of foreigner as next of kin in this business is occasioned= by the fact that the customer was a foreigner and a Burkinabe cannot stand= as next of kin. I dont want this money to go into the Bank treasury as unc= laimed Bill. Be assured this transaction is 100% risk free.=20 =20 On conclusion of this Project=2C you will be entitled to 40% of the total s= um as gratification=2Cwhile 60% will be for me.Please you have been adviced= to keep "top secret" as I am still in service and intend to retire from se= rvice after I conclude this deal with you. I will fly down to your country = for subsequent sharing of the fund according to percentages previously indi= cated and further investment will be discussed. On your acceptance to be my= partner=2C please email for a brief discussion before we proceed. Please k= eep this proposal secret=2C even if you dont want to assist me. I look forw= ard to receive your urgent reply.=20 =20 Yours faithfully=2C=20 Mr.ABDUL ABDEL --_ccb47ca0-536f-45ae-94ea-66d2bd96e2d4_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
DUTHE DESK OF:MR.ABDUL ABDEL.
BANK OF AFRICA(B.O.A)
OUAGADOUGO= U BURKINA-FASO=2C
WEST AFRICA.
 =3B
Dear Friend=2C
 = =3B
(PRIVATE/CONFIDENTIAL).
 =3B
I am Mr.ABDUL ABDEL. the Dir= ector in charge of Auditing section Bank Of Africa(.B.O.A)Ouagadougou Burki= na-Faso in West Africa. Forgive my indignation if this message comes to you= as a surprise. AS IT MAY INTEREST YOU TO KNOW=2C I GOT YOUR IMPRESSIVE INF= ORMATION THROUGH THE INTERNET SEARCH HERE IN OUAGADOUGOU BURKINA-FASO. I ha= ve decided to contact you on a project that will be very beneficial to both= of us. During our auditing in this Bank=2CI came across some amount of mon= ey belonging to a deceased foreigner Mr.Sheu Yuan-dong who died with his wi= fe and their only daughter on February 16=2C1998 in a plane crash.
&nbs= p=3B
The fund has been dormant in his account with this Bank without any= claim of the fund in our custody from his relation before my discovery to = this development. He was the Governor of Taiwan Central(Reserve)Bank. The s= aid amount is U.S $14=2C000=2C000(FOURTEEN MILLION UNITED STATE OF AMERICA = DOLLAR). I want you to know that I never master minded the death of the dec= eased fellow. Their death occured Naturally. Please View this website:
=  =3B
http://www.cnn.com= /WORLD/9802/16/taiwan.crash.update2/
FOR YOUR INFORMATION BE= EN YOU NOT A TAIWANESE WILL NOT POSE ANY PROBLEM FOR THE SUCESSFUL TRANSFER= ON THIS FUND INTO YOUR ACCOUNT. All the whole arrangement to put claim ove= r this fund as the Bonafide next of kin to the deceased has been put in pla= ce and directives will be relayed to you as soon as you indicate your inter= est and willingness to assist me and also benefit your self to this great b= usiness opportunity. In this country as a civil servant(A Banker)=2Cwe are = not allowed to operate a foreign account. This is the actual reason why it = will require a second party or fellow who will forward claims as the next o= f kin to the Bank and also present a foreign account where he will need the= money to be re-transferred into on his request.
 =3B
Our Bankin= g law stipulates that if such money remained unclaimed after Ten years=2C t= he money will be transferred into the Bank treasury as unclaimed fund.The r= equest of foreigner as next of kin in this business is occasioned by the fa= ct that the customer was a foreigner and a Burkinabe cannot stand as next o= f kin. I dont want this money to go into the Bank treasury as unclaimed Bil= l. Be assured this transaction is 100% risk free.
 =3B
On conclu= sion of this Project=2C you will be entitled to 40% of the total sum as gra= tification=2Cwhile 60% will be for me.Please you have been adviced to keep = "top secret" as I am still in service and intend to retire from service aft= er I conclude this deal with you. I will fly down to your country for subse= quent sharing of the fund according to percentages previously indicated and= further investment will be discussed. On your acceptance to be my partner= =2C please email for a brief discussion before we proceed. Please keep this= proposal secret=2C even if you dont want to assist me. I look forward to r= eceive your urgent reply.
 =3B
Yours faithfully=2C
Mr.ABDUL = ABDEL

= --_ccb47ca0-536f-45ae-94ea-66d2bd96e2d4_-- From tunde_lemo@cbn.org Thu Apr 16 10:11:40 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************* X-Spam-Status: Yes, score=37.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_80,FAKE_REPLY_C,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, J_CHICKENPOX_53,MISSING_HEADERS,MSOE_MID_WRONG_CASE,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_PROLOSTOCK_SYM3,STOX_30, SUBJ_ALL_CAPS,TVD_PH_SUBJ_ACCOUNTS_POST,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [205.208.207.120 listed in b.barracudacentral.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 3.0 TVD_PH_SUBJ_ACCOUNTS_POST TVD_PH_SUBJ_ACCOUNTS_POST * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.2 PHISH_05 BODY: Phishing for account information * 1.6 SARE_PROLOSTOCK_SYM3 BODY: Last week's hot stock scam * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [62.60.136.28 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [62.60.136.28 listed in zen.spamhaus.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [205.208.207.120 listed in psbl.surriel.com] * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8760] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 FAKE_REPLY_C FAKE_REPLY_C * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.ohiohills.net (mail.ohiohills.net [205.208.207.120]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3GHBYUh003849 for ; Thu, 16 Apr 2009 10:11:39 -0700 Received: from User [62.60.136.28] by mail.ohiohills.net with ESMTP (SMTPD-8.22) id A7770BC8; Thu, 16 Apr 2009 10:06:15 -0600 Reply-To: From: "Prof.Tunde Lemo" Subject: [SPAM] RE:BENEFICIARY PAYMENT AND CONFIRMATION OF ACCOUNT PARTICULARS. Date: Thu, 16 Apr 2009 09:07:22 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200904161007846.SM01544@User> X-Greylist: Delayed for 00:15:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 16 Apr 2009 10:11:39 -0700 (PDT) X-Spam-Prev-Subject: RE:BENEFICIARY PAYMENT AND CONFIRMATION OF ACCOUNT PARTICULARS. Status: R X-Status: X-Keywords: X-UID: 267 Content-Length: 4558 >From the Desk of: Tunde Lemo. Central Bank of Nigeria (CBN) Federal Ministry of Finance (FMF). Date: 16th April, 2009. Attention: Beneficiary, RE:BENEFICIARY PAYMENT AND CONFIRMATION OF ACCOUNT PARTICULARS. Following the series of petition from score of foreign contractors over non-payment of overdue contracts, we are directed to carry out a thorough examination of various issues raised in the petitions with a view of effecting payment immediately. To show it's seriousness on the issue,the Federal Government has set aside US$7 Billion, mainly for categorized Beneficiaries. Going through the records, it was discovered that some other cases, payments indeed were fake as there was no trace of any contract executed anywhere in Nigeria, while in some other cases, payments were made to wrong beneficiaries. However, we discovered from all the documents sent to us that your over-due contract fund US$28 Million is one of the few and real and overdue payments, though with some irregularities that demand immediate clarification from you. Please verify the following questions: Was it by the alleged transaction or agreement between you and to one Mr. Weakly that your overdue payment should be directed to these designated bank account Co-ordinates? Please you have to reconfirm your account as the account details state as stated below so that payment will not be paid into wrong account as stated below: Beneficiary Name: Mr. Matthew Carol Weakly Bank Account Number #: 6987259303 Rounting Number #: 121000248 Bank Name: Wells Fargo Bank 18488 Blanco Rd. San Antonio TX 78258 However, if the above mentioned statements are false, and you did not ask anybody to change your account particulars for the transfer of your over-due Contract payment so that the APEX Bank of Nigeria will not pay into wrong account instead of your personal account. Kindly send to us without delay your correct account details with your banking details and also furnish to us your private phone and fax number for easy and effective communication. However, Sequel to the memorandum of understanding signed between the APEX Bank of Nigeria and the Federal Government of Nigeria, we in our capacity as a professional team of APEX Bank (AB) have been mandated and empowered by the Nigeria Government to solely handle all local and foreign contractual payment and other external debt servicing exercise, this mandate is due to expire in sixty working days. Hence Government of Nigeria have called back all funds in there offshore payment centers in Europe and America, all payment must be made from Nigeria through the Central Bank of Nigeria. Secondly, there were counter claims over your fund prominent among the discrepancies discovered is an application/Sworn declaration deposed for a change of account number, purporting that you are terminally sick and wish that your fund be transferred to account name Mr.Matthew Weakly of the United States and Designated Bank Account No #: 6987259303, you are therefore required as a matter of urgency to confirm to us as follows: 1. That the applications for the change of Accounts/Beneficiary was done at your instance, if not, furnish us with your Bank details so that we will not make payment to wrong person. 2. That your fund should be transferred to the above stated account, If not, kindly reconfirm your banking co-ordinates to enable us correspond it with the facts and figures in our central computer and as well authenticate your claim as the bonafide beneficiary to this fund. We advice you not to jeopardize your chance of receiving your fund by not communicating by any other office outside Central Bank of Nigeria (CBN) as we are single handedly spearheading all contractual payment and our strong suspicion is that some unscrupulous officials of Central Bank of Nigeria (CBN) Federal Ministry of Finance (FMF) Office of the Presidency, Senate Committee and your so called local representative must have a hand in this arrangement of diverting your fund because several allegation of extortion, delay and misappropriation of contract funds payment have been leveled against them which consequently compelled most of them from handling contractual payments. Kindly furnish me with your private phone and fax in your return mail for easy and effective communication. Be guide accordingly as we expect your urgent response. Revert to us as a matter of urgency. Prof. Tunde Lemo Central Bank of Nigeria (CBN) cc: Federal Ministry of Finance (FMF). cc: NNPC. From dr.davidpewi5@hotmail.com Thu Apr 16 15:52:17 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_95,FORGED_HOTMAIL_RCVD2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MILLIONS_01,MISSING_HEADERS, MSOE_MID_WRONG_CASE,NA_DOLLARS,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3,SARE_FRAUD_X4, SARE_FRAUD_X5,SARE_FRAUD_X6,SARE_SUB_NEED_REPLY,SPF_SOFTFAIL,STOX_30, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.5 FORGED_HOTMAIL_RCVD2 hotmail.com 'From' address, but no 'Received:' * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9883] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from dfallbackip3.mail.eu.uu.net (dhuumrelay3.dtm.ops.eu.uu.net [194.139.33.96]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3GMqCCH012942 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 16 Apr 2009 15:52:16 -0700 Received: from dhuumrelay3.dtm.ops.eu.uu.net (dfallbackip3.mail.eu.uu.net [195.129.12.194]) by dfallbackip3.mail.eu.uu.net (8.14.1/8.14.1) with ESMTP id n3C09593007593 for ; Sun, 12 Apr 2009 00:09:09 GMT Received: from User ([41.29.241.24]) (authenticated bits=0) by dhuumrelay3.dtm.ops.eu.uu.net (8.14.1/8.14.1) with ESMTP id n3C03m7I020304; Sun, 12 Apr 2009 00:04:04 GMT Message-Id: <200904120004.n3C03m7I020304@dhuumrelay3.dtm.ops.eu.uu.net> X-Authenticated-As: stausi@cityweb.de at dhuumrelay3.dtm.ops.eu.uu.net Reply-To: From: "Dr. David Chabalala Pewi" Subject: [SPAM] YOUR URGENT REPLY IS NEEDED Date: Sat, 11 Apr 2009 17:04:44 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 118:43:11 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 16 Apr 2009 15:52:17 -0700 (PDT) X-Spam-Prev-Subject: YOUR URGENT REPLY IS NEEDED Status: R X-Status: X-Keywords: X-UID: 268 Content-Length: 3437 FROM THE DESK OF DR. DAVID C PEWI DIRECTOR: ACCOUNT/AUDIT PHONE: +27-83-531-2768 E-MAIL: dr.davidpewi20@hotmail.com (TO WHOM IT MAY CONCERN) I Dr. David Chabalala Pewi, on behalf of my other colleagues from different organs of Republic of South Africa (RSA) owned prostates decided to solicit your assistance as regards transfer of the above-mentioned amount into your bank account. This fund accrued from over invoicing of various contract awarded in my parasitical to certain Foreign Contractors sometimes ago. We, as the Federal Government to Scrutinize mandated holders of sensitive position in our various prostates, all payments made to certain foreign Contractors and we discovered that some of the contracts they executed were grossly over-invoiced either by omission or commission. In the process the sum of US$20M (twenty Million US Dollars only) was found lying in the parasitical suspense account after the foreign contractors had been paid their rightful dues for executing the said contracts. We all agreed that this over-invoiced amount be transferred (for our own use) into a bank account provided by a foreign partner, because we are government workers and the Code of Conduct does not allow us to operate foreign accounts. However, we have succeeded in transferring some of this money precisely US$5.0M (Five Million US Dollars only) into a foreign account in MOROCCO (North Africa), but the provider of the account in MOROCCO is up to some mischief and refuses to comply to the earlier mutual agreement by insisting that the total amount be paid into his nominated bank account before disbursement will take effect. If for a meager sum of US$5.0M (Five Million US Dollars only) we are not compensated, is it when the balance of US$15M (Fifteen Million US Dollars) is transferred that, we will be sure of our full compensation? Of course, this abuse of trust and inhumanity calls for sobers reflection and search for absolute trust. Thus we are seeking your unwavering assistance that the remaining amount of US$15M can be speedily processed and fully remitted into your nominated bank account. On successful remittance of the fund into your account, you will be compensated with 30% of the amount for your assistance and services. So far, much have been said and due to our sensitive positions, we cannot afford a slip in this transaction neither can we give out identity as regards our respective offices, but whereby cordial relationship is established, smooth operations commences, you will be furnished with details of all you deserves to know. I am at your disposition to entertain any question from you with respect to this transaction, so contact me immediately through my email for further information on the requirements and procedure for this transaction. In your reply please endeavor to send me the following information's. (1) Your Full Name and your address (2) Your telephone/fax numbers (3) Your Nationality (4) Your Age (5) Your occupation This will enable me apply for the release of the fund to your nominated account. Please, treat with the strictest confidentiality and utmost urgency and get back to me through this my private Phone: +27-83-531-2768 or Private email: (dr.davidpewi20@hotmail.com) for safety and confidentiality of this transfer? Yours faithfully, Dr. David Chabalala Pewi DIRECTOR: ACCOUNT/AUDIT From kwanpark222@yahoo.co.jp Fri Apr 17 20:38:40 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.1 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, BL_COUNTRY_TW_1,BL_COUNTRY_TW_2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL,RDNS_DYNAMIC,SPF_SOFTFAIL, YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [59.124.226.140 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9998] * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [59.124.226.140 listed in tw.countries.nerd.dk] * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.unicorn-chemical.com (59-124-226-140.HINET-IP.hinet.net [59.124.226.140]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3I3caIn028286 for ; Fri, 17 Apr 2009 20:38:40 -0700 Received: by mail.unicorn-chemical.com (Postfix, from userid 104) id DFDFB26D5BC; Sat, 18 Apr 2009 04:33:31 +0800 (GMT-8) Received: from User (unknown [82.128.70.220]) by mail.unicorn-chemical.com (Postfix) with ESMTP id 4EEFF26D579; Sat, 18 Apr 2009 04:32:53 +0800 (GMT-8) Reply-To: From: "Mr. Park Kwang." Subject: [SPAM] Read And Get Back To Me Date: Fri, 17 Apr 2009 20:13:59 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090417203253.4EEFF26D579@mail.unicorn-chemical.com> To: undisclosed-recipients: ; X-Greylist: Delayed for 00:23:29 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 17 Apr 2009 20:38:40 -0700 (PDT) X-Spam-Prev-Subject: Read And Get Back To Me Status: R X-Status: X-Keywords: X-UID: 269 Dear Prospective Partner, I am sending you this email through the internet with reservations, basically because you may perceive my intentions wrongly. The issue I want to unravel to you is a very classified and sensitive one, it may be very difficult for you to comprehend, but it certainly the truth. It involves huge sum of Fund that I want you to receive on my behalf, On your response via my email address (kparkg@gmail.com) I will send you the details and more information about myself and the funds. Yours Sincerely, Mr. Park Kwang. (South Korea) From bancoespirito@gmail.com Fri Apr 17 20:41:06 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.5 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,KAM_LOTTO1,LOTTO_AGENT, LOTTO_MANY,LOTTO_RANDOM,LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BRBL,RDNS_NONE,SPF_NEUTRAL,STOX_30,SUBJ_ALL_CAPS, Spoof_Port_URL,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [209.29.33.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [209.29.33.22 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [209.29.33.22 listed in psbl.surriel.com] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 LOTTO_RANDOM BODY: Random selection * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.5 Spoof_Port_URL URI with malformed port * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from iowawebhosting.com ([209.29.33.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3I3f1n7028352 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Fri, 17 Apr 2009 20:41:06 -0700 Message-Id: <200904180341.n3I3f1n7028352@ga.impsec.org> Received: (qmail 9048 invoked from network); 16 Apr 2009 19:11:37 -0500 Received: from 212-166-157-130.red-acceso.airtel.net (HELO User) (212.166.157.130) by birdsandfeeders.com with SMTP; 16 Apr 2009 19:11:37 -0500 Reply-To: From: "LOTERIA ESPANA" Subject: [SPAM] LOTERIA ESPANA Date: Fri, 17 Apr 2009 02:11:40 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 16:33:43 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 17 Apr 2009 20:41:06 -0700 (PDT) X-Spam-Prev-Subject: LOTERIA ESPANA Status: R X-Status: X-Keywords: X-UID: 270 Content-Length: 1707 REF.NO.: ROEUSP7775553 BATCH NO: X8007891324Z, YOU HAVE WON We are pleased to inform you on the release of E-Lotto Internet Promotional Draws held in Madrid Spain on the 4th of january of 2009. Your e-mail address , attached to the ticket number 3570146744224, with the serial number 51228-07, drew the lucky numbers of 1-M-M-0-0-M+1-0 which consequently won the lottery in the 3rd category. All email addresses entered for these promotional draws were randomly inputted from an internet resource database using the Synchronized Random Selection System (SRSS). You have therefore been approved for a lump sum payout of 415.810,00 (FOUR HUNDRED AND FIFTEEN THOUSAND EIGHT HUNDRED AND TEN EUROS ) in cash credited to your file with the REF.NO:ROEUSP7775553 AND BATCH.NO: X8007891324Z, to be paid through BANK TRANSFER. Your winning prize is now deposited with a BANK insured with your REF.NO:ROEUSP7775553 for security reasons and will be released for payment by the order of the LOTTERY BOARD after the datas have been verified. We ask you to keep this award confidential and away from public notice until your claim has been processed and your cash remitted to you. The beneficiary is responsible for the remittance charge of the prize to his/her country. To claim your prize, please contact your claims agent below, and demand for your lottery claiming form. MRS ANA SANCHEZ BANCO ESPIRITO SANTO CTO.-PASEO ALAMEDA, 34/46023 VALENCIA ESPAA NIF G-5889999/8. " TEL.00 34.634.015.778 FAX.00 34.911.817.394 e-mail: bancoespiritosantoespana@mail.md SINCERELY JUAN FERNANDO HERNNDEZ (PRESIDENT) From robertmueller0777@yahoo.cn Sat Apr 18 05:12:29 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, J_CHICKENPOX_34,LOTTO_YOU_WON_03,MISSING_HEADERS,MSGID_FROM_MTA_HEADER, MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, RCVD_IN_SBL,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,STOX_30,US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [66.7.202.107 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9933] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.72 listed in zen.spamhaus.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.72 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.72 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 76] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 76] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from bludomain9.bludomain9.com (bludomain9.bludomain9.com [66.7.202.107]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3ICCP3X010504 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 18 Apr 2009 05:12:29 -0700 Message-Id: <200904181212.n3ICCP3X010504@ga.impsec.org> Received: from [196.3.183.72] (helo=User) by bludomain9.bludomain9.com with esmtpa (Exim 4.69) (envelope-from ) id 1Lv7vv-0002VB-Ro; Sat, 18 Apr 2009 06:38:06 -0400 Reply-To: From: "F.B.I" Subject: [SPAM] Federal Bureau of Investigation Date: Sat, 18 Apr 2009 11:38:00 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - bludomain9.bludomain9.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - yahoo.cn X-Source: X-Source-Args: X-Source-Dir: X-Greylist: Delayed for 00:57:29 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 18 Apr 2009 05:12:29 -0700 (PDT) X-Spam-Prev-Subject: Federal Bureau of Investigation Status: R X-Status: X-Keywords: X-UID: 271 Content-Length: 3070 Federal Bureau of Investigation FBI Seattle Division 1110 Third Avenue Seattle, Washington 98101-2904 Payment Code: R5109176K Reg No: 132731593 08070760985 The Federal Bureau of Investigation has discovered through our intelligence Monitoring Network that you are eligible to receive the sum of $7,500,000.00 USD regarding to an over-due Inheritance/Award payment which was fully endorsed to be paid in your favor. Therefore, the FBI Seattle Division in conjunction with the United States Department of Homeland Security (DHS), Has screened through our various Monitoring Networks and has been confirmed and notified that the transaction you have with the Financial Institution is Legal and you have the Lawful Right to claim your due fund. The President His Excenllency Alhaji Umaru Musa Yar'Adua President of the Federal republic of Nigeria has given us the final approval to pay your fund to you within the next 72hrs, your fund valued $7,500,000.00 USD has been deposited into a Gold smart Card Number: 5425 0512 3456 1956 personal identification is ATM- 7997 this card will enable you buy and withdrawal cash anywhere around the world this is done for your own security, with this card you will not have to take the risk of sending us your personnal banking details online as you have been strongly advise by your local bank not to send your banking details to anyone online. What you are required to do now is to Pay the fees of $120.00 USD for the shipment of your Gold Smart card to your choice location, $120.00 USD is the only fees that has been approved by both the FBI and the Bank that you are to pay as cost of Delivery of your Card to you by the courier company.Once the fees is been paid your atm will get to you in the next 2-3 working day. Note: Your funds are protected by a hardcover insurance policy, which makes it impossible to deduct any amount from the money before it can be remitted to you.this means that the above charges cannot be deducted from the Funds and hence must be provided by you before your fund is transferred to you. The payment for any of the above options should be sent via Western Union Money Transfer in the name of the Head of accounts Mr. JULIUS AZUKA. Find below the payment information. Name of receiver: JULIUS AZUKA Office Address: Plot 143, Ahmadu Bello Way, Victoria Island, Lagos 23401 Nigeria. Text Question: In God Answer: We Trust Name of Sender:..................... Address of Sender:.................. MTCN#............................... Please contact the Head of Operations Dr.Robert Mueller Central Bank of Nigeria with the payment details as soon you make the your payment. Dr. Robert Mueller (Head of Operations) International Remittance Department Email: robertmuellerr@yahoo.cn As soon as he receive your payment, he shall proceed with your fund transfer immediately. We anticipate your prompt response. If you need to contact me at any stage please do not hesitate to call +234 807 076 0985. Sincerely, Steven M. Dean (Assistant Special Agent-in-Charge) cc Evra Rice (FBI Director) From tina_johnson@cantv.net Tue Apr 21 02:30:04 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n3L9U3Uu020944 for ; Tue, 21 Apr 2009 02:30:04 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********* X-Spam-Status: Yes, score=9.2 required=5.0 tests=BAYES_99,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,MILLIONS_01,MIME_HTML_ONLY,PHISH_05,RBL_PSBL_01, SARE_LWOILCO,SPAMMY_HEADER_10,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.3 SPAMMY_HEADER_10 Found a X-Virus-Status header * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [200.11.173.13 listed in psbl.surriel.com] * 1.1 SARE_LWOILCO BODY: SARE_LWOILCO * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Tue, 21 Apr 2009 02:30:04 -0700 (PDT) Received: from rs25s3.datacenter.cha.cantv.net (rs25s3.datacenter.cha.cantv.net [200.11.173.13]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3L9Ra9h027802 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 21 Apr 2009 02:27:42 -0700 X-DNSBL-MILTER: Passed Received: from cantv.net (rs20s8.datacenter.cha.cantv.net [200.109.127.75]) by rs25s3.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP id n3L8KwZG008224; Tue, 21 Apr 2009 03:50:58 -0430 X-Matched-Lists: [] Message-ID: <380-22009422182113136@cantv.net> Reply-To: tina_johnson@cantv.net X-ORIGINATOR-IP: 41.202.76.22 From: "tina_johnson@cantv.net" To: Tina_.Johnson@cantv.net Subject: [SPAM] Dear Beloved Date: Tue, 21 Apr 2009 03:51:13 -0430 MIME-Version: 1.0 Content-Type: text/html; charset=ISO-8859-1 X-Virus-Scanned: clamav-milter 0.95.1 at rs25s3.datacenter.cha.cantv.net X-Virus-Status: Clean X-Greylist: Delayed for 01:03:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 21 Apr 2009 02:27:42 -0700 (PDT) X-Spam-Prev-Subject: Dear Beloved Status: R X-Status: X-Keywords: X-UID: 272 Content-Length: 1381
Dear Beloved,
 
I am Miss Tina  Johnson from Zimbabwe. I am the only surviving Daughter of Late
Dr and Mrs Richard  Johnson ,my Father worked with Oil Company for twenty one
years before he died in a motor accident with my mother  and my only junior brother in the year 2006.
 
My late Father deposited the sum of $8.5 Million (Eight Million Five
Hundred Thousand Dollars) with a bank in Cote D Iviore.

Recently,my Doctor told me that I have limited days to live due to the
stroke and cancerous problems I am suffering from.I have decided to donate
this fund to you and want you to use this gift which comes from my late
fathers effort to fund the upkeep of widows and charities worldwide.
Please i need you to send to me the following informations.
 
1.your full Name.
2.Your private phone and fax number
3) your account number
4)your age and your occupation
5)Any of your ids

I took this decision because I do not have any direct brother or sister
that will inherit this money and my fathers relations are useless  and
wealthy people and I do not want my late fathers hard earned money to
be misused.Please, consider this and get back to me as soon as possible.
 
Your Faithfully
Miss  Tina  Johnson .
From bancoespirito@gmail.com Sun Apr 19 11:40:35 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************************** X-Spam-Status: Yes, score=30.0 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,KAM_LOTTO1,LOTTO_AGENT, LOTTO_MANY,LOTTO_RANDOM,LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RBL_PSBL_01,RCVD_IN_BRBL,RDNS_NONE,SPF_NEUTRAL,STOX_30,SUBJ_ALL_CAPS, Spoof_Port_URL,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [209.29.33.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [209.29.33.22 listed in psbl.surriel.com] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 LOTTO_RANDOM BODY: Random selection * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.5 Spoof_Port_URL URI with malformed port * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from iowawebhosting.com ([209.29.33.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3JIeUkZ029590 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sun, 19 Apr 2009 11:40:35 -0700 Message-Id: <200904191840.n3JIeUkZ029590@ga.impsec.org> Received: (qmail 22371 invoked from network); 19 Apr 2009 04:22:43 -0500 Received: from unknown (HELO User) (77.208.111.49) by birdsandfeeders.com with SMTP; 19 Apr 2009 04:22:43 -0500 Reply-To: From: "LOTERIA ESPANA" Subject: [SPAM] LOTERIA ESPANA Date: Sun, 19 Apr 2009 11:22:40 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: LOTERIA ESPANA Status: R X-Status: X-Keywords: X-UID: 273 Content-Length: 1666 YOU HAVE WON FINAL NOTICE We are pleased to inform you on the release of E-Lotto Internet Promotional Draws held in Madrid Spain on the 4th of january of 2009. Your e-mail address , attached to the ticket number 3570146744224, with the serial number 51228-07, drew the lucky numbers of 1-M-M-0-0-M+1-0 which consequently won the lottery in the 3rd category. All email addresses entered for these promotional draws were randomly inputted from an internet resource database using the Synchronized Random Selection System (SRSS). You have therefore been approved for a lump sum payout of 415.810,00 (FOUR HUNDRED AND FIFTEEN THOUSAND EIGHT HUNDRED AND TEN EUROS ) in cash credited to your file with the REF.NO:ROEUSP7775553 AND BATCH.NO: X8007891324Z, to be paid through BANK TRANSFER. Your winning prize is now deposited with a BANK insured with your REF.NO:ROEUSP7775553 for security reasons and will be released for payment by the order of the LOTTERY BOARD after the datas have been verified. We ask you to keep this award confidential and away from public notice until your claim has been processed and your cash remitted to you. The beneficiary is responsible for the remittance charge of the prize to his/her country. To claim your prize, please contact your claims agent below, and demand for your lottery claiming form. MRS ANA SANCHEZ BANCO ESPIRITO SANTO CTO.-PASEO ALAMEDA, 34/46023 VALENCIA ESPAA NIF G-5889999/8. " TEL.00 34.634.015.778 FAX.00 34.911.817.394 e-mail: bancoespiritosantosespana@mail.md SINCERELY JUAN FERNANDO HERNNDEZ (PRESIDENT) From renategoudsmit@hetnet.nl Sun Apr 19 17:39:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************************** X-Spam-Status: Yes, score=28.9 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_57,J_CHICKENPOX_63,J_CHICKENPOX_73, LOTTO_WIN_01,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [200.35.33.17 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [200.35.33.17 listed in psbl.surriel.com] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 1.3 MISSING_HEADERS Missing To: header * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 71] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 71] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ms1.edatel.net.co (arriero.edatel.net.co [200.35.33.17]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3K0d3v1006361 for ; Sun, 19 Apr 2009 17:39:08 -0700 Message-Id: <200904200039.n3K0d3v1006361@ga.impsec.org> Received: (qmail-ldap/ctrl 20791 invoked from network); 19 Apr 2009 12:12:12 -0000 Received: from unknown (HELO User) (Autenticado:saludintegralm@edatel.net.co@[82.128.45.99]) (envelope-sender ) by 0 (qmail-ldap-1.03) with SMTP for ; 19 Apr 2009 12:12:12 -0000 Reply-To: From: "Mrs Wynand Ferreira," Subject: [SPAM] Congratulations...Contact Cecil Samuel for Your Award Winning Cheque Date: Sun, 19 Apr 2009 05:12:03 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 01:19:41 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 19 Apr 2009 17:39:08 -0700 (PDT) X-Spam-Prev-Subject: Congratulations...Contact Cecil Samuel for Your Award Winning Cheque Status: R X-Status: X-Keywords: X-UID: 274 Content-Length: 2312 Greetings, I have been waiting for you to contact me for your Confirmable Bank Draft of $300.000USD ( Three Hundred Thousand United States Dollars)but I did not hear from you since that time.Then I went and deposited the Draft with GITANO EXPRESS SERVICE in West Africa, I travelled out of the country for a 3 Months Course and I will not come back till end of July 2009.What you have to do now is to contact the GITANO EXPRESS COURIER SERVICE as soon as possible to know when they will deliver your package to you because of the expiring date.For your information, I have paid for the delivering Charge,Insurance premium and Clearance Certificate Fee of the Cheque showing that it is not a Drug Moneyor meant to sponsor Terrorist attack in your Country. The only money you will send to the GITANO EXPRESS COURIER SERVICE to deliver your Draft direct to your postal Address in your country is ($200USD) Dollars only being Security Keeping Fee of the Courier Company so far. Again, don't be deceived by anybody to pay any other money except $200US Dollars.I would have paid that but they said no because they don't know when you will contact them and in case of demurrage.You have to contact the GITANO EXPRESS COURIER SERVICE now for the delivery of your Draft with this information bellow: GITANO EXPRESS COURIER SERVICE Contact Person: Mr Cecil Samuel E-mail: gecs.cecilsamuel17@googlemail.com Phone - +2347055123778 Finally, make sure that you reconfirm your Full Names,Contact address and Direct telephone number to them again to avoid any mistake on the Delivery and ask them to give you the tracking number to enable you track your package over there and know when it will get to your address.Let me repeat again, try to contact them as soon as you receive this mail to avoid any further delay and remember to pay them their Security Keeping fee of $200US Dollars for their immediate action,ask them how you will send the security safe keeping fees of $200USD only to them today so that you can send them the $200USD and the yproceed to send your compensational cheque to you which has already been written in your name and no amount of money can be deducted from the cheque. You should also let me know through email as soon as you receive your Draft. Yours Faithfully, Mrs Wynand Ferreira, 2009 From bancoespirito@gmail.com Mon Apr 20 09:55:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.5 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,KAM_LOTTO1,LOTTO_AGENT, LOTTO_MANY,LOTTO_RANDOM,LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01, RCVD_IN_BRBL,RDNS_NONE,SPF_NEUTRAL,STOX_30,SUBJ_ALL_CAPS,Spoof_Port_URL, THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [209.29.33.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [209.29.33.22 listed in psbl.surriel.com] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 LOTTO_RANDOM BODY: Random selection * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.5 Spoof_Port_URL URI with malformed port * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from iowawebhosting.com ([209.29.33.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3KGtZcN032425 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Mon, 20 Apr 2009 09:55:39 -0700 Message-Id: <200904201655.n3KGtZcN032425@ga.impsec.org> Received: (qmail 17202 invoked from network); 19 Apr 2009 13:05:12 -0500 Received: from 62-87-82-22.red-acceso.airtel.net (HELO User) (62.87.82.22) by sacredheartwdm.org with SMTP; 19 Apr 2009 13:05:12 -0500 Reply-To: From: "LOTERIA ESPANA" Subject: [SPAM] LOTERIA ESPANA Date: Sun, 19 Apr 2009 20:05:10 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: LOTERIA ESPANA Status: R X-Status: X-Keywords: X-UID: 275 Content-Length: 1666 YOU HAVE WON FINAL NOTICE We are pleased to inform you on the release of E-Lotto Internet Promotional Draws held in Madrid Spain on the 4th of january of 2009. Your e-mail address , attached to the ticket number 3570146744224, with the serial number 51228-07, drew the lucky numbers of 1-M-M-0-0-M+1-0 which consequently won the lottery in the 3rd category. All email addresses entered for these promotional draws were randomly inputted from an internet resource database using the Synchronized Random Selection System (SRSS). You have therefore been approved for a lump sum payout of 415.810,00 (FOUR HUNDRED AND FIFTEEN THOUSAND EIGHT HUNDRED AND TEN EUROS ) in cash credited to your file with the REF.NO:ROEUSP7775553 AND BATCH.NO: X8007891324Z, to be paid through BANK TRANSFER. Your winning prize is now deposited with a BANK insured with your REF.NO:ROEUSP7775553 for security reasons and will be released for payment by the order of the LOTTERY BOARD after the datas have been verified. We ask you to keep this award confidential and away from public notice until your claim has been processed and your cash remitted to you. The beneficiary is responsible for the remittance charge of the prize to his/her country. To claim your prize, please contact your claims agent below, and demand for your lottery claiming form. MRS ANA SANCHEZ BANCO ESPIRITO SANTO CTO.-PASEO ALAMEDA, 34/46023 VALENCIA ESPAA NIF G-5889999/8. " TEL.00 34.634.015.778 FAX.00 34.911.817.394 e-mail: bancoespiritosantosespana@mail.md SINCERELY JUAN FERNANDO HERNNDEZ (PRESIDENT) From webmaster@sanmiguelcamden.org Tue Apr 21 04:25:19 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_95,FORGED_YAHOO_RCVD,FREEMAIL_FROM,FREEMAIL_REPLYTO, J_CHICKENPOX_43,J_CHICKENPOX_57,J_CHICKENPOX_63,L_SOME_STD_PROBS,MILLION_USD, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, RDNS_DYNAMIC,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_HELO_PASS,SPF_PASS, STOX_30,SUBJ_ALL_CAPS,UPPERCASE_75_100 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [74.92.83.34 listed in b.barracudacentral.org] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.3 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 1.5 MILLION_USD BODY: Talks about millions of dollars * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9602] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 1.5 UPPERCASE_75_100 message body is 75-100% uppercase * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from lfserver.sanmiguelcamden.org (74-92-83-34-Philadelphia.hfc.comcastbusiness.net [74.92.83.34] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3LBPEga031492 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 21 Apr 2009 04:25:19 -0700 Received: from lfserver (localhost [127.0.0.1]) by lfserver.sanmiguelcamden.org (Postfix) with ESMTP id BF9241A6BAC for ; Tue, 21 Apr 2009 07:06:04 -0400 (GMT+4) X-NitixSpamScannerValue: 630 X-NitixSpamScannerScore: ********** X-NitixVirusScanner: Clean Received: by lfserver.sanmiguelcamden.org (Postfix, from userid 4019) id 81B241A6BA7; Tue, 21 Apr 2009 07:06:04 -0400 (GMT+4) To: jhardin@impsec.org Subject: [SPAM] PLEASE I NEED YOUR ASSISTANCE AND HELP From: SIKIDI MIMI KONNEH Reply-To: mimikonneh@rocketmail.com MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit Message-Id: <20090421110604.81B241A6BA7@lfserver.sanmiguelcamden.org> Date: Tue, 21 Apr 2009 07:06:04 -0400 (GMT+4) X-Greylist: Delayed for 00:19:05 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 21 Apr 2009 04:25:19 -0700 (PDT) X-Spam-Prev-Subject: PLEASE I NEED YOUR ASSISTANCE AND HELP Status: R X-Status: X-Keywords: X-UID: 276 Content-Length: 2684 HELLO I AM SIKIDI MIMI KONNEH, 19YEARS OLD FROM LIBERIA, DAUGHTER OF LATE CYRUS KONNEH, SIR I SAW YOUR CONTACT INFORMATION ON THE INTERNET SEARCH UNIT AND I DECIDED TO CONTACT YOU FOR HELP. PRESENTLY I AM IN GHANA.BECAUSE OF THE GENOCIDE THE REBELS COMMITTED IN MY COUNTRY WHICH AFFECTED MY FAMILY BADLY. MY FATHER WAS A POLITICIAN AND A GOLD MERCHANT BEFORE AND DURING THE WAR TIME IN LIBERIA, AND DURING THE WAR HE WAS KILLED BY REBELS, WHEN THE WAR STATED HE TOLD ME THAT HE HAS DEPOSITED SOME LUMP SUM OF MONEY WHAT ($30 MILLION USD IN CASH, AND GOLD BAR WHAT ($5 MILLION) THAT CAN KEEP OUR FAMILY IN GOOD SHAPE UNTIL THINGS SETTLES DOWN IN LIBERIA, UNFORTUNATELY HE WAS KILLED.AND DID NOT MAKE IT OUT OF LIBERIA. AND AS WELL HE TOLD ME WERE TO GET THE DOCUMENTS HE USED IN DEPOSITING THE BOXES IN CASE ANYTHING BAD HAPPENS, AFTER HIS DEATH OUR FAMILY BECAME A TARGET POINT FOR THE REBELS, AND THEN MY MOTHER RAPED BRUTALIZED AND FINALLY KILLED, I HAD TO RUN TO GHANA THROUGH THE HELP OF THE UNITED NATIONS CARGO TRUCKS WHEN THE WAR WAS SO TENSE AND PEOPLE WHERE RUNNING OUT OF LIBERIA. WHEN I GOT HERE (GHANA) I CONTACTED THE SECURITY AND INSURANCE COMPANY WITH THE LITTLE INFORMATION I WAS HAVING AND WAS ABLE TO SEE EVERY THING, WHICH OF COURSE WAS STILL IN TACT,BUT THE PROBLEM AM HAVING NOW, IS THAT MY FATHER STATED IN THE CONTRACT PAPERS THAT, ON THE EVENT OF HIS DEATH, HIS NEXT OF KIN SHOULD BE GIVEN THE BOXES WITH THE CONSENT OF HIS FRIEND AND BUSINESS PARTNER ( MR, COLIN MORLEY IN (LONDON UK) ALSO THAT THE BOXES BE MOVED TO THE COUNTRY OF MR COLIN MORLEY WITH THE APPROVAL OF THE NEXT OF KIN FOR PROPER INVESTMENT AND MANAGEMENT. AND BECAUSE OF THE WAR I HAVE LOST ALL HIS CONTACT INFORMATION'S I WAS HAVING THAT IS WHY I AM LOOKING FOR A GODLY PERSON TO STAND FOR ME AS MY FOREIGN BENEFICIARY AS STATED BY THE CONTRACT WITH MY FATHER. PRESENTLY THE HEAD OF THE SECURITY COMPANY IS WILLING TO RENDER ANY ASSISTANCE TO ME IF I CAN GET SOME BODY TO STAND FOR ME AS STATED BY THE DOCUMENTS. I KNOW THIS MAY SOUND STRANGE TO YOU BUT I REALLY NEED YOU AS A GODLY PERSON TO HELP ME, AND I PROMISE TO GIVE YOU 30% OF THE CONTENTS OF THE TWO BOXES IF YOU CAN HELP ME SO THAT I CAN START A NEW LIFE AND HAVE A PLACE TO CALL HOME. AND ANOTHER 10% FOR ANY EXPENDITURE YOU MAY IN CURE AS YOU TRY TO HELP ME ON THIS AND AFTER THAT YOU WILL TAKE MONEY FROM THE BOXES TO ARRANGE THE TRAVELING DOCUMENTS THAT I WILL USE TO COME OVER TO YOUR COUNTRY AND CONTINUE MY EDUCATION. PLEASE IF YOU ARE WILLING TO HELP ME REPLY ME WITH YOUR CONTACT NUMBER SO THAT I CAN TALK TO YOU ON THE PHONE THANKS AND GOD BLESS YOU. I WAIT ANXIOUSLY TO HEAR FROM YOU. SIKIDI MIMI KONNEH From shuantelrobert2003@yahoo.co.jp Tue Apr 21 04:54:08 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.0 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_JP_1,FREEMAIL_FROM,FREEMAIL_REPLYTO, HTML_MESSAGE,MILLION_USD,RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET, SPF_PASS,US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [41.207.216.176 listed in psbl.surriel.com] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 MILLION_USD BODY: Talks about millions of dollars * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from web2909.mail.tnz.yahoo.co.jp (web2909.mail.tnz.yahoo.co.jp [203.216.249.194]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n3LBs3X6032046 for ; Tue, 21 Apr 2009 04:54:07 -0700 Received: (qmail 76646 invoked by uid 60001); 21 Apr 2009 11:27:22 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=yj20050223; d=yahoo.co.jp; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=J5bS8k4+bcJCr07XfzZaR3m5SxlqrwNWvW9IsoamYmJUj7KJyAwQweutdTWaU+Slh2e1dMDP+Y5cd3H3hUTnmKg/R2ZRq3hFz38YWX126rwDZA6Fe6rBx+vwDozqDL7j ; Message-ID: <20090421112722.76644.qmail@web2909.mail.tnz.yahoo.co.jp> Received: from [41.207.216.176] by web2909.mail.tnz.yahoo.co.jp via HTTP; Tue, 21 Apr 2009 20:27:22 JST Date: Tue, 21 Apr 2009 20:27:22 +0900 (JST) From: Miss Shuantel Robert Reply-To: missshuantelrobert@yahoo.fr Subject: [SPAM] Miss Shuantel To: shuantelrobert2003@yahoo.co.jp MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="0-1266031780-1240313242=:76269" X-Greylist: Delayed for 00:26:35 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 21 Apr 2009 04:54:08 -0700 (PDT) X-Spam-Prev-Subject: Miss Shuantel Status: R X-Status: X-Keywords: X-UID: 277 Content-Length: 3897 --0-1266031780-1240313242=:76269 Content-Type: text/plain; charset=iso-2022-jp Hello Dear, My name is Shuantel Robert, I am 23 years old single girl . I lost my parents and our two youger sisters to the war in our country. I am lucky that I was taken to this country Cote d' Ivoire by some good sameritans who have families here, Ivory coast. I am staying in a missionary refugee camp for people displaced by the crisis in our country and those from this country's crisis. I would like to appeal to you confidentialy to assist me concerning my late father's deposit in a private security company here in Abidjan of $10,500,000,00. (Ten Million Five Hundred Thousand USD) I want to move out of here because the crisis that started here of over one year now is still on and there is no sign that it will be well with the country. Also the condition in this camp is not condusive for us that had life very easy before. Can I trust you to help me clear the treasure from the security company and also get a place for us to stay in your country? Can I also trust you to safe keep this fund when you help me clear the treasure from the security company? If you are willing to help please indicate in your next mail and let me know so that I will give you the contact of the security company to contact them as my foriegn partner and make arrangement with them on how to lift the treasure to your country through diplomatic courrier agent service. Let me have your telephone number and I will discuss with you some details. Let me know in your discussion what you expect to deduct when you help me clear this treasure from the security company. God bless you, Shuantel Robert --------------------------------- Power up the Internet with Yahoo! Toolbar. --0-1266031780-1240313242=:76269 Content-Type: text/html; charset=iso-2022-jp
Hello Dear,
 
My name is Shuantel Robert,  I am 23 years old single girl . I lost my parents and our two youger sisters  to the war in our country. I am lucky that I was taken to this country Cote d' Ivoire by some good sameritans who have families here, Ivory coast.
I am  staying in a missionary refugee camp for people displaced by the crisis in our country and those from this country's crisis.
 
I would like to appeal to you confidentialy to assist me concerning my late father's deposit in a private security company here in Abidjan of $10,500,000,00. (Ten Million Five Hundred Thousand USD) I want to move out of here because the crisis that started here of over one year now is still on and there is no sign that it will be well with the country. Also the condition in this camp is not condusive for us that had life very easy before.

Can I trust you to help me clear the treasure from the security company and also get a place for us to stay in your country?
Can I also trust you to safe keep this fund when you help me clear the treasure from the security company?

If you are willing to help please indicate in your next mail and let me know so that I will give you the contact of the security company to contact them as my foriegn partner and make arrangement with them on how to lift  the treasure to your country through diplomatic courrier agent service.

Let me have your telephone number and I will discuss with you some details. Let me know in your discussion what you expect to deduct when you help me clear this treasure from the security company.

God bless you,
Shuantel Robert
 

Power up the Internet with Yahoo! Toolbar.
--0-1266031780-1240313242=:76269-- From rbsonlineintl@gmail.com Tue Apr 21 15:45:58 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********** X-Spam-Status: Yes, score=11.9 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_50,FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_21, LOTTO_YOU_WON_03,MISSING_HEADERS,PHISH_05,RCVD_IN_BRBL,SPF_NEUTRAL, SUBJ_ALL_CAPS,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [202.70.91.8 listed in b.barracudacentral.org] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5092] * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from makalu.ioe.edu.np (makalu.ioe.edu.np [202.70.91.8]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3LMjoCe018979 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Tue, 21 Apr 2009 15:45:57 -0700 Received: (qmail 30220 invoked by uid 509); 20 Apr 2009 17:38:26 -0000 Received: from 127.0.0.1 by makalu.ioe.edu.np (envelope-from , uid 89) with qmail-scanner-2.01 (clamdscan: 0.90.2/3571. spamassassin: 3.1.9. Clear:RC:1(127.0.0.1):. Processed in 3.459006 secs); 20 Apr 2009 17:38:26 -0000 Received: from unknown (HELO makalu.ioe.edu.np) (127.0.0.1) by 0 with SMTP; 20 Apr 2009 17:38:22 -0000 Received: from 41.219.195.219 (SquirrelMail authenticated user iswar@ioe.edu.np) by makalu.ioe.edu.np with HTTP; Mon, 20 Apr 2009 23:23:22 +0545 (NPT) Message-ID: <27471.41.219.195.219.1240249102.squirrel@makalu.ioe.edu.np> Date: Mon, 20 Apr 2009 23:23:22 +0545 (NPT) Subject: [SPAM] RE: REVIEW AND TRANSFER OF US$6,200,000.00 TO YOUR BANK ACCOUNT. From: "Royal Bank of Scotland" Reply-To: rbsonlineintl@gmail.com User-Agent: SquirrelMail/1.4.9a MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Greylist: Delayed for 00:20:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 21 Apr 2009 15:45:58 -0700 (PDT) X-Spam-Prev-Subject: RE: REVIEW AND TRANSFER OF US$6,200,000.00 TO YOUR BANK ACCOUNT. Status: R X-Status: X-Keywords: X-UID: 278 Content-Length: 1831 Financial Reporting Council Royal Bank of Scotland 2 Waterhouse Square 138-142 Holborn London EC1N 2TH United Kingdom http://www.rbs.co.uk Attn: Beneficiary, RE: REVIEW AND TRANSFER OF US$6,200,000.00 TO YOUR BANK ACCOUNT. We wish to inform you that our bank is presently processing the release of your payment voucher for the transfer of your funds. We are fully aware that that you have spent a lot of money and the auditor's reports shows that you have been ripped off several times for the transfer of your funds, which has been delayed by some dubious officials that dealt with you in the past. Investigations are presently going on to curb their activities and bring them all to justice within the shortest possible time. Note that regulations guiding large funds transfer have changed on a global basis and all major international banks have to follow these rules to protect your financial security. In line with this new regulations, final approval has been given to our bank by the Financial Service Authority to transfer a part-payment of US$6,200,000.00 to your bank account in your country to enable you meet up with your financial obligations to your creditors. Should you follow our directives, this first installment transfer amount of US$6,200,000.00 will be credited and confirm in your bank account within three (3) working days. Kindly re-confirm your telephone number and acknowledge the receipt of this message so that we can update our records for the transfer of the first installment amount of US$6,200,000.00 to your bank account. To protect the confidentiality of your information, send your telephone number directly to my private email: mrsalisonmc@gmail.com Thanks for your co-operation. Yours sincerely, Mrs. Alison MacLean Financial Reporting Council Royal Bank of Scotland, UK From dantremb@f-mail.net Thu Apr 23 02:09:22 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.4 required=5.0 tests=BAYES_80,FAKE_REPLY_C, FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,MILLION_USD,MISSING_HEADERS, MSOE_MID_WRONG_CASE,RBL_PSBL_01,RCVD_IN_BRBL,RCVD_IN_NJABL_RELAY, SARE_FRAUD_X3,SARE_FRAUD_X4 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.7 RCVD_IN_NJABL_RELAY RBL: NJABL: sender is confirmed open relay * [206.71.145.228 listed in combined.njabl.org] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [206.71.145.228 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [206.71.145.228 listed in psbl.surriel.com] * 1.3 MISSING_HEADERS Missing To: header * 1.5 MILLION_USD BODY: Talks about millions of dollars * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8986] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 FAKE_REPLY_C FAKE_REPLY_C * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.markorama.com (mail.markorama.com [206.71.145.228]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3N99Hcf017068 for ; Thu, 23 Apr 2009 02:09:21 -0700 Received: from User [94.113.0.217] by mail.markorama.com with ESMTP (SMTPD32-8.05) id AA6444A04F6; Sun, 19 Apr 2009 13:07:48 -0400 Reply-To: From: "Daniel Tremblay" Subject: [SPAM] Re:from Mr Daniel Date: Sun, 19 Apr 2009 18:06:34 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090419130862.SM01796@User> X-Greylist: Delayed for 23:07:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 23 Apr 2009 02:09:22 -0700 (PDT) X-Spam-Prev-Subject: Re:from Mr Daniel Status: R X-Status: X-Keywords: X-UID: 279 Content-Length: 1290 DIPLOMATIC DELIVERY OF YOUR CONSIGNMENT/FUNDS CLASSIFIED INFORMATION/TREAT WITH UTMOST CONFIDENTIALITY Attention, On behalf of the Board and Management of Finance direct Commission, London UK, please be informed that your consignment/funds tagged diplomatic luggage 122 with Ref: No1226/X42/206 which was deposited in our vault for safe keeping by a Diplomatic Courier Company, is due for Immediate collection. This Consignment contains amount in tune of $2.5million USD. We require the information below in other for you to claim the consignment ocntaining the money A scanned copy of your International passport and drivers license. your phone number. List the nearest international airport to your address location. your age and occupation, Meanwhile, we urge you to treat the above requirement with utmost urgency and confidentiality to enable us dispense our duties and obligation accordingly thereby allowing us to serve you in a timely fashion. Upon satisfactory receipt of all the above mentioned, you will be further acquainted with the detailed delivery itinerary including information of the Diplomat who will accompany your consignment. We pledge our best service at all times. Yours Sincerely Mr Daniel Tremblay Foreign Operations Manager From sihhoit@telkomsa.net Thu Apr 23 09:08:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=30.0 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,DEAR_SOMETHING,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,MILLIONS_01,PHISH_05,RAZOR2_CHECK, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,URG_BIZ,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9997] * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from leo.telkomsa.net (jabbah.telkomsa.net [196.25.211.3]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3NG84oF028860 for ; Thu, 23 Apr 2009 09:08:08 -0700 Received: from mail4.telkomsa.net (newmail.telkomsa.net [196.25.211.110]) by leo.telkomsa.net (Postfix) with ESMTP id AE4EDF085C; Thu, 23 Apr 2009 17:46:06 +0200 (SAST) Date: Thu, 23 Apr 2009 17:45:52 +0200 (SAST) From: Dhld Message-ID: <61720556.623371240501552808.JavaMail.root@zimbra4-vm1.telkomsa.net> Subject: [SPAM] Dear Sir/Madam, MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [192.168.16.50] X-Mailer: Zimbra 5.0.11_GA_2695.RHEL5_64 (zclient/5.0.11_GA_2695.RHEL5_64) To: undisclosed-recipients:; X-Greylist: Delayed for 00:20:59 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 23 Apr 2009 09:08:09 -0700 (PDT) X-Spam-Prev-Subject: Dear Sir/Madam, Status: R X-Status: X-Keywords: X-UID: 280 Content-Length: 2587 Reply: maxwelltambo2@gala.net Dear Sir/Madam, I am Mr. Maxwell Tambo, Bank Manager of a Reputable bank in Johannesburg, Gauteng Province, Republic of South Africa. I have an urgent and very confidential business proposition for you. On Feb. 27, 2001, a British Contractor with the South African Mining Corporation, (Name deliberately with held) made a numbered time (Fixed) Deposit for twelve calendar months, valued at US$50,000,000.00 (Ffity Million Dollars) in my branch. Upon maturity, I sent a routine notification to his forwarding address but got no reply. After a month, we sent a reminder and finally we discovered from his contract employers, the South African Mining Corporation, that the depositor died from an automobile accident. On further investigation, I found out that he died without making a WILL and all attempts to trace his next of kin was fruitless. I therefore made further investigation and discovered that the depositor did not declare any next of kin or relations in all his official documents,US$50,000,000.00 is still sitting in my Bank and the interest is being rolled over with the principal sum at the end of each year. No one will ever come forward to claim it. According to Laws of Republic of South Africa, at the expiration of 10(Ten) years, the money will revert to the ownership of the South African Government if nobody applies to claim the fund. Consequently, my proposal is that I will like you as a foreigner to stand in as THE NEXT OF KIN to the depositor so that the fruits of this old man's labo ur will not get into the hands of some corrupt government officials. A bank account in any part of the world that you will provide will then facilitate the transfer of this money to you as the beneficiary/next of kin. The money will be paid into your account for us to share in the ratio of 60%for me and 35% for you and 5% for any expenses that we are going to incue.There is no risk at all and if you are interested, please reply immediately via the private email address. Upon your response, I shall then provide you with more details and relevant documents that will help you understand the transaction. Please send me your full name, age, occupation, address, confidential telephone and fax numbers for easy communication and also, Please observe utmost confidentiality, and be rest assured that this transaction would be most profitable for both of us because I shall require your assistance to invest my share in your country. Thanks and Regards. Mr. Maxwell Tambo Reply: maxwelltambo2@gala.net From rlanfear@bresnan.net Fri Apr 24 01:37:21 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************ X-Spam-Status: Yes, score=36.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_NG_2,DATE_IN_FUTURE_03_06,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FREEMAIL_FORGED,HTML_MESSAGE, J_CHICKENPOX_34,J_CHICKENPOX_46,MIME_HTML_ONLY,MISSING_HEADERS, MSOE_MID_WRONG_CASE,PHISH_05,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SARE_FRAUD_X4, SARE_FRAUD_X5,SARE_FRAUD_X6,SUBJ_ALL_CAPS,UPPERCASE_75_100,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [206.130.100.149 listed in b.barracudacentral.org] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.72 listed in zen.spamhaus.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9987] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.72 listed in psbl.surriel.com] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.72 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 0.3 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_46 BODY: 4alpha-pock-6alpha * 0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha * 1.6 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 1.5 UPPERCASE_75_100 message body is 75-100% uppercase * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from rovita-ks.com (rovita-ks.com [206.130.100.149]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3O8bGYZ024715 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 24 Apr 2009 01:37:21 -0700 Received: from User ([196.3.183.72]) (authenticated bits=0) by rovita-ks.com (8.13.1/8.13.1) with ESMTP id n3O61bAE016169; Fri, 24 Apr 2009 00:01:40 -0600 Message-Id: <200904240601.n3O61bAE016169@rovita-ks.com> Reply-To: From: "Janet Edward" Subject: [SPAM] DEAR BELOVED IN CHRIST Date: Fri, 24 Apr 2009 07:01:59 -0700 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 02:29:06 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 24 Apr 2009 01:37:21 -0700 (PDT) X-Spam-Prev-Subject: DEAR BELOVED IN CHRIST Status: R X-Status: X-Keywords: X-UID: 281 Content-Length: 4652
DEAR BELOVED IN CHRIST,
 
 
IT IS BY THE GRACE OF GOD THAT I RECEIVED CHRIST,KNOWING THE TRUTH AND THE TRUTH HAVE SET ME FREE.HAVING KNOWN THE TRUTH I HAD NO CHOICE THAN TO DO WHAT IS LAWFUL AND RIGHT IN THE SIGHT OF GOD FOR ETERNAL LIFE AND IN THE SIGHT OF MAN FOR WITNESS OF GODS MERCY AND GLORY UPON MY LIFE.
 
 
I AM MRS EDWARDS FROM USA.I AM MARRIED TO DR.MIKE EDWARDS WHO WORKED WITH CHEVRON/TEXACO IN NIGERIA FOR TWENTY YEARS BEFORE HE DIED IN THE YEAR 2002.WE WERE MARRIED FOR TWENTY-SEVEN YEARS WITHOUT A CHILD, HE DIED DURING ONE OF THE RIOTS IN THE NIGERIA .HE WAS HELD HOSTAGE AND SLAIN TO DEATH BY PROTESTING YOUTHS OF THE REGION IN EDO STATE BEFORE HIS DEATH WE WERE BOTH BORN AGAIN CHRISTIANS.
 
 
SINCE HIS DEATH I DECIDED NOT TO RE-MARRY.WHEN MY LATE HUSBAND WAS ALIVE HE DEPOSITED THE SUM OF (US18 MILLION) WITH A BANK IN THE CHINA AND NOW THE MANAGEMENT OF THE BANK HAVE JUST WROTE ME TO COME FORWARD TO RECEIVE THE MONEY OR RATHER ISSUE A LETTER OF AUTHORISATION TO SOMEBODY TO RECEIVE IT ON MY BEHALF IF I CAN NOT COME OVER BECAUSE OF MY CONDITION AT HAND.I AM PRESENTLY WITH MY LAPTOP IN A HOSPITAL WHERE I HAVE BEEN UNDERGOING TREATMENT FOR CANCER OF THE LUNGS, I HAVE SINCE LOST MY ABILITY TO TALK AND MY DOCTORS HAVE TOLD ME THAT I HAVE ONLY A FEW MONTHS TO LIVE.
 
 
IT IS MY LAST WISH TO SEE THAT THIS MONEY IS INVESTED AND AT THE END OF EVERY YEAR DISTRIBUTED AMONG CHARITY ORGANISATION. AND FOR YOUR COMPESATION, AS SOON AS THE MONEY ENTERS YOUR ACCOUNT TAKE 30%OF THE TOTAL MONEY, WHILE 70% WILL BE FOR THE WORK OF GOD.
 
 
I TOOK THIS DECISION BECAUSE I KNOW THAT THERE ARE ALOT OF POOR PEOPLE SUFFERING FROM DIFFERENT KIND OF DISEASE AND NOBODY TO COME TO THEIR AID.WITH GOD ALL THINGS ARE POSSIBLE. AS SOON AS I RECEIVE YOUR REPLY I SHALL GIVE YOU THE CONTACT OF THE BANK IN CHINA WERE THE MONEY IS BEEN DEPOSITED .I WILL ALSO ISSUE YOU A LETTER OF AUTHORITY AND CERTIFICATE OF CLAIM THAT WILL PROVE YOU AS THE NEW BENEFICIARY OF THIS FUND. GET BACK TO ME
 
 
I AWAIT YOUR URGENT REPLY.
 
 
YOURS IN CHRIST,
MRS. EDWARD.
 
 From bancoespirito@gmail.com Fri Apr 24 15:48:58 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=33.0 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,KAM_LOTTO1,LOTTO_AGENT, LOTTO_MANY,LOTTO_RANDOM,LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL,RDNS_NONE,SARE_LOTTO_SPAM,SPF_NEUTRAL, STOX_30,SUBJ_ALL_CAPS,Spoof_Port_URL,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [209.29.33.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 LOTTO_RANDOM BODY: Random selection * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [209.29.33.22 listed in psbl.surriel.com] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.5 Spoof_Port_URL URI with malformed port * 2.4 SARE_LOTTO_SPAM Lottery Spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from iowawebhosting.com ([209.29.33.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3OMmqjl017185 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Fri, 24 Apr 2009 15:48:58 -0700 Message-Id: <200904242248.n3OMmqjl017185@ga.impsec.org> Received: (qmail 27869 invoked from network); 24 Apr 2009 17:30:09 -0500 Received: from unknown (HELO User) (77.208.113.160) by z28camaro.com with SMTP; 24 Apr 2009 17:30:09 -0500 Reply-To: From: "LOTERIA ESPANA" Subject: [SPAM] CONGRATULATIONS !!! Date: Sat, 25 Apr 2009 00:29:55 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: CONGRATULATIONS !!! Status: R X-Status: X-Keywords: X-UID: 282 Content-Length: 1696 REF.NO.: ROEUSP7775553 BATCH NO: X8007891324Z, YOU HAVE WON We are pleased to inform you on the release of E-Lotto Internet Promotional Draws Jackpot held in Madrid Spain on the 4th of january of 2009. Your e-mail address , attached to the ticket number 3570146744224, with the serial number 51228-07, drew the lucky numbers of 1-M-M-0-0-M+1-0 which consequently won the lottery in the 3rd category. All email addresses entered for these promotional draws were randomly inputted from an internet resource database using the Synchronized Random Selection System (SRSS). You have therefore been approved for a lump sum payout of 1,500,000.00 (ONE MILLION FIVE HUNDRED THOUSAND EUROS) in cash credited to your file with the REF.NO:ROEUSP7775553 AND BATCH.NO: X8007891324Z, to be paid through BANK TRANSFER. Your winning prize is now deposited with a BANK insured with your REF.NO:ROEUSP7775553 for security reasons and will be released for payment by the order of the LOTTERY BOARD after the datas have been verified. We ask you to keep this award confidential and away from public notice until your claim has been processed and your cash remitted to you. The beneficiary is responsible for the remittance charge of the prize to his/her country. To claim your prize, please contact your claims agent below, and demand for your lottery claiming form. MRS ANA SANCHEZ BANCO ESPIRITO SANTO CTO.-PASEO ALAMEDA, 34/46023 VALENCIA ESPAA NIF G-5889999/8. " TEL.00 34.634.015.778 FAX.00 34.933.807.707 e-mail: bancoespiritosantosespana@mail.md SINCERELY JUAN FERNANDO HERNNDEZ (PRESIDENT) From info@scott.com Fri Apr 24 20:41:15 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.7 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, DNS_FROM_RFC_BOGUSMX,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_1,J_CHICKENPOX_62, LOTTO_YOU_WON_03,L_SOME_STD_PROBS,RAZOR2_CHECK,RCVD_IN_BRBL,RDNS_DYNAMIC, SUBJ_ALL_CAPS,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.210.72.147 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 1.5 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from ultra.genomeindia.org (210-210-72-147.lan.sify.net [210.210.72.147]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3P3f8CV025519 for ; Fri, 24 Apr 2009 20:41:15 -0700 Received: from localhost (localhost [127.0.0.1]) by ultra.genomeindia.org (Postfix) with ESMTP id 3C1E66DE1; Sat, 25 Apr 2009 06:12:13 +0530 (IST) Received: from ultra.genomeindia.org ([127.0.0.1]) by localhost (ultra [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 18755-01; Sat, 25 Apr 2009 06:11:39 +0530 (IST) Received: from www.genomeindia.org (localhost [127.0.0.1]) by ultra.genomeindia.org (Postfix) with ESMTP; Sat, 25 Apr 2009 06:11:38 +0530 (IST) From: "Stephen Scott" Reply-To: stephenppscott@yahoo.com.hk Subject: [SPAM] THIS IS FOR YOUR ATTENTION Date: Sat, 25 Apr 2009 07:10:47 +0630 Message-Id: <20090424212055.M62814@scott.com> X-Mailer: Open WebMail 2.50 20050114 X-OriginatingIP: 41.220.75.3 (aktpmb) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 X-Virus-Scanned: amavisd-new at domain.com To: undisclosed-recipients:; X-Greylist: Delayed for 01:42:43 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 24 Apr 2009 20:41:15 -0700 (PDT) X-Spam-Prev-Subject: THIS IS FOR YOUR ATTENTION Status: R X-Status: X-Keywords: X-UID: 283 Content-Length: 1048 THIS IS FOR YOUR ATTENTION I wish to notify you again that you were listed as a beneficiary to the total sum of 15,600,000.00GBP (Fifteen million Six hundred thousand British pounds)in the codicil and last testament of the deceased. (Name now withheld since this is our second letter to you).I contacted you because you bear the surname identity and therefore can present you as the beneficiary to the inheritance. I therefore reckoned that you can receive these funds as you are qualified by your name identity. All the legal papers will be processed in your acceptance. In your acceptance of this deal, I request that you kindly forward to me your letter of acceptance; your current telephone and fax numbers and a forwarding address to enable us file necessary documents at our high court probate division for the release of this sum of money. You are entitle to 50% of this money while i will also take 50% Get back to me with the following contact mail address [stephenppscott@yahoo.com.hk] Yours faithfully, Stephen Scott From gene.genegene.dorado27@gmail.com Sat Apr 25 11:49:48 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************************** X-Spam-Status: Yes, score=28.3 required=5.0 tests=ADVANCE_FEE_2,BAYES_50, BL_COUNTRY_NG_2,DATE_IN_PAST_24_48,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML, FORGED_OUTLOOK_TAGS,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_44,J_CHICKENPOX_57, J_CHICKENPOX_63,L_SOME_STD_PROBS,MIME_HTML_ONLY,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,RCVD_IN_SORBS_WEB,SPF_NEUTRAL,STOX_30, US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.73 listed in zen.spamhaus.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.73 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 1.2 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5003] * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from fallback.edevote.nl (worldwebmedia4.nl [213.193.237.69]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3PInim1018352 for ; Sat, 25 Apr 2009 11:49:48 -0700 Message-Id: <200904251849.n3PInim1018352@ga.impsec.org> Received: from UnknownHost [196.3.183.73] by fallback.edevote.nl with SMTP; Sat, 25 Apr 2009 18:37:29 +0200 Reply-To: From: "Gene L. Dodaro" Subject: [SPAM] The U.S. Government Accountability Office (GAO) ....Stimulus Relief ....ATM CARD Date: Fri, 24 Apr 2009 09:33:07 -0700 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:24:55 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 25 Apr 2009 11:49:48 -0700 (PDT) X-Spam-Prev-Subject: The U.S. Government Accountability Office (GAO) ....Stimulus Relief ....ATM CARD Status: R X-Status: X-Keywords: X-UID: 284 Content-Length: 4165 The U.S. Government Accountability Office (GAO) Gene L. Dodaro GAO Anti Fraud Dept 441 G Street NW Mail Stop 4T21 Washington, DC 20548 The U.S. Government Accountability Office (GAO) Our Work is done at the request of congressional committees or subcommittees or is mandated by public laws or committee reports. We also undertake research under the authority of the Controller General. We support congressional oversight by 1, auditing agency operations to determine whether federal funds are being spent efficiently and effectively; 2, investigating allegations of illegal and improper activities; 3, reporting on how well government programs and policies are meeting their objectives; 4, performing policy analysis and outlining options for congressional consideration; and 5, issuing legal decisions and opinions, such as bid protest rulings and reports on agency rules. We advise Congress and the heads of executive agencies about ways to make government more efficient, effective, ethical, equitable and responsive. Our work leads to laws and acts that improve government operations, saving the government and tax payers billions of dollars. This is to officially inform you that it has come to our notice and we have thoroughly investigated with the help of our Intelligence Monitoring Network System that you are having an illegal Transaction with Impostors claiming to be FEDERAL BUREAU OF INVESTIGATION. During our Investigation, we noticed that the reason why you have not received your payment is because you are dealing with the wrong person in respect of your Contract/Inheritance Payment. Just this month we recover some amount from fraudulent people in Nigeria with the help of the new government in Nigeria and the total money recover was $11,000.000.00 in which the Nigeria government decided to give away the money to an American ,Australia, Asia, European, Canada,New Zealand ,Citizen ith correct social security details as a compensation, either unemployed/employed as in accordance with the new president of America permission as an External Stimulus Relief ,your name and address came out and we the U.S. Government Accountability Office (GAO) decided to contact in regards to your claims. Therefore, we have contacted the Federal Ministry Of Finance on your behalf and they have brought a solution to your problem by coordinating your payment in total USD$11,000.000.00 in an ATM CARD which you can use to withdraw money from any ATM MACHINE CENTER anywhere in the world with a maximum of $4000 to $5000 United States Dollars daily. You now have the lawful right to claim your fund in an ATM CARD. Since the U.S. Government Accountability Office (GAO) is involved in this transaction, you have to be rest assured for this is 100% risk free it is our duty to protect the American Citizens. All I want you to do is to contact the ATM CARD CENTER via email or by phone for their requirements to proceed and procure your Approval Slip on your behalf while the shipment of the ATM CARD is been taken care of by GAO office . CONTACT INFORMATION NAME: MR. Ebi Micheal EMAIL:ebimicheal@aol.com TELEPHONE:234-805229420 BANK:AFRI BANK PLC 22,RANDLE ROAD VICTORIA ISLAND LAGOS,NIGERIA Do contact Mr. Ebi Micheal of the ATM CARD CENTRE with your details and reconfirmed you information FULL NAME: HOME ADDRESS: TELL: CELL: BANK NAME: AGE: CURRENT OCCUPATION: We order you get back to this office after you have contacted the ATM SWIFT CARD CENTER and we do await your response so we can move on with our Investigation and make sure your ATM SWIFT CARD gets to you. Thanks and hope to read from you soon. The U.S. Government Accountability Office (GAO) Gene L. Dodaro GAO Fraud NET 441 G Street NW Mail Stop 4T21 Washington, DC 20548 Note: Do disregard any email you get from any impostors or offices claiming to be in possession of your ATM CARD, you are hereby advice only to be in contact with Mr.Ebi Micheal of the ATM CARD CENTRE who is the rightful person to deal with in regards to your ATM CARD PAYMENT and forward any emails you get from impostors to this office so we could act upon and commence investigation. From chrisv@sns.nl Sat Apr 25 15:58:29 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.2 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FREEMAIL_FORGED,J_CHICKENPOX_44,MILLIONS_01,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RCVD_IN_BRBL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [161.58.206.227 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9997] * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.207.246.86 listed in dnsbl.sorbs.net] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from tama36.securemail19.com (tama36.securemail19.com [161.58.206.227]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3PMwN2k025766 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 25 Apr 2009 15:58:29 -0700 Received: from User ([196.207.246.86]) (authenticated bits=0) by tama36.securemail19.com (8.13.6.20060614/8.13.6) with ESMTP id n3PIcMFm040174; Sat, 25 Apr 2009 18:38:29 GMT Message-Id: <200904251838.n3PIcMFm040174@tama36.securemail19.com> Reply-To: From: "SNS Bank N.V" To: chrisvnl@rediffmail.com Subject: [SPAM] Kindly attend to this Date: Sat, 25 Apr 2009 19:39:05 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 04:18:24 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 25 Apr 2009 15:58:29 -0700 (PDT) X-Spam-Prev-Subject: Kindly attend to this Status: R X-Status: X-Keywords: X-UID: 285 Content-Length: 1479 REFERENCE: SNS/097836578/09/NL KINDLY ATTEND TO THIS. This to inform you that my previous mail was not responded to and do not know what your non response mean. Our search revealed your last name to be same with a customer of the SNS Bank whose account balance at time of death was several millions of dollars .The benefits from this account have not been paid for reason of no listed beneficiary or heir as at this moment of contacting you. In view of this and my post as the head of Compensation and Benefits of my bank,your last name can be accepted for a heir to this huge amount of money. You needless worry about the legal requirements of this claim as you shall be closely guided and directed on this. This is a very sensitive issue that must be treated with caution.It is in the best best interest of successful claim that you keep this to yourself unless advised otherwise. Further details will be sent to you as soon as you signify your interest with your prompt response. Thank you. Sincerely yours Chris V CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. Going contrary to this warning may be unlawful. From moresadv@onda.com.br Sat Apr 25 19:00:54 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.5 required=5.0 tests=BAYES_60,BL_COUNTRY_BR_1, DATE_IN_PAST_12_24,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,MILLIONS_01, MSOE_MID_WRONG_CASE,NA_DOLLARS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,SPF_PASS,STOX_30 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [195.226.120.107 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [195.226.120.107 listed in psbl.surriel.com] * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.6656] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 76] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 76] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from maresia.onda.com.br (maresia.onda.com.br [200.195.199.6]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3Q20nWv031359 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 25 Apr 2009 19:00:54 -0700 Received: from User (unknown [195.226.120.107]) by maresia.onda.com.br (Postfix) with ESMTP id CA4393D8B61; Sat, 25 Apr 2009 22:42:17 -0300 (BRT) Reply-To: From: "Johnson Watts" Subject: [SPAM] Thanks For Accomodating Our Inquiry Date: Sat, 25 Apr 2009 03:41:25 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090426014218.CA4393D8B61@maresia.onda.com.br> To: undisclosed-recipients:; X-Greylist: Delayed for 00:17:08 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 25 Apr 2009 19:00:54 -0700 (PDT) X-Spam-Prev-Subject: Thanks For Accomodating Our Inquiry Status: R X-Status: X-Keywords: X-UID: 286 Content-Length: 1946 Sir/Madam I am aware that this is an unconventional way of relaying an important message such as this. I did try without success to locate both your contact address or fax number and as such, I resorted in contacting you via email. Greetings from Me, Mr. Johnson Watts, an associate partner in the firm of Jw Consults Inc, in Nottingham, United Kingdom; we are a Private Investigators, Security Consultants and Financial Managers. We are conducting a standard process investigation/Recommendation on behalf of African Development Bank Group (ADB), The African Investment Banking Conglomerate in conjunction with standard Bank International London thus will be referred to as our clients. This investigation involves an account holder (Name Withheld) who bears same surname with you and the circumstances surrounding his investments at ADB Invest Account, the Investment Banking arm of African Development Bank Group. The ADB Private Investment client died intestate and nominated no successor in title over his investments made at the bank amounting to over SEVEN MILLION US Dollars (7,000,000.00). The essence of this communication with you is to request that you provide us information/comments on any or all of the four issues as regards nominating you to inherit the fund left behind by this client. Your answers and response(s) to the questions that will be raised in your response will determine our recommendation to the ADB towards legally appointing you to inherit this investment fund after certified investigation has yielded results showing that there are no known relation of the deceased client. You must appreciate that we are constrained from providing you with more detailed information at this point. We will provide you with additional information upon receipt of your response. Thank you for accommodating our inquiry. Mr. Johnson Watts For: JW Consults Inc. Foxhall Business Centre Nottingham. NG7 6LH United Kingdom From bancoespirito@gmail.com Sun Apr 26 07:51:19 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.5 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2,KAM_LOTTO1,LOTTO_AGENT, LOTTO_MANY,LOTTO_RANDOM,LOTTO_WINNINGS,LOTTO_WIN_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RBL_PSBL_01,RCVD_IN_BRBL,RDNS_NONE,SARE_LOTTO_SPAM,SPF_NEUTRAL,STOX_30, SUBJ_ALL_CAPS,Spoof_Port_URL,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [209.29.33.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [209.29.33.22 listed in psbl.surriel.com] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 LOTTO_RANDOM BODY: Random selection * 1.0 LOTTO_WINNINGS BODY: Claim your winnings * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.5 Spoof_Port_URL URI with malformed port * 2.4 SARE_LOTTO_SPAM Lottery Spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from iowawebhosting.com ([209.29.33.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3QEpFGd022975 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sun, 26 Apr 2009 07:51:19 -0700 Message-Id: <200904261451.n3QEpFGd022975@ga.impsec.org> Received: (qmail 1474 invoked from network); 25 Apr 2009 18:16:23 -0500 Received: from unknown (HELO User) (77.208.113.160) by sacredheartwdm.org with SMTP; 25 Apr 2009 18:16:23 -0500 Reply-To: From: "LOTERIA ESPANA" Subject: [SPAM] CONGRATULATIONS !!! Date: Sun, 26 Apr 2009 01:15:23 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: CONGRATULATIONS !!! Status: R X-Status: X-Keywords: X-UID: 287 Content-Length: 1748 REF.NO.: ROEUSP7775553 BATCH NO: X8007891324Z, YOU HAVE WON (Change of e-mail: bancoespiritosanto@strompost.com) We are pleased to inform you on the release of E-Lotto Internet Promotional Draws Jackpot held in Madrid Spain on the 4th of january of 2009. Your e-mail address , attached to the ticket number 3570146744224, with the serial number 51228-07, drew the lucky numbers of 1-M-M-0-0-M+1-0 which consequently won the lottery in the 3rd category. All email addresses entered for these promotional draws were randomly inputted from an internet resource database using the Synchronized Random Selection System (SRSS). You have therefore been approved for a lump sum payout of 1,500,000.00 (ONE MILLION FIVE HUNDRED THOUSAND EUROS) in cash credited to your file with the REF.NO:ROEUSP7775553 AND BATCH.NO: X8007891324Z, to be paid through BANK TRANSFER. Your winning prize is now deposited with a BANK insured with your REF.NO:ROEUSP7775553 for security reasons and will be released for payment by the order of the LOTTERY BOARD after the datas have been verified. We ask you to keep this award confidential and away from public notice until your claim has been processed and your cash remitted to you. The beneficiary is responsible for the remittance charge of the prize to his/her country. To claim your prize, please contact your claims agent below, and demand for your lottery claiming form. MRS ANA SANCHEZ BANCO ESPIRITO SANTO CTO.-PASEO ALAMEDA, 34/46023 VALENCIA ESPAA NIF G-5889999/8. " TEL.00 34.634.015.778 FAX.00 34.933.807.707 e-mail: bancoespiritosanto@strompost.com SINCERELY JUAN FERNANDO HERNNDEZ (PRESIDENT) From moresadv@onda.com.br Sun Apr 26 12:19:21 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.1 required=5.0 tests=BAYES_60,BL_COUNTRY_BR_1, DATE_IN_PAST_12_24,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,MILLIONS_01, MSOE_MID_WRONG_CASE,NA_DOLLARS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,SPF_PASS,STOX_30,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [195.226.120.107 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [195.226.120.107 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.6409] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from maresia.onda.com.br (maresia.onda.com.br [200.195.199.6]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3QJJFr4030197 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 26 Apr 2009 12:19:21 -0700 Received: from User (unknown [195.226.120.107]) by maresia.onda.com.br (Postfix) with ESMTP id EDC6D3D8AB9; Sun, 26 Apr 2009 16:18:02 -0300 (BRT) Reply-To: From: "Johnson Watts" Subject: [SPAM] Just Making Inquiry Date: Sat, 25 Apr 2009 21:16:57 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090426191802.EDC6D3D8AB9@maresia.onda.com.br> To: undisclosed-recipients:; X-Spam-Prev-Subject: Just Making Inquiry Status: R X-Status: X-Keywords: X-UID: 288 Content-Length: 2663 Sir/Madam I am aware that this is an unconventional way of relaying an important message such as this. I did try without success to locate both your contact address or fax number and as such, I resorted in contacting you via email. Greetings from Me, Mr. Johnson Ward, an associate partner in the firm of Jw Consults Inc, in Nottingham, United Kingdom; we are a Private Investigators, Security Consultants and Financial Managers. We are conducting a standard process investigation/Recommendation on behalf of African Development Bank Group (ADB), The African Investment Banking Conglomerate in conjunction with standard Bank International London thus will be referred to as our clients. This investigation involves an account holder (Name Withheld) who bears same surname with you and the circumstances surrounding his investments at ADB Invest Account, the Investment Banking arm of African Development Bank Group. The ADB Private Investment client died intestate and nominated no successor in title over his investments made at the bank amounting to over SEVEN MILLION US Dollars ($7,000,000.00). The essence of this communication with you is to request that you provide us information/comments on any or all of the four issues as regards nominating you to inherit the fund left behind by this client. Your answers and response(s) to the questions raised below will determine our recommendation to the ADB towards legally appointing you to inherit this investment fund after certified investigation has yielded results showing that there are no known relation of the deceased client. 1-Are you aware of any relative/relation born on the 2nd of February 1951, who bears your same surname whose last known contact address was Angola, in Southern Africa? 2-Are you aware of any investment of considerable value made by such a person at the Investment Banking Division of ADB Bank Group? 3-Can you confirm your willingness to accept this inheritance if you are legally and legitimately appointed. 4-Would you agree to donate part of this inheritance to charity if you are officially approved to stand as the inheritor? It is pertinent that you inform us ASAP whether or not you are familiar with this personality or and your interest towards the issues mentioned. You must appreciate that we are constrained from providing you with more detailed information at this point. We will provide you with additional information upon receipt of your response. Thank you for accommodating our inquiry. Mr. Johnson Ward For: JW Consults Inc. Foxhall Business Centre Nottingham. NG7 6LH United Kingdom From cbnclaim1@sify.com Mon Apr 27 02:41:40 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************ X-Spam-Status: Yes, score=36.1 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_37, J_CHICKENPOX_42,J_CHICKENPOX_52,J_CHICKENPOX_82,L_SOME_STD_PROBS,MILLIONS_01, MILLION_USD,MISSING_HEADERS,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FREE_WEBM_ZCom01,SPF_HELO_PASS, STOX_30,SUBJ_ALL_CAPS,UPPERCASE_75_100,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.6 SARE_FREE_WEBM_ZCom01 Sender used free email account - may be * spammer * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 1.5 UPPERCASE_75_100 message body is 75-100% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from aasteppingstone.com (mail.aasteppingstone.com [69.28.126.226]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3R9faUP019654 for ; Mon, 27 Apr 2009 02:41:40 -0700 Received: from User ([41.222.69.120] RDNS failed) by aasteppingstone.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 25 Apr 2009 09:38:28 -0700 Reply-To: From: "CENTRAL BANK" Subject: [SPAM] FROM CBN,PAYMENT CODE (FG29) Date: Sat, 25 Apr 2009 17:38:26 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 25 Apr 2009 16:38:29.0301 (UTC) FILETIME=[43789E50:01C9C5C4] X-Greylist: Delayed for 12:22:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 27 Apr 2009 02:41:40 -0700 (PDT) X-Spam-Prev-Subject: FROM CBN,PAYMENT CODE (FG29) Status: R X-Status: X-Keywords: X-UID: 289 Content-Length: 2788 CENTRAL BANK OF NIGERIA (CBN). CORPORATE HEADQUARTERS: CBN HOUSE, TINUBU SQUARE, ELEKE CRESCENT-VICTORIA ISLAND MARINA LAGOS NIGERIA, WEST AFRICA. P.O.BOX 55037 FALOMO IKOYI LAGOS ISLAND MARINA. TEL: +234 1 4530551 FAX: +234 1 7244914 FROM THE DESK OF: MR. AFOLABI OJO. DIRECTOR FOREIGN OPERATIONS, PAYMENT CODE (FG29) DATE: 25/4/2009 ATTENTION: BENEFICIARY, THIS IS TO NOTIFY YOU THAT YOUR OVER DUE INHERITANCE/CONTRACT FUNDS HAS BEENGAZETTED TO BE RELEASED, VIA KEY TELEX TRANSFER (KTT) -DIRECT WIRE TRANSFER TOYOU OR THROUGH ANY OF OUR CORRESPONDENT NOMINATED BANK,BY THE SENATE FOR FOREIGNOVER DUE FUND TRANSFER. MEANWHILE, A WOMAN CAME TO MY OFFICE FEW DAYS AGO WITH A LETTER, CLAIMING TO BEYOUR TRUE REPRESENTATIVE. HERE ARE HER INFORMATIONS FOR YOU TO CONFIRM TO THISOFFICE IF THIS WOMAN IS TRULY FROM YOU OR NOT SO THAT THE FEDERAL GOVERNMENTWILL NOT BE HELD RESPONSIBLE FOR PAYING INTO ANY WRONG ACCOUNTS. CLAIMS NAME: JANET WHITE, BANK NAME: CITI BANK ARIZONA, USA. ACCOUNT NUMBER: 6503809428. PLEASE, DORECONFIRM TO THIS OFFICE, AS A MATTER OF URGENCY IF THIS WOMAN IS FROM YOU. YOU ARE REQUESTED TO FILL AND SEND THIS INFORMATION FOR VERIFICATIONS PURPOSES SO THAT YOUR FUND VALID US$7.5M (SEVEN MILLION, FIVE HUNDRED THOUSAND UNITED STATE DOLLARS) WILL BE REMITTED INTO YOUR NOMINATED BANK ACCOUNT ANYWHERE. THIS FUND IS AS A RESULT OF NHERITANCE/CONTRACT ON YOUR BEHALF. INFORMATION NEEDED FROM YOU FOR VERIFICATION IS AS FOLLOWS: 1. YOUR NAME:.......................... 2. YOUR FULL ADDRESS................... 3. YOUR MOBILE PHONE NUMBER:........... 4. FAX NUMBER:......................... 5. AGE................................. 6. SEX:................................ 7. YOUR OCCUPATION:.................... 8. YOUR BANKING DETAILS: 9. ANY SCANNED COPY OF YOUR IDENTITY:..(NECESSARY). AS SOON AS WE RECEIVE THESE INFORMATIONS, WE WILL COMMENCE WITH ALL NECESSARYPROCEDURES IN OTHER TO REMIT THIS MONEY INTO YOUR ACCOUNT. THE CENTRAL BANK GOVERNOR,IN CONJUNCTION WITH THE FEDERALMINISTRY OF FINANCE (FMF) EXECUTIVEBOARD OF DIRECTORS AND THE SENATECOMMITTEE FOR FOREIGN OVER DUE INHERITANCE/CONTRACTFUND HAVE APPROVED ANDACCREDITED THIS REPUTABLE BANK WITH THE OFFICE OF THE DIRECTOR, INTERNATIONALREMITTANCE/FOREIGN OPERATIONS, TOHANDLE AND TRANSFER ALL FOREIGNINHERITANCE/CONTRACT FUNDS THIS FIRST FISCAL PAYMENT OF THE YEAR 2009. HOWEVER, WE SHALL PROCEED TO ISSUE ALL PAYMENTS DETAILS TO THE SAID MRS.WHITE,IF WE DO NOT HEAR FROM YOU WITHIN THE NEXT SEVEN WORKING DAYS FROM TODAY.WE ARESORRY FOR ANY INCONVENIENCE THE DELAY IN TRANSFERRING OF THISFUND MUST HAVECAUSED YOU. CONGRATULATIONS. MR. AFOLABI OJO, FOREIGN OPERATION DEPARTMENT CENTRAL BANK OF NIGERIA (CBN). CC: SENATE PRESIDENT CC: BOARD OF DIRECTORS (B.O.D) CC: ACCOUNTANTGENERAL OF NIGERIA. From westcliff_88@msn.com Mon Apr 27 06:23:32 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************* X-Spam-Status: Yes, score=13.9 required=5.0 tests=BAYES_99,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_MESSAGE,LOTTO_YOU_WON_02,MISSING_HEADERS, MISSING_SUBJECT,RBL_POXLAY_01,SPF_PASS,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.243.132.249 listed in dnsbl.sorbs.net] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.8 MISSING_SUBJECT Missing Subject: header * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from blu0-omc3-s15.blu0.hotmail.com (blu0-omc3-s15.blu0.hotmail.com [65.55.116.90]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3RDNSWG025798 for ; Mon, 27 Apr 2009 06:23:32 -0700 Received: from BLU129-W28 ([65.55.116.72]) by blu0-omc3-s15.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 27 Apr 2009 06:07:03 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_d8683dd3-2580-40bf-8855-c49ef611f5dc_" X-Originating-IP: [41.243.132.249] Reply-To: From: WEST CLIFF Subject: [SPAM] Date: Mon, 27 Apr 2009 13:07:03 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 27 Apr 2009 13:07:03.0918 (UTC) FILETIME=[0F3848E0:01C9C739] X-Greylist: Delayed for 00:16:24 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 27 Apr 2009 06:23:32 -0700 (PDT) X-Spam-Prev-Subject: Status: R X-Status: X-Keywords: X-UID: 290 Content-Length: 2706 --_d8683dd3-2580-40bf-8855-c49ef611f5dc_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable The WEST CLIFF CASINO BOARD International promotion UNITED KINGDOM program = is proud to inform you that you have just won Two Million British Pounds (= =A32=2C000=2C000=2C 00) However no previous notification is given before yo= ur email address was picked for this lottery.=20 =20 To file for your claim=2C please contact our financial agent: ACTIVE FINANCE LIMITED:=20 Mr.FRANK TERRY Email:westcliff_c01@yahoo.com.hk APPLICATION FOR PRIZE CLAIM (Receipt Official Notification Letter) ---------------------------------------------------------------------- [FULL NAME OF WINNER] [FULL MAILING ADDRESS] [COUNTRY/ REGION] [STATE/ PROVINCE] [DATE OF BIRTH]=20 [SEX] [MARITAL STATUS] =20 [OCCUPATION]=20 [CURRENT E-MAIL]=20 [TEL HOME] [CELLPHONE NUMBER] [FAX] =20 Congratulations!!! Best Regards=2C Rose Mary Joe (Mrs.) (Group Coordinator) --_d8683dd3-2580-40bf-8855-c49ef611f5dc_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable The WEST CLIFF CASINO BOARD International promotion UNITED KING= DOM program is proud to inform you that you have just won Two Million Briti= sh Pounds (=A32=2C000=2C000=2C 00) However no previous notification is give= n before your email address was picked for this lottery.
 =3B
To= file for your claim=2C please contact our financial agent:
ACTIVE FINAN= CE LIMITED:
Mr.FRANK TERRY
Email:westcliff_c01@yahoo= .com.hk
APPLICATION FOR PRIZE CLAIM (Receipt Official Noti= fication Letter)
-------------------------------------------------------= ---------------
[FULL NAME OF WINNER]
[FULL MAILING ADDRESS]
[COUN= TRY/ REGION]
[STATE/ PROVINCE]
[DATE OF BIRTH]
[SEX]
[MARITAL = STATUS] =3B
[OCCUPATION]
[CURRENT E-MAIL]
[TEL HOME]
[CE= LLPHONE NUMBER]
[FAX]
 =3B
Congratulations!!!
Best Regards= =2C
Rose Mary Joe (Mrs.)
(Group Coordinator)
= --_d8683dd3-2580-40bf-8855-c49ef611f5dc_-- From 15william@zing.vn Mon Apr 27 12:12:54 2009 Return-Path: <15william@zing.vn> X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.9 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FROM_EXCESS_BASE64,HTML_MESSAGE,L_SOME_STD_PROBS, RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_PASS,STOX_30, US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [118.102.6.5 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9995] * -0.0 SPF_PASS SPF: sender matches SPF record * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.5 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtpbg1.zing.vn (smtpbg1.zing.vn [118.102.6.5]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n3RJ6n4Q002439 for ; Mon, 27 Apr 2009 12:11:50 -0700 X-QQ-ThreadID: wZ2IbJD5Yh,1 X-QQ-mid: webmail1124085810365821022 X-QQ-STYLE: From: "=?utf-8?B?d2lsbGlhbXM=?=" <15william@zing.vn> To: Sender: 15william@zing.vn Subject: [SPAM] Dear Respectful One, Mime-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="----=_NextPart_49F5FDF6_084654B0_14D034D2" Content-Transfer-Encoding: 8Bit Date: Tue, 28 Apr 2009 01:48:22 +0700 X-Priority: 3 Message-ID: X-QQ-MIME: TCMime 1.0 by Tencent X-Mailer: QQMail 2.x X-QQ-Mailer: QQMail 2.x X-Spam-Prev-Subject: Dear Respectful One, Status: R X-Status: X-Keywords: X-UID: 291 Content-Length: 11083 This is a multi-part message in MIME format. ------=_NextPart_49F5FDF6_084654B0_14D034D2 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RGVhciBSZXNwZWN0ZnVsIE9uZSwNCiAgDQogUGxlYXNlIHlvdSBjYW4gY29udGFjdGUgbWUg d2l0aCBteSBwcml2YXRlIGVtYWlsIGFkZHJlc3Mod2kyaWxsaWFtc19kYXZpZEB5YWhvby5j by5qcCkgDQogIA0KIE91ciByZWFzb24gb2YgY29udGFjdGluZyB5b3UgaXMgcHVyZWx5IGJh c2VkIG9uIHNlZWtpbmcgeW91ciBhc3Npc3RhbmNlLiBUbyB0ZWxsIHlvdSBtb3JlIGFib3V0 IHVzLCBvdXIgbmFtZXMgYXJlIFdpbGxpYW1zIERhdmlkIGFuZCBTYXJhaCBEYXZpZC4gSSBh bSAyMiB5ZWFycyBvbGQgd2hpbGUgbXkgeW91bmdlciBzaXN0ZXIgaXMgMTkgeWVhcnMgb2xk IHdlIGFyZSB0aGUgY2hpbGRyZW4gb2YgbGF0ZSBNciBhbmQgTXJzIERvbmFsZCBEYXZpZCBh bmQgd2UgYXJlIGxpdmluZyBoZXJlIGluIEFiaWRqYW4sIHRoZSBjYXBpdGFsIGNpdHkgb2Yg Q290ZSBk44O7SXZvaXJlIGluIFdlc3QgQWZyaWNhLg0KIA0KSSBhbSBhIHN0dWRlbnQgc3R1 ZHlpbmcgbWFzcyBjb21tdW5pY2F0aW9uIGJ1dCB0aGUgc3VkZGVuIGRlYXRoIG9mIG91ciBm YXRoZXIuIEkgZm9yY2VkIG15c2VsZiB0byBkaXNjb250aW51ZSBteSBzdHVkaWVzIGJlY2F1 c2Ugbm8gb25lIGNvdWxkIHNwb25zb3IgbXkgc3R1ZGllcyBhZ2Fpbi4gTXkgbW90aGVyIGRp ZWQgbWFueSB5ZWFycyBiYWNrIHdoZW4gSSB3YXMganVzdCA4IHllYXJzIG9sZCBhbmQgc2lu Y2UgdGhlbiBJIGFuZCBteSB5b3VuZ2VyIHNpc3RlciBoYXZlIGJlZW4gd2l0aCBteSBmYXRo ZXIgYW5kIGhlIHRvb2sgbWUgc28gc3BlY2lhbCBhcyB0aGUgb25seSBzb24uDQpIaXMgZGVh dGggd2FzIHNvIHN1ZGRlbiBhbmQgd2FzIGNhdXNlZCBieSBmb29kIHBvaXNvbmluZyBhcyB0 aGUgZG9jdG9yIHNhaWQgaW4gaGlzIGRlYXRoIGNlcnRpZmljYXRlIGJ1dCB3ZSBhcmUgc3Vz cGVjdGluZyBvbmUgb2YgbXkgdW5jbGUgd2hvIGFsd2F5cyB0cmF2ZWwgd2l0aCBoaW0gYW55 IHRpbWUgaGUgaXMgbWFraW5nIG92ZXJzZWFzIHRyaXAgYXMgdGhlIHBlcnNvbiB3aG8gcGxh bm5lZCBoaXMgZGVhdGgsIHdlbGwgb25seSBHb2Qga25vd3MgdGhlIHRydXRoLg0KDQpUaGUg aXNzdWUgbm93IGlzIHRoYXQgSSBhbmQgbXkgeW91bmdlciBzaXN0ZXIgd2FudCB0byBtb3Zl IG91dCBvZiB0aGlzIGNvdW50cnkgaW1tZWRpYXRlbHkgdG8gYSBtb3JlIHNlY3VyZSBwbGFj ZSB3aGVyZSB3ZSB3aWxsIGxpdmUgZm9yIHRoZSByZXN0IG9mIG91ciBsaWZlIGJlY2F1c2Ug c2luY2UgdGhlIGRlYXRoIG9mIG91ciBmYXRoZXIsIGhpcyBicm90aGVy55e0IGFuZCBvdGhl ciBmYW1pbHkgcmVsYXRpdmVzIGhhdmUgYWxsIHRha2VuIG92ZXIgYWxsIG15IGxhdGUgZmF0 aGVy55e0IGJlbG9uZ2luZ3MgaW5jbHVkaW5nIGhpcyBidXNpbmVzcyBhbmQgaG91c2VzIGFu ZCB0aGV5IGRvbueomiBldmVuIHdhbnQgdG8gY29uc2lkZXIgbWUgYW5kIG15IHlvdW5nZXIg c2lzdGVyLg0KDQpJbiBteSBvd24gY2FzZSwgbXkgZmF0aGVyIHdhcyBhIGJ1c2luZXNzIG1h biB3aG8gYWx3YXlzIGV4cG9ydCBDb2NvYSB0byBFdXJvcGUgYW5kIGhlIG1hZGUgYSBsb3Qg b2YgbW9uZXkgZnJvbSB0aGlzIGJ1c2luZXNzIGFuZCBvd24gbG90IG9mIHByb3BlcnRpZXMg YW5kIGhvdXNlcywgaGlzIGJyb3RoZXJzIGhhdmUgdGFrZW4gY29udHJvbCBvZiBhbGwgdGhl c2UgdGhpbmdzIGFuZCB0aGV5IGNhbiBldmVuIGtpbGwgbWUgdG9vIGlmIEkgc2hvdWxkIGFz ayBhYm91dCB0aGVtLiBGb3IgdGhpcyByZWFzb24sIEkgZG9u56iaIHdhbnQgdG8gYmUgYXNz b2NpYXRlZCB3aXRoIHRoZW0gYWdhaW4uDQpIb3dldmVyLCBteSBmYXRoZXIgY29uZmlkZWQg YSBzZWNyZXQgdG8gbWUgYmVmb3JlIGhpcyBkZWF0aCBpbiBhIGhvc3BpdGFsIGhlcmUuIEhl IHRvbGQgbWUgdGhhdCBoZSBkZXBvc2l0ZWQgYSBjb25zaWdubWVudCBpbiBhIHNlY3VyaXR5 IGNvbXBhbnkgaGVyZSBpbiBBYmlkamFuIENvdGUgRCBJdm9pcmUsIGEgVHJ1bmsgYm94IGNv bnRhaW5pbmcgdGhlIHN1bSBvZiAoJDE0LDMwMCwwMDApLiBhbmQgbm8gb25lIGtub3dzIGFi b3V0IHRoaXMsIG5vdCBldmVuIHRoZSBzZWN1cml0eSBjb21wYW55IGJlY2F1c2UgaGUgcmVn aXN0ZXJlZCB0aGUgY29udGVudCBvZiB0aGUgYm94IGFzIEZhbWlseSBWYWx1YWJsZXMuDQpI ZSBhbHNvIHRvbGQgbWUgdGhhdCBoZSB1c2VkIG15IG5hbWUgKHdpbGxpYW1zIGRhdmlkKSBh cyB0aGUgbmV4dCBvZiBraW4gaW4gZGVwb3NpdGluZyB0aGUgdHJ1bmsgYm94IGNvbnRhaW5p bmcgdGhlIG1vbmV5IGFuZCBhbHNvIGhhbmRlZCBvdmVyIHRoZSBkZXBvc2l0b3J5IGRvY3Vt ZW50cyB0byBtZS4gSGUgdG9sZCBtZSB0aGF0IGl0IHdhcyBiZWNhdXNlIG9mIGhpcyB3ZWFs dGggdGhhdCBoZSB3YXMgcG9pc29uZWQgYW5kIHRoYXQgSSBzaG91bGQgc2VlayBhIHRydXN0 d29ydGh5IHBlcnNvbiBpbiBhIGNvdW50cnkgb2YgbXkgY2hvaWNlIHdobyBjb3VsZCBhc3Np c3QgbWUgdG8gY2xhaW0gYW5kIGludmVzdCB0aGlzIG1vbmV5Lg0KIERlYXIgQmVsb3ZlZCBP bmUsIHRoaXMgaXMgdGhlIG1haW4gcmVhc29uIEkgY29udGFjdGVkIHlvdS4gSSB3YW50IHlv dSB0byBoZWxwIG1lIGNsYWltIHRoaXMgY29uc2lnbm1lbnQvdHJ1bmsgYm94IChDQVNIKSBm cm9tIHRoZSBzZWN1cml0eSBjb21wYW55IGhlcmUgaW4gQWJpZGphbiBDb3RlIEQnSXZvaXJl IHRvIHlvdXIgY291bnRyeSBhbmQgYWxzbyBoZWxwIG1lIGFuZCBteSB5b3VuZ2VyIHNpc3Rl ciB0byByZWxvY2F0ZSB0byB5b3VyIGNvdW50cnkgdG8gY29udGludWUgb3VyIGxpZmUgb3Zl ciB0aGVyZS4NCg0KIFRoaXMgY291bnRyeSBpcyBubyBsb25nZXIgc2FmZSBmb3IgbXkgY29u dGludWFsIHN0YXkgYmVjYXVzZSBldmVyeSBkYXkgaGVyZSBJIGFtIGxpdmluZyB1bmRlciB0 aGUgZmVhciBvZiB0aG9zZSBteSBsYXRlIGZhdGhlcueXtCByZWxhdGl2ZXMuIFdlIGFyZSBu byBsb25nZXIgbGl2aW5nIGluIG91ciBmYW1pbHkgaG91c2UgYmVjYXVzZSB0aGV5IG1pZ2h0 IHRyeSB0byBraWxsIHVzIHNpbmNlIHRoZXkgd2FudCB0byBpbmhlcml0IGFsbCBteSBsYXRl IGZhdGhlcueXtCBwcm9wZXJ0aWVzLiBJIGFtIG5vdyBsaXZpbmcgaW4gYSBndWVzdCBob3Vz ZSBoZXJlIGFuZCBJIHdhbnQgdG8gbW92ZSBvdXQgb2YgdGhlIGNvdW50cnkNCmZpbmFsbHkg d2l0aCB0aGlzIG1vbmV5IGFuZCBJIG5lZWQgeW91ciBoZWxwLg0KIElmIHlvdSBhZ3JlZSB0 byBoZWxwIG1lLCBJIHdpbGwgY29tcGVuc2F0ZSB5b3Ugd2l0aCAyMCUgb2YgdGhlIHRvdGFs IHN1bSBhbmQgYWxzbyB5b3Ugd2lsbCBtYW5hZ2UgdGhlc2UgZnVuZHMgaW4gYW55IGdvb2Qg aW52ZXN0bWVudCB3aGlsZSBJIHdpbGwgY29udGludWUgbXkgc3R1ZGllcyBhbmQgZXZlcnkg aW5jb21lIG1hZGUgd2lsbCBiZSBzaGFyZWQgYmV0d2VlbiB1cy4gVGhhbmsgeW91IGFuZCBJ IGxvb2sgZm9yd2FyZCB0byB5b3VyIHBvc2l0aXZlIHJlc3BvbnNlLg0KIA0KQ29uc2lkZXIg dGhpcyBhbmQgZ2V0IGJhY2sgdG8gbWUgYXMgc29vbiBhcyBwb3NzaWJsZS4NClRoYW5rIHlv dSBzbyBtdWNoLiAgDQogTXkgU2luY2VyZSANCiByZWdhcmRzLA0KUGxlYXNlIHlvdSBjYW4g Y29udGFjdGUgbWUgd2l0aCBteSBwcml2YXRlIGVtYWlsIGFkZHJlc3Mod2kyaWxsaWFtc19k YXZpZEB5YWhvby5jby5qcCkgDQogV2lsbGlhbXMgRGF2aWQNCg0KDQrvu78gCQ0KIAkNClRo xrAgxJHGsOG7o2MgZ+G7rWkgdOG7qyBodHRwOi8vbWFpbC56aW5nLnZu ------=_NextPart_49F5FDF6_084654B0_14D034D2 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PERJVj4NCjxESVYgaWQ9eWl2MTMxNDA4MjU4MT4NCjxESVYgaWQ9eWl2MTM4NTQ0NzA2NT5E ZWFyIFJlc3BlY3RmdWwgT25lLDwvRElWPg0KPERJVj4mbmJzcDs8L0RJVj4NCjxESVY+UGxl YXNlIHlvdSBjYW4gY29udGFjdGUgbWUgd2l0aCBteSBwcml2YXRlIGVtYWlsIGFkZHJlc3Mo PEEgaHJlZj0ibWFpbHRvOndpMmlsbGlhbXNfZGF2aWRAeWFob28uY28uanAiIHRhcmdldD1f YmxhbmsgcmVsPW5vZm9sbG93PndpMmlsbGlhbXNfZGF2aWRAeWFob28uY28uanA8L0E+KSA8 L0RJVj4NCjxESVY+Jm5ic3A7PC9ESVY+DQo8RElWPk91ciByZWFzb24gb2YgY29udGFjdGlu ZyB5b3UgaXMgcHVyZWx5IGJhc2VkIG9uIHNlZWtpbmcgeW91ciBhc3Npc3RhbmNlLiBUbyB0 ZWxsIHlvdSBtb3JlIGFib3V0IHVzLCBvdXIgbmFtZXMgYXJlIFdpbGxpYW1zIERhdmlkIGFu ZCBTYXJhaCBEYXZpZC4gSSBhbSAyMiB5ZWFycyBvbGQgd2hpbGUgbXkgeW91bmdlciBzaXN0 ZXIgaXMgMTkgeWVhcnMgb2xkIHdlIGFyZSB0aGUgY2hpbGRyZW4gb2YgbGF0ZSBNciBhbmQg TXJzIERvbmFsZCBEYXZpZCBhbmQgd2UgYXJlIGxpdmluZyBoZXJlIGluIEFiaWRqYW4sIHRo ZSBjYXBpdGFsIGNpdHkgb2YgQ290ZSBk44O7SXZvaXJlIGluIFdlc3QgQWZyaWNhLjxCUj4m bmJzcDs8QlI+SSBhbSBhIHN0dWRlbnQgc3R1ZHlpbmcgbWFzcyBjb21tdW5pY2F0aW9uIGJ1 dCB0aGUgc3VkZGVuIGRlYXRoIG9mIG91ciBmYXRoZXIuIEkgZm9yY2VkIG15c2VsZiB0byBk aXNjb250aW51ZSBteSBzdHVkaWVzIGJlY2F1c2Ugbm8gb25lIGNvdWxkIHNwb25zb3IgbXkg c3R1ZGllcyBhZ2Fpbi4gTXkgbW90aGVyIGRpZWQgbWFueSB5ZWFycyBiYWNrIHdoZW4gSSB3 YXMganVzdCA4IHllYXJzIG9sZCBhbmQgc2luY2UgdGhlbiBJIGFuZCBteSB5b3VuZ2VyIHNp c3RlciBoYXZlIGJlZW4gd2l0aCBteSBmYXRoZXIgYW5kIGhlIHRvb2sgbWUgc28gc3BlY2lh bCBhcyB0aGUgb25seSBzb24uPEJSPkhpcyBkZWF0aCB3YXMgc28gc3VkZGVuIGFuZCB3YXMg Y2F1c2VkIGJ5IGZvb2QgcG9pc29uaW5nIGFzIHRoZSBkb2N0b3Igc2FpZCBpbiBoaXMgZGVh dGggY2VydGlmaWNhdGUgYnV0IHdlIGFyZSBzdXNwZWN0aW5nIG9uZSBvZiBteSB1bmNsZSB3 aG8gYWx3YXlzIHRyYXZlbCB3aXRoIGhpbSBhbnkgdGltZSBoZSBpcyBtYWtpbmcgb3ZlcnNl YXMgdHJpcCBhcyB0aGUgcGVyc29uIHdobyBwbGFubmVkIGhpcyBkZWF0aCwgd2VsbCBvbmx5 IEdvZCBrbm93cyB0aGUgdHJ1dGguPEJSPjxCUj5UaGUgaXNzdWUgbm93IGlzIHRoYXQgSSBh bmQgbXkgeW91bmdlciBzaXN0ZXIgd2FudCB0byBtb3ZlIG91dCBvZiB0aGlzIGNvdW50cnkg aW1tZWRpYXRlbHkgdG8gYSBtb3JlIHNlY3VyZSBwbGFjZSB3aGVyZSB3ZSB3aWxsIGxpdmUg Zm9yIHRoZSByZXN0IG9mIG91ciBsaWZlIGJlY2F1c2Ugc2luY2UgdGhlIGRlYXRoIG9mIG91 ciBmYXRoZXIsIGhpcyBicm90aGVy55e0IGFuZCBvdGhlciBmYW1pbHkgcmVsYXRpdmVzIGhh dmUgYWxsIHRha2VuIG92ZXIgYWxsIG15IGxhdGUgZmF0aGVy55e0IGJlbG9uZ2luZ3MgaW5j bHVkaW5nIGhpcyBidXNpbmVzcyBhbmQgaG91c2VzIGFuZCB0aGV5IGRvbueomiBldmVuIHdh bnQgdG8gY29uc2lkZXIgbWUgYW5kIG15IHlvdW5nZXIgc2lzdGVyLjxCUj48QlI+SW4gbXkg b3duIGNhc2UsIG15IGZhdGhlciB3YXMgYSBidXNpbmVzcyBtYW4gd2hvIGFsd2F5cyBleHBv cnQgQ29jb2EgdG8gRXVyb3BlIGFuZCBoZSBtYWRlIGEgbG90IG9mIG1vbmV5IGZyb20gdGhp cyBidXNpbmVzcyBhbmQgb3duIGxvdCBvZiBwcm9wZXJ0aWVzIGFuZCBob3VzZXMsIGhpcyBi cm90aGVycyBoYXZlIHRha2VuIGNvbnRyb2wgb2YgYWxsIHRoZXNlIHRoaW5ncyBhbmQgdGhl eSBjYW4gZXZlbiBraWxsIG1lIHRvbyBpZiBJIHNob3VsZCBhc2sgYWJvdXQgdGhlbS4gRm9y IHRoaXMgcmVhc29uLCBJIGRvbueomiB3YW50IHRvIGJlIGFzc29jaWF0ZWQgd2l0aCB0aGVt IGFnYWluLjxCUj5Ib3dldmVyLCBteSBmYXRoZXIgY29uZmlkZWQgYSBzZWNyZXQgdG8gbWUg YmVmb3JlIGhpcyBkZWF0aCBpbiBhIGhvc3BpdGFsIGhlcmUuIEhlIHRvbGQgbWUgdGhhdCBo ZSBkZXBvc2l0ZWQgYSBjb25zaWdubWVudCBpbiBhIHNlY3VyaXR5IGNvbXBhbnkgaGVyZSBp biBBYmlkamFuIENvdGUgRCBJdm9pcmUsIGEgVHJ1bmsgYm94IGNvbnRhaW5pbmcgdGhlIHN1 bSBvZiAoJDE0LDMwMCwwMDApLiBhbmQgbm8gb25lIGtub3dzIGFib3V0IHRoaXMsIG5vdCBl dmVuIHRoZSBzZWN1cml0eSBjb21wYW55IGJlY2F1c2UgaGUgcmVnaXN0ZXJlZCB0aGUgY29u dGVudCBvZiB0aGUgYm94IGFzIEZhbWlseSBWYWx1YWJsZXMuPEJSPkhlIGFsc28gdG9sZCBt ZSB0aGF0IGhlIHVzZWQgbXkgbmFtZSAod2lsbGlhbXMgZGF2aWQpIGFzIHRoZSBuZXh0IG9m IGtpbiBpbiBkZXBvc2l0aW5nIHRoZSB0cnVuayBib3ggY29udGFpbmluZyB0aGUgbW9uZXkg YW5kIGFsc28gaGFuZGVkIG92ZXIgdGhlIGRlcG9zaXRvcnkgZG9jdW1lbnRzIHRvIG1lLiBI ZSB0b2xkIG1lIHRoYXQgaXQgd2FzIGJlY2F1c2Ugb2YgaGlzIHdlYWx0aCB0aGF0IGhlIHdh cyBwb2lzb25lZCBhbmQgdGhhdCBJIHNob3VsZCBzZWVrIGEgdHJ1c3R3b3J0aHkgcGVyc29u IGluIGEgY291bnRyeSBvZiBteSBjaG9pY2Ugd2hvIGNvdWxkIGFzc2lzdCBtZSB0byBjbGFp bSBhbmQgaW52ZXN0IHRoaXMgbW9uZXkuPEJSPiZuYnNwO0RlYXIgQmVsb3ZlZCBPbmUsIHRo aXMgaXMgdGhlIG1haW4gcmVhc29uIEkgY29udGFjdGVkIHlvdS4gSSB3YW50IHlvdSB0byBo ZWxwIG1lIGNsYWltIHRoaXMgY29uc2lnbm1lbnQvdHJ1bmsgYm94IChDQVNIKSBmcm9tIHRo ZSBzZWN1cml0eSBjb21wYW55IGhlcmUgaW4gQWJpZGphbiBDb3RlIEQnSXZvaXJlIHRvIHlv dXIgY291bnRyeSBhbmQgYWxzbyBoZWxwIG1lIGFuZCBteSB5b3VuZ2VyIHNpc3RlciB0byBy ZWxvY2F0ZSB0byB5b3VyIGNvdW50cnkgdG8gY29udGludWUgb3VyIGxpZmUgb3ZlciB0aGVy ZS48QlI+PEJSPiZuYnNwO1RoaXMgY291bnRyeSBpcyBubyBsb25nZXIgc2FmZSBmb3IgbXkg Y29udGludWFsIHN0YXkgYmVjYXVzZSBldmVyeSBkYXkgaGVyZSBJIGFtIGxpdmluZyB1bmRl ciB0aGUgZmVhciBvZiB0aG9zZSBteSBsYXRlIGZhdGhlcueXtCByZWxhdGl2ZXMuIFdlIGFy ZSBubyBsb25nZXIgbGl2aW5nIGluIG91ciBmYW1pbHkgaG91c2UgYmVjYXVzZSB0aGV5IG1p Z2h0IHRyeSB0byBraWxsIHVzIHNpbmNlIHRoZXkgd2FudCB0byBpbmhlcml0IGFsbCBteSBs YXRlIGZhdGhlcueXtCBwcm9wZXJ0aWVzLiBJIGFtIG5vdyBsaXZpbmcgaW4gYSBndWVzdCBo b3VzZSBoZXJlIGFuZCBJIHdhbnQgdG8gbW92ZSBvdXQgb2YgdGhlIGNvdW50cnk8QlI+Zmlu YWxseSB3aXRoIHRoaXMgbW9uZXkgYW5kIEkgbmVlZCB5b3VyIGhlbHAuPEJSPiZuYnNwO0lm IHlvdSBhZ3JlZSB0byBoZWxwIG1lLCBJIHdpbGwgY29tcGVuc2F0ZSB5b3Ugd2l0aCAyMCUg b2YgdGhlIHRvdGFsIHN1bSBhbmQgYWxzbyB5b3Ugd2lsbCBtYW5hZ2UgdGhlc2UgZnVuZHMg aW4gYW55IGdvb2QgaW52ZXN0bWVudCB3aGlsZSBJIHdpbGwgY29udGludWUgbXkgc3R1ZGll cyBhbmQgZXZlcnkgaW5jb21lIG1hZGUgd2lsbCBiZSBzaGFyZWQgYmV0d2VlbiB1cy4gVGhh bmsgeW91IGFuZCBJIGxvb2sgZm9yd2FyZCB0byB5b3VyIHBvc2l0aXZlIHJlc3BvbnNlLjxC Uj4mbmJzcDs8QlI+Q29uc2lkZXIgdGhpcyBhbmQgZ2V0IGJhY2sgdG8gbWUgYXMgc29vbiBh cyBwb3NzaWJsZS48QlI+VGhhbmsgeW91IHNvIG11Y2guJm5ic3A7IDwvRElWPg0KPERJVj5N eSBTaW5jZXJlIDwvRElWPg0KPERJVj5yZWdhcmRzLDxCUj5QbGVhc2UgeW91IGNhbiBjb250 YWN0ZSBtZSB3aXRoIG15IHByaXZhdGUgZW1haWwgYWRkcmVzcyg8QSBocmVmPSJtYWlsdG86 d2kyaWxsaWFtc19kYXZpZEB5YWhvby5jby5qcCIgdGFyZ2V0PV9ibGFuayByZWw9bm9mb2xs b3c+d2kyaWxsaWFtc19kYXZpZEB5YWhvby5jby5qcDwvQT4pIDwvRElWPg0KPERJVj5XaWxs aWFtcyBEYXZpZDwvRElWPjwvRElWPjwvRElWPu+7vzxkaXY+Cgk8aHI+Cgk8cD5UaMawIMSR xrDhu6NjIGfhu61pIHThu6sgPGEgaHJlZj0iaHR0cDovL21haWwuemluZy52biI+aHR0cDov L21haWwuemluZy52bjwvYT4KPC9kaXY+ ------=_NextPart_49F5FDF6_084654B0_14D034D2-- From mr.colemanw@yahoo.com Tue Apr 28 14:19:35 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.0 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_BR_1,DEAR_SOMETHING,FORGED_MUA_OUTLOOK, FORGED_YAHOO_RCVD,FREEMAIL_FROM,FREEMAIL_REPLYTO,J_CHICKENPOX_66, L_SOME_STD_PROBS,MISSING_HEADERS,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [200.211.85.66 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9977] * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 2.3 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers * 1.3 MISSING_HEADERS Missing To: header * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.6 J_CHICKENPOX_66 BODY: 6alpha-pock-6alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from castanhal.com.br (brma.castanhal.com.br [200.211.85.66]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3SLJUN4012649 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 28 Apr 2009 14:19:35 -0700 BrmaOutput: CUSTOMER.VPLS.NET [66.186.34.211] (may be forged) Received: from User (CUSTOMER.VPLS.NET [66.186.34.211] (may be forged)) (authenticated bits=0) by castanhal.com.br (8.12.11.20060308/8.12.11) with ESMTP id n3SKj0NG007192; Tue, 28 Apr 2009 17:45:10 -0300 Message-Id: <200904282045.n3SKj0NG007192@castanhal.com.br> Reply-To: From: " Mr.W .Coleman" Subject: [SPAM] From Mr.Coleman!! Date: Tue, 28 Apr 2009 13:48:07 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:19:36 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 28 Apr 2009 14:19:35 -0700 (PDT) X-Spam-Prev-Subject: From Mr.Coleman!! Status: R X-Status: X-Keywords: X-UID: 292 >From Mr.Coleman, Dear Sir, I need your services in a confidential matter regarding consignment (fund) out of a family beneficiary deposit. This requires a private arrangement. You will receive these funds under legal claims; all legal documents will be carefully worked out to ensure a risk free transfer. 30% of the total sum would be your own potion at the end of this deal. I have all the details. The funds in question are quite large ($36.8M).I will expect a straight answer from you. If you are willing to assist,kindly furnish me with your personal information which must include your direct cell phone and fax number, your address and company name. Please get back to me through my private email: Thanks as I expect to hear from you. Mr.Williams Coleman From paul_konan500@yahoo.com Wed Apr 29 07:50:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n3TEo3c4023468 for ; Wed, 29 Apr 2009 07:50:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********* X-Spam-Status: Yes, score=9.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_50,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE, HTML_OBFU_01,J_CHICKENPOX_74,MILLION_USD,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 HTML_OBFU_01 BODY: HTML encoded-character obfuscation * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5069] * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Wed, 29 Apr 2009 07:50:03 -0700 (PDT) Received: from web110604.mail.gq1.yahoo.com (web110604.mail.gq1.yahoo.com [67.195.13.195]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n3TEmSUn008182 for ; Wed, 29 Apr 2009 07:48:32 -0700 Received: (qmail 9102 invoked by uid 60001); 29 Apr 2009 14:21:47 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1241014907; bh=qbvHI79IdyIWYICecVAJf9XCc9VcOIhbcpXoT56mEhk=; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=GMg2I9ai62tJy1OYjvRqPzB+QDfNeak/fZTirsxtQdGAA94LuVWatzp6rmssA9ClzKP7vApNUpLGZcLMivCcAZOPmWPlatD906fYO3M9JK3iCFA4UbQ3PxWqCuSVwAhxiBro+z4/GlhkVjUXmVPKVt9gLocBnAED1KHMyK/pp2E= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=6rVDN/oRBzPjxVU4e0JweyaS8I7cSbGfaLf1Hnto5r3sV4qz57rgcla/KtnwTseI9fKRfpnQsGeGq0I0k7C42BPH4oAkWUr41m1J2IwEPKt4lOzk/ArmtReww1B+LzMbrYhEOVd1OIX4D0FVZ20cO/WkXvWqaZJFQI/DnR1RpjA=; Message-ID: <579392.6580.qm@web110604.mail.gq1.yahoo.com> Received: from [41.207.192.43] by web110604.mail.gq1.yahoo.com via HTTP; Wed, 29 Apr 2009 22:21:47 CST Date: Wed, 29 Apr 2009 22:21:47 +0800 (CST) From: Paul Konan Reply-To: paulkonan@hotmail.fr Subject: [SPAM] Investment!!! To: paul_konan500@yahoo.com MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="0-752892815-1241014907=:6580" Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 00:26:40 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 29 Apr 2009 07:48:32 -0700 (PDT) X-Spam-Prev-Subject: Investment!!! Status: R X-Status: X-Keywords: X-UID: 293 Content-Length: 6275 --0-752892815-1241014907=:6580 Content-Type: text/plain; charset=big5 Content-Transfer-Encoding: 8bit Hello Dear friend, How are you today?,I am Paul. I would like you to permit me to apply through this medium for your co-operation and to secure an opportunity to invest and do joint relationship and business with you in your country. I have a substantial capital I honourably Inherited from my late father late Dr Barry Konan who deal in Cocao-coffee plantation and share from family Gold, diamond Mining and trading.The Epmgigo rebels killed Him recently in political crisis in our country that have resulted to war since this past two years. I intend to invest this money in profitable areas in your country into a very lucratives business venture of which you are to advise and execute the said venture over there for the mutual benefits of both of us . Most especially is for you to help me come over to your base if possible for You be able co-operate with me to become my business partner in your country and create ideas on how money will be invested, properly managed and the type of investment after the money is transferred to your custody with your assistance. I inherited this sum from my late father whom the rebels killed because he was not supporting their selfish interest to topple the president Gbagbo the present president.Meanwhile, on indication of your willingness to handle this transaction sincerely by protecting my Interests and upon your acceptance of this proposal.I would furnish you with the full detailed information, procedure, amount involve is below and we shall mutually agree on your percentage interest or share holding for helping me to secure the release of the deposit and investing the fund into a lucratives profitable venture in your care.It is The sum of Seven Million,Five Hundred Thousand USD $7.500.000USD I shall be glad to reserve this respect and opportunity for you, if you so desire, but do urge you to give the matter your immediate attention it deserves. I want you to be rest assured that everything is in order and legitimate it was due to the political crisis in our country that have resulted to war which cause everybody to find a way to get out the country,that makes me to use this medium to request for your assistance hoping that you will not let me down. This money is legitimately acquired by my late father from sales of cocoa-coffee and diamond dealings. Looking forward to your prompt response Thanks and God bless Paul Konan. _______________________________________ 辣茩妏蚚閉湮講捇誥蚘眊 http://cn.mail.yahoo.com _______________________________________ 辣茩妏蚚閉湮講捇誥蚘眊 http://cn.mail.yahoo.com _______________________________________ ӭʹóŻ http://cn.mail.yahoo.com --0-752892815-1241014907=:6580 Content-Type: text/html; charset=big5 Content-Transfer-Encoding: 8bit
Hello Dear friend,
 
How are you today?,I am Paul. I would like you to permit me to apply through this medium for your co-operation and  to secure an opportunity to invest and do joint relationship and business with you in your country.
 
I have a substantial capital I honourably Inherited from my late father late Dr Barry Konan who deal in Cocao-coffee plantation and share from family Gold, diamond Mining and trading.The Epmgigo rebels killed Him recently in political crisis in our country that have resulted to war since this past two years.
I intend to invest this money in profitable areas in your country into a very lucratives business venture of which you are to advise and execute the said venture over there for the mutual benefits of both of us .
 
Most especially is for you to help me come over to your base if possible for You be able co-operate with me to become my business partner in your country and create ideas on how  money will be invested, properly managed and the type of investment after the money  is transferred to your custody with your assistance.
 
I inherited this sum from my late father  whom the rebels killed because he was not supporting their selfish interest to topple the president Gbagbo the present president.Meanwhile, on indication of your willingness to handle this transaction sincerely by protecting my Interests and upon your acceptance of this proposal.I would  furnish you with the full detailed information, procedure, amount involve is below and we shall  mutually agree on your percentage interest or share holding for helping me to secure the release of the deposit and investing the fund into a lucratives profitable venture in your care.It is The sum of Seven Million,Five Hundred Thousand USD $7.500.000USD I shall be glad to reserve this respect and opportunity for you, if you so desire, but do urge you to give the matter your immediate attention it deserves.
 
I want you to be rest assured that everything is in order and legitimate it was due to the political crisis in our country that have resulted to war which cause everybody to find a way to get out the country,that makes me to use this medium to request for your assistance hoping that you will not let me down.
This money is legitimately acquired by my late father from sales of cocoa-coffee and diamond dealings.
 
Looking forward to your prompt response
Thanks and God bless
Paul Konan.
_______________________________________
辣茩妏蚚閉湮講捇誥蚘眊
http://cn.mail.yahoo.com

_______________________________________
辣茩妏蚚閉湮講捇誥蚘眊
http://cn.mail.yahoo.com

_______________________________________
ӭʹóŻ
http://cn.mail.yahoo.com --0-752892815-1241014907=:6580-- From prk_civ1@yahoo.co.th Thu Apr 30 04:45:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n3UBj2uq009422 for ; Thu, 30 Apr 2009 04:45:02 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****** X-Spam-Status: Yes, score=6.9 required=5.0 tests=BAYES_50,DNS_FROM_RFC_BOGUSMX, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE,J_CHICKENPOX_41,J_CHICKENPOX_71, J_CHICKENPOX_75,MILLIONS_01,RCVD_IN_BRBL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [124.108.123.92 listed in b.barracudacentral.org] * 1.5 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in * bogusmx.rfc-ignorant.org * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5000] Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Thu, 30 Apr 2009 04:45:02 -0700 (PDT) Received: from web76712.mail.sg1.yahoo.com (web76712.mail.sg1.yahoo.com [124.108.123.92]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n3UBijpc010359 for ; Thu, 30 Apr 2009 04:44:49 -0700 Received: (qmail 72579 invoked by uid 60001); 30 Apr 2009 11:18:03 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.th; s=s1024; t=1241090283; bh=gm9aHnVegQVpEqP5Sht0BCA7r4t+wvfoP2+l0YQhGsc=; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=f0I38Ef/Vsa0HZXy5dHwwlKAqktVHdX7TngV4ctRLl4iQ7EhpO4tKtXGwdeVexsNxNcsbnk2Au/EpSuZC3A0LyYmy1sFTp/xWgMMG9QMl+gXnMyxe1qkUlUS8/ug6SEjg3Q4kUxc0mFiZwBlwth2NglsF6e8b39k1OQpbItAk8w= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.th; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=VRtLM0wGpSpu5VnYCxvXLmR+m6Dch5rwEfySGor/w4kpPbpVEUz1QXUzAnr4lsk5gQ0HCkMiVOhEUghOQmoOqDpIUxKOMDvCBZgMq04WsISSCDdq1JP/p9XKXeiMEZZcp38H72XxQaXK6uuQdrOwwMVDRLvOWkWu9Xq0dXVUoM4=; Message-ID: <8422.71885.qm@web76712.mail.sg1.yahoo.com> Received: from [41.207.202.68] by web76712.mail.sg1.yahoo.com via HTTP; Thu, 30 Apr 2009 18:18:02 ICT Date: Thu, 30 Apr 2009 18:18:02 +0700 (ICT) From: Pp Kk Reply-To: konepascal00000@yahoo.com Subject: [SPAM] Hello Dear, To: prk_civ1@yahoo.co.th MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="0-908368570-1241090282=:71885" Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 00:26:40 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 30 Apr 2009 04:44:50 -0700 (PDT) X-Spam-Prev-Subject: Hello Dear, Status: R X-Status: X-Keywords: X-UID: 294 Content-Length: 3912 --0-908368570-1241090282=:71885 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Hello Dear, My name is Pascal Zadi I hope this mail finds you well & healthy and i hope we can established a relationship since we are meeting for the first time,i have gone through fasting and prayers asking God to lead me to a trust worthy person who will help me with this transaction and it interests me to contact you aftter my prayers for an assistance to help me transfer this Sum of 10.7 Million USA dollars my father deposited in a bank here in Cote d'Ivoire before he was assasinated.i like honesty,trust,love,truth,caring,& respect,i have all this qualities in me and i believe you have all this qualities too, that is why i decided to contact you for this transaction,i will like you to contact me as soon as possible so that we can know ourselves better. call me on phone (00225 6634 7640)Thanks and hoping to hear from you soonest. Mr Pascal Kone --------------------------------- ຍì?ⴹ桠 ˒?ר͠?ʘ????ըⴹ㨠?ը? @ymail ᅐ @rocketmail. Õ??ͧ?荹?Т???Ѵ˹钡 --------------------------------- ท่องเน็ตเร็วและชาญฉลาดกว่าด้วย Firefox 3! --------------------------------- ปลอดภัยกว่าเวลาออนไลน์ อัพเกรดใหม่เป็น Internet Explorer 8 เหมาะสุดสำหรับ Yahoo! วางใจได้เสมอ แถมฟรีอีกด้วยนะ โหลดIE8 ได้ที่นี่! --0-908368570-1241090282=:71885 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hello Dear,
My name is Pascal Zadi I hope this mail finds you well & healthy and i hope we can established a relationship since we are meeting for the first time,i have gone through fasting and prayers asking God to lead me to a trust worthy person who will help me with this transaction and it interests me to contact you aftter my prayers for an assistance to help me transfer this Sum of 10.7 Million USA dollars my father deposited in a bank here in Cote d'Ivoire before he was assasinated.i like honesty,trust,love,truth,caring,& respect,i have all this qualities in me and i believe you have all this qualities too, that is why i decided to contact you for this transaction,i will like you to contact me as soon as possible so that we can know ourselves better. call me on phone (00225 6634 7640)Thanks and hoping to hear from you soonest.
Mr Pascal Kone
ຍì?ⴹ桠
˒?ר͠?ʘ????ըⴹ㨠?ը? @ymail ᅐ @rocketmail.
Õ??ͧ?荹?Т???Ѵ˹钡

ท่องเน็ตเร็วและชาญฉลาดกว่าด้วย Firefox 3!

ปลอดภัยกว่าเวลาออนไลน์
อัพเกรดใหม่เป็น Internet Explorer 8 เหมาะสุดสำหรับ Yahoo! วางใจได้เสมอ แถมฟรีอีกด้วยนะ โหลดIE8 ได้ที่นี่! --0-908368570-1241090282=:71885-- From aichaeme07@rocketmail.com Thu Apr 30 05:20:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n3UCK3A8009841 for ; Thu, 30 Apr 2009 05:20:03 -0700 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ** X-Spam-Status: No, score=2.7 required=5.0 tests=BAYES_50,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_MESSAGE,US_DOLLARS_3 autolearn=disabled version=3.2.5 Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Thu, 30 Apr 2009 05:20:03 -0700 (PDT) Received: from web76612.mail.sg1.yahoo.com (web76612.mail.sg1.yahoo.com [124.108.123.68]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n3UCHPMg011607 for ; Thu, 30 Apr 2009 05:17:29 -0700 Received: (qmail 92477 invoked by uid 60001); 30 Apr 2009 11:50:42 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; s=s1024; t=1241092242; bh=qNoKY0wq7Ps8z+5B3EurSUCPTP6FbjruvIc1xof2unQ=; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=HVlgrFvI+XSo83fgc0bOWpHHkCmDVr21/4DnbNjJbm6B0s2uqlDe+IgdWGrdGoK7Vnk9VWe3BP1HcQY7F87JyEyjWn+5eXAYNBxnztj6cAn+Y+idbqVUcvVyDEwZaZ5HI8GIpDXxA1x9UCrtD9Fr0Gwbv1V621f0RdgfR/zfV74= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=rocketmail.com; h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=MgnjKPmDbWPJXyQ3rdE83FO6b1WB5pGHw6RAonqtecD5At4hOtiqbpZk4D46lJjwdlC56ZOGqtD8QJhUbKpia7W8NF8OY+sPrSn2nj94dmVecs6KEnAzmGBD6LEzmAoZZoVkK+e8bYxQ4+8rgJ57ECIS2dfKSSMGxFcRnW1wIVI=; Message-ID: <865307.88471.qm@web76612.mail.sg1.yahoo.com> Received: from [41.207.212.103] by web76612.mail.sg1.yahoo.com via HTTP; Thu, 30 Apr 2009 18:50:42 ICT Date: Thu, 30 Apr 2009 18:50:42 +0700 (ICT) From: Aicha Eme Reply-To: aichaeme2006@yahoo.fr Subject: Aicha Eme To: aichaeme07@rocketmail.com MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="0-774169376-1241092242=:88471" Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 00:26:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 30 Apr 2009 05:17:30 -0700 (PDT) Status: R X-Status: X-Keywords: X-UID: 295 Content-Length: 5644 --0-774169376-1241092242=:88471 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit AICHA EME Bonjour, Je vous contacte dans le but d'avoir votre assistance afin de transferer la somme de $17,000,000 us (Dix sept millions de dollards americain) dans votre pays. J'ai reçu cet argent comme heritage de la part de mon defunt pere qui etait un important homme d'affaire et propriétaire d'une société de production et d'exportation de café et de cacao, il avait également des investissements dans le domaine de l'anarcade,ainsi que de l'hévéa. Je souhaite investir cet dans votre pays et poursuivre mes etudes. Tout ce que je souhaites de vous, c'est de recevoir la caisse dans laquelle se trouve l'argent a la société de securité, étant donné que la société en question a une filliale en Europe et c'est dans cette société étrangère de la compagnie de sécurité que la caisse est entreposée; et vous m'en enverrez de l'argent dans la caisse une fois retirée,pour vous rejoindre dans votre pays afin d'investir le reste de l'argent et débuter une nouvelle vie. Si vous êtes serieusement disposés en toute sincérité a m'assister, je compenserai votre assistance par 25 % des $17,000,000 us. Veuillez me contacter urgemment pour plus de details. Merci de votre attention et votre comprehension. AICHA EME --------------------------------- Yahoo! แจกเบอร์เมลใหม่ หาชื่อเมลสุดเลิฟที่โดนใจ ที่เมล @ymail และ @rocketmail. รีบจองก่อนจะโดนตัดหน้า! --------------------------------- ปลอดภัยกว่าเวลาออนไลน์ อัพเกรดใหม่เป็น Internet Explorer 8 เหมาะสุดสำหรับ Yahoo! วางใจได้เสมอ แถมฟรีอีกด้วยนะ โหลดIE8 ได้ที่นี่! --------------------------------- เปิดเมลได้ไวกว่า Yahoo! ขอแนะนำให้อัพเกรดเบราเซอร์เป็น Internet Explorer 8 เหมาะสุดสำหรับ Yahoo!โหลดเลย! (ฟรี) --0-774169376-1241092242=:88471 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
AICHA EME

Bonjour,
 
Je vous contacte dans le but d'avoir votre assistance afin de transferer la somme de $17,000,000 us (Dix sept millions de dollards americain) dans votre pays. J'ai reçu cet argent comme heritage de la part de mon defunt pere qui etait un important homme d'affaire et propriétaire d'une société de production et d'exportation de café et de cacao, il avait également des investissements dans le domaine de l'anarcade,ainsi que de l'hévéa. Je souhaite investir cet dans votre pays et poursuivre mes etudes.
 
Tout ce que je souhaites de vous, c'est de recevoir la caisse dans laquelle se trouve l'argent a la société de securité, étant donné que la société en question a une filliale en Europe et c'est dans cette société étrangère de la compagnie de sécurité que la caisse est entreposée; et vous m'en enverrez de l'argent dans la caisse une fois retirée,pour vous rejoindre dans votre pays afin d'investir le reste de l'argent et débuter une nouvelle vie. Si vous êtes serieusement disposés en toute sincérité a m'assister, je compenserai votre assistance par 25 % des $17,000,000 us.

Veuillez me contacter urgemment pour plus de details.
 
Merci de votre attention et votre comprehension. 
 
AICHA EME
Yahoo! แจกเบอร์เมลใหม่
หาชื่อเมลสุดเลิฟที่โดนใจ ที่เมล @ymail และ @rocketmail.
รีบจองก่อนจะโดนตัดหน้า!

ปลอดภัยกว่าเวลาออนไลน์
อัพเกรดใหม่เป็น Internet Explorer 8 เหมาะสุดสำหรับ Yahoo! วางใจได้เสมอ แถมฟรีอีกด้วยนะ โหลดIE8 ได้ที่นี่!

เปิดเมลได้ไวกว่า
Yahoo! ขอแนะนำให้อัพเกรดเบราเซอร์เป็น Internet Explorer 8 เหมาะสุดสำหรับ Yahoo!โหลดเลย! (ฟรี) --0-774169376-1241092242=:88471-- From prvs=1364adbd85=kwame.addo8@gmail.com Wed Apr 29 11:59:15 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********** X-Spam-Status: Yes, score=11.9 required=5.0 tests=BAYES_99,FREEMAIL_FROM, JM_SOUGHT_FRAUD_2,J_CHICKENPOX_56,LOTTO_YOU_WON_02,MSGID_MULTIPLE_AT,PHISH_05, RAZOR2_CHECK,SPF_NEUTRAL,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9998] * 1.4 MSGID_MULTIPLE_AT Message-ID contains multiple '@' characters * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 0.2 PHISH_05 BODY: Phishing for account information * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns Received: from worldvision.org (smtp-backstop.worldvision.org [207.14.59.40]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3TIxAwq015097 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 29 Apr 2009 11:59:14 -0700 Date: Wed, 29 Apr 2009 11:55:08 -0700 From: "Mr.kwame addo" Subject: [SPAM] I thought you would be interested in this World Vision webpage To: jhardin@impsec.org Message-ID: X-MIMETrack: Serialize by Router on ProdStage/Wvus-Web(Release 8.0.1|February 07, 2008) at 04/29/2009 11:57:29 AM MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII X-Spam-Prev-Subject: I thought you would be interested in this World Vision webpage Status: R X-Status: X-Keywords: X-UID: 296 Content-Length: 1242 Hello! I thought you would be interested in seeing the following page on the World Vision website. Please click this link or copy and paste it into your browser window: http://www.worldvision.org/news.nsf/news/myanmar-cyclone-20080505 Dearest, I got your contact during my search for a reliable, honest and a trust worth person to entrust this huge transfer project with. My name is Mr. kwame addo, Branch manager of a financial institution here in Ghana. I am a Ghanaian married with two kids. I am writing to solicit your assistance in the transfer of $11,597,864.00 only.This fund is the excess of what my branch in which am the manager made as profit! during the 2005 financial year. I have already submitted annual report for that year to my head office here in Accra as I have watched with keen interest as they will never know of this excess. I have since,placed this amount of $ 11,597,864.00 only to an Escrow Coded account without a beneficiary (anonymous) to avoid trace. I cannot be directly connected to this money thus I am impelled to request for your assistance to receive this money into your bank account on my behalf.I will give you more details when i hear from you. kwame.addo8@gmail.com With Regards, Mr.kwame addo From gdduarte01@yahoo.com.hk Wed Apr 29 15:06:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.7 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_NG_2,BL_COUNTRY_TW_1,BL_COUNTRY_TW_2,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MISSING_HEADERS, MSOE_MID_WRONG_CASE,PHISH_05,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RCVD_IN_BRBL,RDNS_DYNAMIC,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [211.75.76.194 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [211.75.76.194 listed in tw.countries.nerd.dk] * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from tarky.com.tw (211-75-76-194.HINET-IP.hinet.net [211.75.76.194] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3TM61b4020549 for ; Wed, 29 Apr 2009 15:06:06 -0700 Received: (from root@localhost) by tarky.com.tw Sharetech Mailgateway id n3T7hhM31321; Wed, 29 Apr 2009 15:43:43 +0800 Received: from User ([82.128.27.214]) (authenticated bits=0) by tarky.com.tw Sharetech with ESMTP id n3T7eUuH028801; Wed, 29 Apr 2009 15:42:25 +0800 Message-Id: <200904290742.n3T7eUuH028801@tarky.com.tw> Reply-To: From: "Chiedu Amaka" Subject: [SPAM] [Spam-Mail]Attn: BENEFICIARY Date: Wed, 29 Apr 2009 08:42:13 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 14:20:19 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 29 Apr 2009 15:06:06 -0700 (PDT) X-Spam-Prev-Subject: [Spam-Mail]Attn: BENEFICIARY Status: R X-Status: X-Keywords: X-UID: 297 Content-Length: 2581 DATE: 2009-04-09 Attn: BENEFICIARY Be informed that all the fees you are supposed to pay before receiving your contract/inheritance fund have been waived off. only for your processing fee and he will transfer your contract/Inheritance fund to you immediately. No other charges except the processing fee. Your PASSCODE is: 999-035-2655 (Fund Transfer confirmation same day). You have no other payment to make except the processing fee. Your Payment Of ($15.5 Million) in addition with your accumulated interest will be through Electronic Telegraphic Transfer. This is newly introduced system of payment by the Union Bank of Nigeria to avoid experiences of incessant fraud, illegal extortion of money from beneficiaries and to enhance transparency. WHEN YOUR FUNDS ARE TRANSMITTED, THE MANAGEMENT WILL INFORM YOU, AND YOU APPLY THE PASSCODE AS DIRECTED AND INSTANTLY, YOUR ACCOUNT WILL BE CREDITED AND YOU MOVE TO YOUR BANK TO CONFIRM YOUR FUND. You will only apply the passcode when you have paid your processing fee because for now, it is still invalid until your fund is transmitted. Here is the processing fee payment information below. Name: TINA OMOLPARE Text Question: GOOD Text Answer: OK Country:Lagos/ Nigeria Amount: $70 You have to go immediately and make the payment before your passcode will be activated and your fund transferred. You can try the guideline as instance: * With your digital phone dial our bank access code followed by, then enter your Account number followed by #, at a voice prompt enter your passcode and # and you will be credited. (This will be when your fund has been transmitted). Any other contact or payment you make apart from the processing fee is to anybody or office is at your own risk. Then your email subject must have this code for security reasons "In God We Trust?, any email that does not come with it as the subject is not from central bank and guard this code jealously. Be informed that so many unauthorized individuals do parade themselves as our officials and impose bogus bills on our beneficiaries with their syndicates home and abroad. Take precautionary measure henceforth, you have been notified, and once we find out that you are one of the people that involve themselves with these unauthorized individuals, tarnishing the image of this great country we will immediately report you to the authorities (F.B.I) because we are trying our best to restore the image of this great country. Yours faithfully, Mr.Amaka chiedu ACCOUNTANT GENERAL From euromillottnl@gmail.com Wed Apr 29 16:57:32 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************************ X-Spam-Status: Yes, score=48.7 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_JP_1,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,KAM_LOTTO1,KAM_LOTTO2,LOTTO_AGENT,LOTTO_FROM,LOTTO_MANY, LOTTO_WIN_02,LOTTO_YOU_WON_02,MISSING_HEADERS,MSOE_MID_WRONG_CASE, RBL_POXLAY_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_LOTTO_SPAM2,SPF_NEUTRAL, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS,UNCLAIMED_MONEY autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [221.186.15.162 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [62.108.17.26 listed in dnsbl.sorbs.net] * 2.0 LOTTO_FROM Admits to being a lottery * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 3.1 UNCLAIMED_MONEY BODY: People just leave money laying around * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_02 BODY: * Winner * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from sv1.nes-irg.com (sv1.nes-irg.com [221.186.15.162]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3TNvPf4023494 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 29 Apr 2009 16:57:31 -0700 Received: from User (k17026.upc-k.chello.nl [62.108.17.26]) (authenticated bits=0) by sv1.nes-irg.com (8.12.8/8.12.8) with ESMTP id n3P4CoJ1028682; Sat, 25 Apr 2009 13:13:03 +0900 Message-Id: <200904250413.n3P4CoJ1028682@sv1.nes-irg.com> Reply-To: From: "Euro Millions Lottery" Subject: [SPAM] EURO MILLIONS LOTTERY WINNER !!!!! Date: Sat, 25 Apr 2009 06:13:54 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 115:38:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 29 Apr 2009 16:57:32 -0700 (PDT) X-Spam-Prev-Subject: EURO MILLIONS LOTTERY WINNER !!!!! Status: R X-Status: X-Keywords: X-UID: 298 Content-Length: 2679 EURO MILLIONS LOTTERY INTERNATIONAL. www.euro-millions.com FROM: INTERNATIONAL PROMOTION/PRIZE AWARD DEPT. REFERENCE: 897/60/IPDHJK662091 BATCH: EU-983-741-2883992MG02 Sir/Madam, The EURO MILLIONS Promotion team is proud to inform you of the Euro Millions Lottery Online International E-mail programs held on the 21ST OF APRIL 2009.And result where release on the 24TH OF April 2009. Your E-mail address attached to ticket number 07 09 31 29 41 07 02 with serial main number 605-990-291-681 which consequently won in the 1ST category, you have therefore been approved for a lump sum pay out of 1.000.000.00 Euro. (One Million Euro). CONGRATULATIONS!!!!!!!!!!!!!!! Due to mix up of some numbers and names, we ask that you keep your winning information confidential until your claims has been processed and your money remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 100,000 company and 50,000,000 individual email addresses and names from all over the world. This lottery was promoted and sponsored by European Union Lottery Board in order to enhance and promote the use of Internet Explorer Users and Microsoft-wares around the globe. This promotional program takes place once in a week . We hope with part of your winning you will take part in our middle of year 28 million Euro International Jackpot. To file in for the processing and release of your money, you are advised to contact our accredited claims agent with the information stated below: *************************************************************************** *********** Name: Mr. John Raymer Tel/Fax: +31 84 755 2015 Email: claimoffices@aol.nl *************************************************************************** ********** You are to furnish them with the following: 1.First Name: 2. Last Name: 3. Telephone: 4. Fax number: 5. Address: 6. Nationality:: 7. Reference Number: 8. Batch Number: NOTE: All winnings must be claimed not later than 15 days, thereafter unclaimed funds would be forfeited after a trio repeated forwarding of this message to you without your response. Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform us as soon as possible. Congratulations once more from our members of staff and thank you for being part of our promotional program. Sincerely yours, Mrs. Maria Van Plessis (Coordinator) Euro Millions International. From gordonmurrel@gmail.com Wed Apr 29 17:11:32 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.2 required=5.0 tests=BAYES_95,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,SPF_NEUTRAL autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [77.243.225.51 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [77.243.225.51 listed in psbl.surriel.com] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [81.91.228.131 listed in zen.spamhaus.org] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [77.243.225.51 listed in dnsbl.sorbs.net] * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9550] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from srv2.sz-hosting.net (ns4.sz-hosting.net [77.243.225.51]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3U0BSB2024434 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 29 Apr 2009 17:11:32 -0700 Message-Id: <200904300011.n3U0BSB2024434@ga.impsec.org> Received: from [81.91.228.131] (helo=User) by srv2.sz-hosting.net with esmtpa (Exim 4.69) (envelope-from ) id 1LzJKb-0000pH-Dc; Thu, 30 Apr 2009 01:36:49 +0200 Reply-To: From: "Gordon Murrel" Subject: [SPAM] Investment Prospect Date: Wed, 29 Apr 2009 16:28:58 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 090428-0, 04/28/2009), Outbound message X-Antivirus-Status: Not-Tested X-Greylist: Delayed for 00:41:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 29 Apr 2009 17:11:32 -0700 (PDT) X-Spam-Prev-Subject: Investment Prospect Status: R X-Status: X-Keywords: X-UID: 299 Sir/Madam, Considering the sensitive nature of this deal and having thought carefully of a confidant that will assist me in the transaction, I have deemed it pertinent to contact you directly for a prospective business deal in the tune of GBP 34.3 million. I am a Portfolio Manager with UBS financial services Inc. and I am ready and willing to work this deal out with your sincere assistance and cooperation. It will be unwise to jeopardize the success of this transaction at this point by releasing the details as I cannot confirm your exact stand till I receive your response to this email. I will give you the full details of the transaction and how to go about it as soon as I confirm your positive response. Honesty, confidentiality and effective communication is highly needed to ensure prompt conclusion of this deal as this is risk-free and profitable. Regards, Gordon Murrel From nuhanevette@gmail.com Thu Apr 30 13:13:01 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.3 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, BL_COUNTRY_CN_1,BL_COUNTRY_CN_2,BL_COUNTRY_RU_1,DEAR_SOMETHING, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2, MILLIONS_01,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RBL_POXLAY_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SORBS_WEB, SPF_NEUTRAL,SUBJ_ALL_CAPS,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [62.109.184.74 listed in b.barracudacentral.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.5 BL_COUNTRY_CN_2 Mail client in China * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [219.153.65.39 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [219.153.65.39 listed in cn.countries.nerd.dk] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.5ok.ru (mail.5ok.ru [62.109.184.74]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3UKCskf025238 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 30 Apr 2009 13:13:01 -0700 Message-Id: <200904302013.n3UKCskf025238@ga.impsec.org> Received: from User ([219.153.65.39]) (authenticated user test@5ok.ru) by mail.5ok.ru; Wed, 29 Apr 2009 23:41:46 +0400 Reply-To: From: "Dr.Hamza Suleman" Subject: [SPAM] NOTIFICATION OF YOUR CONTRACT PAYMENT!!!!!! 2009 FINANCIAL YEAR Date: Wed, 29 Apr 2009 12:41:44 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 24:21:05 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 30 Apr 2009 13:13:01 -0700 (PDT) X-Spam-Prev-Subject: NOTIFICATION OF YOUR CONTRACT PAYMENT!!!!!! 2009 FINANCIAL YEAR Status: R X-Status: X-Keywords: X-UID: 300 Content-Length: 1837 Dear Sir/Madam, This is to officially inform you that we have verified your contract file presently on my desk, and I found out that you have not received your payment.You are hereby advised to stop dealing with some non-officials in the bank, as this is an illegal act and will have to stop if you so wish to receive your payment immediately. After the Board of director's meeting held in Abuja, we have resolved in finding a solution to your problem. We have arranged your payment through ATM CARD.Therefore if you are interested to receive your ATM card which will be credited with $5,000,000.00 united states dollars before it is been sent to you direct to your doorstep through the FedEx courier service, you will have to respond to me with your full information's, After your response you will be directed to the FedEx shipping courier representative whose name is Mr. Edward Edward.Note: That as soon as you contact the fedex representative they will require you to pay for the delivery charges of the shipmant of your ATM CARD and that is the only money requied from you by the Fedex and no ohter money will be required for the claim of your ATM CARD.You are not required to contact any lawyer in regard to the claim of your contract sum but only the Fedex representative you are to contact. He will send you your ATM CARD, which you will use to withdraw your money via ATM MACHINE in any part of the world, and the maximum daily limit is Fifteen Thousand United States dollars ($15,000.00). (1) Your Full Name(2) Full residential address (3) Phone And Fax Number (4) Occupation.(5) Personal identification. The Nigerian Government supports this message, after you might have startedmaking use of your ATM card, you can reward my firm one way or the other you know best. Thanks for your co-operation. Dr.Hamza Suleman From goodnewforyou@htnhh.com Fri May 1 00:14:47 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.0 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_50,BL_COUNTRY_CN_1,BL_COUNTRY_CN_2,DATE_IN_PAST_12_24,FILL_THIS_FORM_01, HTML_MESSAGE,HTML_STOOPID_01,JM_SOUGHT_FRAUD_1,J_CHICKENPOX_53,LOTTO_WIN_01, LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MIME_BASE64_TEXT,MISSING_HEADERS, RCVD_IN_BRBL,RDNS_DYNAMIC,THOUS_EMAIL_ADDRS,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [61.166.31.9 listed in b.barracudacentral.org] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [61.166.31.9 listed in cn.countries.nerd.dk] * 0.5 BL_COUNTRY_CN_2 Mail client in China * 1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date * 1.3 MISSING_HEADERS Missing To: header * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5696] * 0.5 HTML_STOOPID_01 RAW: stupid HTML: empty FONT tag * 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from htnhh.com (9.31.166.61.broad.yx.yn.dynamic.163data.com.cn [61.166.31.9] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n417EeQQ010709 for ; Fri, 1 May 2009 00:14:46 -0700 Received: from WebMail ([127.0.0.1]) (envelope-sender ) by 127.0.0.1 with ESMTP for ; Fri, 01 May 2009 00:29:02 +0800 Date: Fri, 1 May 2009 0:29:02 +0800 From: "good nwe" Reply-To: "good nwe" Subject: [SPAM] Red Kings Claiming Online Promotions X-Priority: 3 X-Mailer: WebMail Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="--=__b_000_469f38f3a04837c188d59ecdca0a3104" MIME-Version: 1.0 X-Greylist: Delayed for 13:31:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 01 May 2009 00:14:47 -0700 (PDT) X-Spam-Prev-Subject: Red Kings Claiming Online Promotions Status: R X-Status: X-Keywords: X-UID: 301 Content-Length: 8940 This is a multi-part message in MIME format. ----=__b_000_469f38f3a04837c188d59ecdca0a3104 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 DQoNClJlZCBLaW5ncyBDbGFpbWluZyBPbmxpbmUgUHJvbW90aW9ucyANCjI3MSBLaW5ncyBTdHJl ZXQgRWFzdGVybi1DYXBlLCA4MDAxIA0KU291dGggQWZyaWNhDQombmJzcDsNCkNvbmdyYXR1bGF0 aW9ucyEhISEgIllvdSBoYXZlIHdvbiBVU0QkMiw3NTQsMDAwLjAwIGZyb20gUmVkIEtpbmdzIENs YWltaW5nIE9ubGluZSBQcm9tb3Rpb25zIiZuYnNwOw0KJm5ic3A7Jm5ic3A7IA0KV2Ugd2lzaCB5 b3Ugc3VjY2VzcyBpbiBvdXIgUmVkIEtpbmdzIENsYWltaW5nIE9ubGluZSBQcm9tb3Rpb25zL0Vt YWlsIEludGVybmV0IFByb2dyYW0gaGVsZCBpbiBTb3V0aCBBZnJpY2EsIFlvdXIgRW1haWwgQWRk cmVzcyB3YXMgYXR0YWNoZWQgdG8mbmJzcDtTZXJpYWwgTm86IDM0LCAxMSwgYW5kIDQzLDI3LDI5 LDA2IERyZXcgdGhlIEx1Y2t5IE5vOiAwNS0xNy0yMi0yNi01NS0zOCBCb251cyA0NCBmcm9tIDgw MCwwMDAgRW1haWwgQWRkcmVzc2VzIGNvbnNlcXVlbnRseSB3b24gaW4gdGhlIDJuZCBDYXRlZ29y eS4gWW91IGhhdmUgdGhlcmVmb3JlIGJlZW4gYXBwcm92ZWQgdG8gY2xhaW0gYSBTdGFyIFByaXpl IG9mICQyLDc1NCwwMDAuMDAgaW4gY2FzaCBjcmVkaXRlZCB0byBGaWxlIE5vOiA2NzEyMzE0L1pB Ui8yMDA4LiZuYnNwOyBUbyBjbGFpbSB5b3VyIHdpbm5pbmcgcHJpemUsIA0KJm5ic3A7IA0KWW91 IGFyZSBoZXJlYnkgYWR2aXNlZCB0byBDb250YWN0IE91ciBQYXlpbmcgQmFuayB3aXRoIHlvdXIg d2lubmluZyBkZXRhaWxzIGJlbG93IGZvciB0aGUgaW1tZWRpYXRlIHJlbGVhc2Ugb2YgeW91ciBm dW5kLiANCiZuYnNwOyANCkJhbGwmbmJzcDtOdW1iZXI6Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7NS02LTQvMjEtMjQvTU9QLzAwIA0KUG9ja2V0IEFjZSBObzogMTItMTUtMTktMjctMzkv TU9QLzA5IA0KQW1vdW50IFdvbjombmJzcDsmbmJzcDsgVVMkMiw3NTQsMDAwLjAwDQombmJzcDsg DQpZb3VyIHdpbm5pbmcgUHJpemUgaGFzIGJlZW4gaW5zdXJlZCBhbmQgZGVwb3NpdGVkIGluIG91 ciBwYXlpbmcgYmFuayBpbiBhbiBFc2Nyb3cgQWNjb3VudCBQZW5kaW5nIHlvdXIgY2xhaW0uIFdp dGggdGhpcyBwYXltZW50IGZpbGUgcmVmZXJlbmNlIE51bWJlciBvZiBEZXBvc2l0IGlzIE5CLzA1 OTk4ODAgWVgsIFBDQiAwOC4NCg0KQSBUZWxleCBJbnN0cnVjdGlvbiZuYnNwO2hhcyBiZWVuIHRy YW5zbWl0dGVkIHRvIG91ciBwYXlpbmcgYmFuayAoUGF5bWVudCBwcm9jZXNzaW5nIENlbnRlcikg a2luZGx5IGNvbnRhY3QgdGhlbSB3aXRoIHlvdXIgd2lubmluZyBkZXRhaWxzIGZ1bGwgbmFtZXMg YW5kJm5ic3A7eW91ciBQYXltZW50Jm5ic3A7IFJlZmVyZW5jZSBOdW1iZXImbmJzcDtvZiBEZXBv c2l0Jm5ic3A7IGJlbG93IGlzIHRoZWlyIGNvbnRhY3QmbmJzcDtEZXRhaWxzJm5ic3A7QmFuayBO YW1lOiBOZWQgQmFuayBvZiZuYnNwO1NvdXRoIEFmcmljYUNvbnRhY3QgUGVyc29uOiBNci4gRG91 Z2xhcyBTbWl0aChOZWQgQmFuayBTQSBGb3JlaWduIFJlbWl0IERlcGFydG1lbnQpRW1haWw6IG5l ZGJhbmt6YUBnYWxhLm5ldFRlbDombmJzcDsgKzI3LTczLTQ3Mi00MzgyIEZheDogKzI3LTg2LTYx OC03MzY0IA0KJm5ic3A7IA0KWW91IGhlcmUgYnkgQWR2aWNlJm5ic3A7dG8gZmlsbCBhbmQgc3Vi bWl0IHlvdXIgaW5mb3JtYXRpb24gYW5kIHdpbm5pbmcgZGV0YWlscyB0byBvdXIgUGF5aW5nIEJh bmsgaW1tZWRpYXRlbHkgdmlhIA0KRS1tYWlsLiANCiZuYnNwOyANCjEuIE5hbWU6IA0KMi4gRnVs bCBBZGRyZXNzOiANCjMuIE9jY3VwYXRpb246IA0KNC4gQWdlOiANCjUuIFNleDogDQo2LiBDb3Vu dHJ5DQo3LiA5LiBFbWFpbDogDQo4LiBUZWxlcGhvbmUgLyBGYXggTnVtYmVyIA0KOS4gRGlyZWN0 IE1vYmlsZSBQaG9uZSANCjEwIEZpbGUgTnVtYmVyIG9mIERlcG9zaXQgDQombmJzcDsgDQpDb25n cmF0dWxhdGlvbnMnJyBvbmNlIGFnYWluIGZyb20gYWxsIG91ciBTdGFmZiBhbmQgdGhhbmsgeW91 IGZvciBiZWluZyBwYXJ0IG9mIG91ciBQcm9tb3Rpb25zIFByb2dyYW0uIA0KIA0KWW91cnMgVHJ1 bHksJm5ic3A7TXJzLiBGbG9yYSBKLiBDYXJsIFByb21vdGlvbnMgTWFuYWdlciBSZWQgS2luZ3Mg T25saW5lIFByb21vdGlvbnMgKFJlZyBObzogMjAwMC8wMDM3NzgvMDgpDQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj8/Pz8/Pz8/Pz8/ Pz8/Pz8NCg0K ----=__b_000_469f38f3a04837c188d59ecdca0a3104 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: base64 PEhUTUw+PEhFQUQ+PE1FVEEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvSEVBRD48Qk9EWT48RElWPg0KPERJViBpZD15aXYxODI1 MjUyMTYwPjxGT05UIGNvbG9yPSM3ZjAwMDAgc2l6ZT00Pg0KPERJVj48Rk9OVCBjb2xvcj0jZmYw MDAwPlJlZCBLaW5ncyBDbGFpbWluZyBPbmxpbmUgUHJvbW90aW9ucyA8L0ZPTlQ+PC9ESVY+DQo8 RElWPjxGT05UIGNvbG9yPSNmZjAwMDA+MjcxIEtpbmdzIFN0cmVldCBFYXN0ZXJuLUNhcGUsIDgw MDE8L0ZPTlQ+PC9GT05UPjxGT05UIGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PEZPTlQgY29sb3I9 I2ZmMDAwMCBzaXplPTM+IDwvRk9OVD48L0RJVj48L0ZPTlQ+PEZPTlQgY29sb3I9I2ZmMDAwMCBz aXplPTQ+DQo8RElWPlNvdXRoIEFmcmljYTwvRElWPjwvRk9OVD48Rk9OVCBjb2xvcj0jN2YwMDAw IHNpemU9NT48L0ZPTlQ+PEZPTlQgc2l6ZT0yPg0KPERJVj4mbmJzcDs8L0RJVj4NCjxESVY+Q29u Z3JhdHVsYXRpb25zISEhISAiWW91IGhhdmUgd29uIFVTRCQyLDc1NCwwMDAuMDAgZnJvbSBSZWQg S2luZ3MgQ2xhaW1pbmcgT25saW5lIFByb21vdGlvbnMiJm5ic3A7PC9ESVY+DQo8RElWPiZuYnNw OyZuYnNwOyA8L0RJVj4NCjxESVY+V2Ugd2lzaCB5b3Ugc3VjY2VzcyBpbiBvdXIgUmVkIEtpbmdz IENsYWltaW5nIE9ubGluZSBQcm9tb3Rpb25zL0VtYWlsIEludGVybmV0IFByb2dyYW0gaGVsZCBp biBTb3V0aCBBZnJpY2EsIFlvdXIgRW1haWwgQWRkcmVzcyB3YXMgYXR0YWNoZWQgdG8mbmJzcDtT ZXJpYWwgTm86IDM0LCAxMSwgYW5kIDQzLDI3LDI5LDA2IERyZXcgdGhlIEx1Y2t5IE5vOiAwNS0x Ny0yMi0yNi01NS0zOCBCb251cyA0NCBmcm9tIDgwMCwwMDAgRW1haWwgQWRkcmVzc2VzIGNvbnNl cXVlbnRseSB3b24gaW4gdGhlIDJuZCBDYXRlZ29yeS4gWW91IGhhdmUgdGhlcmVmb3JlIGJlZW4g YXBwcm92ZWQgdG8gY2xhaW0gYSBTdGFyIFByaXplIG9mICQyLDc1NCwwMDAuMDAgaW4gY2FzaCBj cmVkaXRlZCB0byBGaWxlIE5vOiA2NzEyMzE0L1pBUi8yMDA4LiZuYnNwOyBUbyBjbGFpbSB5b3Vy IHdpbm5pbmcgcHJpemUsIDwvRElWPg0KPERJVj4mbmJzcDs8L0ZPTlQ+PEZPTlQgZmFjZT0iVGlt ZXMgTmV3IFJvbWFuIj48Rk9OVCBzaXplPTM+IDwvRk9OVD48L0RJVj48L0ZPTlQ+PEZPTlQgc2l6 ZT0yPg0KPERJVj5Zb3UgYXJlIGhlcmVieSBhZHZpc2VkIHRvIENvbnRhY3QgT3VyIFBheWluZyBC YW5rIHdpdGggeW91ciB3aW5uaW5nIGRldGFpbHMgYmVsb3cgZm9yIHRoZSBpbW1lZGlhdGUgcmVs ZWFzZSBvZiB5b3VyIGZ1bmQuPC9GT05UPjxGT05UIGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PEZP TlQgc2l6ZT0zPiA8L0ZPTlQ+PC9ESVY+PC9GT05UPjxGT05UIHNpemU9Mj4NCjxESVY+Jm5ic3A7 PC9GT05UPjxGT05UIGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PEZPTlQgc2l6ZT0zPiA8L0ZPTlQ+ PC9ESVY+PC9GT05UPjxGT05UIHNpemU9Mj4NCjxESVY+QmFsbCZuYnNwO051bWJlcjombmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs1LTYtNC8yMS0yNC9NT1AvMDAgPC9ESVY+DQo8RElWPlBv Y2tldCBBY2UgTm86IDEyLTE1LTE5LTI3LTM5L01PUC8wOTwvRk9OVD48Rk9OVCBmYWNlPSJUaW1l cyBOZXcgUm9tYW4iPjxGT05UIHNpemU9Mz4gPC9GT05UPjwvRElWPjwvRk9OVD48Rk9OVCBzaXpl PTI+DQo8RElWPkFtb3VudCBXb246Jm5ic3A7Jm5ic3A7IFVTJDIsNzU0LDAwMC4wMDwvRElWPg0K PERJVj4mbmJzcDs8L0ZPTlQ+PEZPTlQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48Rk9OVCBzaXpl PTM+IDwvRk9OVD48L0RJVj48L0ZPTlQ+PEZPTlQgc2l6ZT0yPg0KPERJVj5Zb3VyIHdpbm5pbmcg UHJpemUgaGFzIGJlZW4gaW5zdXJlZCBhbmQgZGVwb3NpdGVkIGluIG91ciBwYXlpbmcgYmFuayBp biBhbiBFc2Nyb3cgQWNjb3VudCBQZW5kaW5nIHlvdXIgY2xhaW0uIFdpdGggdGhpcyBwYXltZW50 IGZpbGUgcmVmZXJlbmNlIE51bWJlciBvZiBEZXBvc2l0IGlzIE5CLzA1OTk4ODAgWVgsIFBDQiAw OC48L0RJVj48L0ZPTlQ+PEZPTlQgc2l6ZT0xPg0KPERJVj48L0RJVj48L0ZPTlQ+PEZPTlQgc2l6 ZT0yPg0KPERJVj5BIFRlbGV4IEluc3RydWN0aW9uJm5ic3A7aGFzIGJlZW4gdHJhbnNtaXR0ZWQg dG8gb3VyIHBheWluZyBiYW5rIChQYXltZW50IHByb2Nlc3NpbmcgQ2VudGVyKSBraW5kbHkgY29u dGFjdCB0aGVtIHdpdGggeW91ciB3aW5uaW5nIGRldGFpbHMgZnVsbCBuYW1lcyBhbmQmbmJzcDt5 b3VyIFBheW1lbnQmbmJzcDsgUmVmZXJlbmNlIE51bWJlciZuYnNwO29mIERlcG9zaXQmbmJzcDsg YmVsb3cgaXMgdGhlaXIgY29udGFjdCZuYnNwO0RldGFpbHM8QlI+Jm5ic3A7PEJSPjxTVFJPTkc+ QmFuayBOYW1lOiBOZWQgQmFuayBvZiZuYnNwO1NvdXRoIEFmcmljYTxCUj5Db250YWN0IFBlcnNv bjogTXIuIERvdWdsYXMgU21pdGg8QlI+KE5lZCBCYW5rIFNBIEZvcmVpZ24gUmVtaXQgRGVwYXJ0 bWVudCk8QlI+RW1haWw6IDwvU1RST05HPjwvRk9OVD48Rk9OVCBjb2xvcj0jMDAwMGZmIHNpemU9 Mj48U1RST05HPm5lZGJhbmt6YUBnYWxhLm5ldDwvU1RST05HPjwvRk9OVD48Rk9OVCBzaXplPTI+ PEJSPjxTVFJPTkc+VGVsOiZuYnNwOyArMjctNzMtNDcyLTQzODIgPEJSPkZheDogKzI3LTg2LTYx OC03MzY0PC9TVFJPTkc+PC9GT05UPjxGT05UIGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PEZPTlQg c2l6ZT0zPiA8L0ZPTlQ+PC9ESVY+PC9GT05UPjxGT05UIHNpemU9Mj4NCjxESVY+Jm5ic3A7PC9G T05UPjxGT05UIGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PEZPTlQgc2l6ZT0zPiA8L0ZPTlQ+PC9E SVY+PC9GT05UPjxGT05UIHNpemU9Mj4NCjxESVY+WW91IGhlcmUgYnkgQWR2aWNlJm5ic3A7dG8g ZmlsbCBhbmQgc3VibWl0IHlvdXIgaW5mb3JtYXRpb24gYW5kIHdpbm5pbmcgZGV0YWlscyB0byBv dXIgUGF5aW5nIEJhbmsgaW1tZWRpYXRlbHkgdmlhIDwvRElWPg0KPERJVj5FLW1haWwuPC9GT05U PjxGT05UIGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PEZPTlQgc2l6ZT0zPiA8L0ZPTlQ+PC9ESVY+ PC9GT05UPjxGT05UIHNpemU9Mj4NCjxESVY+Jm5ic3A7PC9GT05UPjxGT05UIGZhY2U9IlRpbWVz IE5ldyBSb21hbiI+PEZPTlQgc2l6ZT0zPiA8L0ZPTlQ+PC9ESVY+PC9GT05UPjxGT05UIHNpemU9 Mj4NCjxESVY+MS4gTmFtZTogPC9ESVY+DQo8RElWPjIuIEZ1bGwgQWRkcmVzczo8L0ZPTlQ+PEZP TlQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIiBzaXplPTM+IDwvRk9OVD48L0RJVj4NCjxESVY+PEZP TlQgc2l6ZT0yPjMuIE9jY3VwYXRpb246IDwvRElWPg0KPERJVj40LiBBZ2U6IDwvRElWPg0KPERJ Vj41LiBTZXg6IDwvRElWPg0KPERJVj42LiBDb3VudHJ5PC9ESVY+DQo8RElWPjcuIDkuIEVtYWls OiA8L0RJVj4NCjxESVY+OC4gVGVsZXBob25lIC8gRmF4IE51bWJlciA8L0RJVj4NCjxESVY+OS4g RGlyZWN0IE1vYmlsZSBQaG9uZSA8L0RJVj4NCjxESVY+MTAgRmlsZSBOdW1iZXIgb2YgRGVwb3Np dCA8L0RJVj4NCjxESVY+Jm5ic3A7PC9GT05UPjxGT05UIGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+ PEZPTlQgc2l6ZT0zPiA8L0ZPTlQ+PC9ESVY+PC9GT05UPjxGT05UIHNpemU9Mj4NCjxESVY+Q29u Z3JhdHVsYXRpb25zJycgb25jZSBhZ2FpbiBmcm9tIGFsbCBvdXIgU3RhZmYgYW5kIHRoYW5rIHlv dSBmb3IgYmVpbmcgcGFydCBvZiBvdXIgUHJvbW90aW9ucyBQcm9ncmFtLjwvRk9OVD48Rk9OVCBm YWNlPSJUaW1lcyBOZXcgUm9tYW4iPjxGT05UIHNpemU9Mz4gPC9GT05UPjwvRElWPjwvRk9OVD48 Rk9OVCBzaXplPTI+DQo8RElWPiA8L0RJVj4NCjxESVY+PFNUUk9ORz5Zb3VycyBUcnVseSwmbmJz cDs8QlI+TXJzLiBGbG9yYSBKLiBDYXJsIDxCUj5Qcm9tb3Rpb25zIE1hbmFnZXIgPEJSPlJlZCBL aW5ncyBPbmxpbmUgUHJvbW90aW9ucyA8QlI+KFJlZyBObzogMjAwMC8wMDM3NzgvMDgpPC9TVFJP Tkc+PC9ESVY+PC9GT05UPjwvRElWPjwvRElWPjwvQk9EWT48L0hUTUw+DQo8cHJlPl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPz8/Pz8/ Pz8/Pz8/Pz8/Pw0KPC9wcmU+DQo= ----=__b_000_469f38f3a04837c188d59ecdca0a3104-- From feetfirst@winch.twcbc.com Sat May 2 10:05:27 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n42H5QZr024528 for ; Sat, 2 May 2009 10:05:27 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******* X-Spam-Status: Yes, score=7.2 required=5.0 tests=BAYES_99,DEAR_SOMETHING, FROM_SUBDOMAIN,MSGID_FROM_MTA_HEADER autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.2 FROM_SUBDOMAIN From address is a third-level domain * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Sat, 02 May 2009 10:05:27 -0700 (PDT) Received: from hrndva-commlb.mail.rr.com (hrndva-commlb.mail.rr.com [71.74.57.8]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n42H04wP002518 for ; Sat, 2 May 2009 10:00:07 -0700 Received: from rrcs-agw-01.hrndva.rr.com ([24.28.200.151]) by hrndva-comm-mta03.mail.rr.com with ESMTP id <20090502163834.DMAP1137.hrndva-comm-mta03.mail.rr.com@rrcs-agw-01.hrndva.rr.com> for ; Sat, 2 May 2009 16:38:34 +0000 Message-Id: <7h9gbp$d1bjvo@rrcs-agw-01b.hrndva.rr.com> Received: from unknown (HELO rrcs-out.biz.rr.com) ([172.28.200.142]) by rrcs-agw-01b.hrndva.rr.com with SMTP; 02 May 2009 12:38:34 -0400 X-Mailer: Openwave WebEngine, version 2.8.17 (webedge20-101-1107-20041027) From: Amanda Reply-To: elcukoffice14@btinternet.com To: Subject: [SPAM] Dear Sir/Madam Date: Sat, 2 May 2009 11:38:34 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 00:21:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 02 May 2009 10:00:08 -0700 (PDT) X-Spam-Prev-Subject: Dear Sir/Madam Status: R X-Status: X-Keywords: X-UID: 302 Your email ID was awarded 950,000,00 GBP in the Global Promo. Send us email about your full info. Name:........................... Country:........................ Age/Tell Number:................ Sex..................... From nal_pat@mail.com Sat May 2 05:35:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************* X-Spam-Status: Yes, score=19.8 required=5.0 tests=BAYES_99,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,J_CHICKENPOX_52,L_SOME_STD_PROBS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, SPAMMY_WEBMAIL,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [222.255.23.22 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.6 URG_BIZ BODY: Contains urgent matter * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 76] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 76] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mailserver.bacgiang.gov.vn (mail.bacgiang.gov.vn [222.255.23.22] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n42CZ0HW027685 for ; Sat, 2 May 2009 05:35:06 -0700 Received: from mail.bacgiang.gov.vn (unknown [10.82.254.27]) by mailserver.bacgiang.gov.vn (Postfix) with ESMTP id 39534745E8; Sat, 2 May 2009 18:40:49 +0700 (ICT) Received: from 10.82.254.2 (SquirrelMail authenticated user loctv_hiephoa); by mail.bacgiang.gov.vn with HTTP; Sat, 2 May 2009 18:40:49 +0700 (ICT) Message-ID: <5824.10.82.254.2.1241264449.squirrel@10.82.254.2> Date: Sat, 2 May 2009 18:40:49 +0700 (ICT) Subject: [SPAM] With Great Honour And Respect From: "Mrs Nalini Patel" Reply-To: mrsnalinipatel@yahoo.com.hk User-Agent: SquirrelMail/1.5.0 MIME-Version: 1.0 Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal To: undisclosed-recipients:; X-Greylist: Delayed for 01:29:39 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 02 May 2009 05:35:06 -0700 (PDT) X-Spam-Prev-Subject: With Great Honour And Respect Status: R X-Status: X-Keywords: X-UID: 303 Dear Beloved in Christ, I am Mrs. Nalini Patel.,suffering from cancerous ailment.I was married to Mr.Robert Patel,my husband worked with Chevron/Texaco in the United Kingdom for twenty years before he died in the year 2003. My late husband deposited the sum of £ 17.5 Million (Seventeen Million Five Hundred Thousand Pounds) with a Bank in United Kingdom.Recently,my Doctor told me that I have limited days to live due to the stroke and cancerous problems I am suffering from.I have decided to donate this fund to you and want you to use this husbands effort to fund the upkeep of widows and charities worldwide.I took this decision because I do not have any child that will inherit this money and my husband relatives are bourgeois and very wealthy persons and I do not want my husband hard earned money to be misused.Awaiting your urgent reply via my email address: mrsnalinipatel@yahoo.com.hk With God all things are possible. Your Sister in Christ, Mrs. Nalini Patel. From walmartsurvey@walmartstores.com Sat May 2 10:07:10 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.7 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG, LOTTO_YOU_WON_03,L_SOME_STD_PROBS,MIME_HTML_ONLY,MISSING_HEADERS,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, RDNS_NONE autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [69.199.35.34 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.3 MISSING_HEADERS Missing To: header * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from stevelouth.com ([69.199.35.34]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n42H76ks002928 for ; Sat, 2 May 2009 10:07:10 -0700 Received: from User ([71.43.144.138]) by stevelouth.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 2 May 2009 08:33:38 -0600 Reply-To: From: "Wal*Mart Payments dept." Subject: [SPAM] Congratulations.You have been selected Date: Sat, 2 May 2009 10:40:25 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 02 May 2009 14:33:38.0737 (UTC) FILETIME=[FBA38210:01C9CB32] X-Greylist: Delayed for 01:07:49 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 02 May 2009 10:07:10 -0700 (PDT) X-Spam-Prev-Subject: Congratulations.You have been selected Status: R X-Status: X-Keywords: X-UID: 304 Content-Length: 1942

Congratulations!

You have been selected by Wal-Mart Stores, Inc. Online Department to take part in our quick and easy reward survey.
In return we will credit $150 to your account - Just for your time!

Helping us better understand how our customers feel, benefits everyone.
With the information collected we can decide to direct a number of changes to improve and expand our services.
The information you provide us is all non-sensitive and anonymous. No part of it is handed down to any third party groups.
It will be stored in our secure database for maximum of 3 days while we process the results of this nationwide survey.

To access the form, please click on the link below :

http://walmartstores.com/Survey/

Lee Scott
President and Chief Executive Officer
Wal-Mart Stores, Inc.

From chineudha@yahoo.com.hk Sat May 2 14:05:59 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.3 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FREEMAIL_FROM, HTML_MESSAGE,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_42, J_CHICKENPOX_52,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,MIME_HTML_ONLY, MISSING_HEADERS,MSOE_MID_WRONG_CASE,RBL_PSBL_01,RCVD_IN_BRBL, RCVD_IN_NJABL_RELAY,RDNS_NONE,SUBJ_ALL_CAPS,URG_BIZ,US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 2.7 RCVD_IN_NJABL_RELAY RBL: NJABL: sender is confirmed open relay * [69.85.52.82 listed in combined.njabl.org] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [69.85.52.82 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [69.85.52.82 listed in psbl.surriel.com] * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 1.6 URG_BIZ BODY: Contains urgent matter * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.cmsius.com ([69.85.52.82]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n42L5s25009635 for ; Sat, 2 May 2009 14:05:59 -0700 Received: from User [41.202.93.126] by mail.cmsius.com with ESMTP (SMTPD32-8.04) id A637144D01DA; Mon, 27 Apr 2009 15:23:35 -0400 Reply-To: From: "Chine Udha" Subject: [SPAM] URGENT AND CONFIDENTIAL ASSIST Date: Mon, 27 Apr 2009 20:17:05 +0100 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200904271523505.SM01268@User> X-Greylist: Delayed for 73:21:06 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 02 May 2009 14:05:59 -0700 (PDT) X-Spam-Prev-Subject: URGENT AND CONFIDENTIAL ASSIST Status: R X-Status: X-Keywords: X-UID: 305 Content-Length: 1884
(Hello Dear)
How are you and every members of your family we hope fine It is my pleasure to identify with you.I am Chine Udha and My younger brother Joel is 18 years we are from sierra leone but residing in Ivory Coast in Africa. It is my desire to contact you on honesty and sincerity to assist us in transferring the sum ofUS$5.600.000 (FIVE MILLION SIX HUNDRED THOUSAND,UNITED STATES DOLLARS)inherited from my late father Udha Johnson to your country for investment.
 
It is sad to say that he passed away mysteriously in France during one of his business trips broad.Though his sudden death was linked or rather suspected to have been masterminded by our wicked uncle who travelled with him at that time.But God knows the truth,we are motivated to contact you after our prayers, and as we get to know you better, we hope to gradually build trust, relationship and confidence in you as our step parent.So if you can be in position to assist us in any way, we will be glad and willing to offer you 20% of the total sum for your assistance in retrieving the money and effort input after the successful transfer of this money and  investment.
 
Indicate your interest towards assisting us by sending your phone # and address so that we can communicate with you at any time.we need your expected guidance in investing the money in any profitable business investment in your country.If you are willing to assist us, kindly get back to us immediately with your adequate communication.
 
Thanks
Chine and Joel
 
 
 
 From euromillionslottnl@ymail.com Sat May 2 15:01:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************************** X-Spam-Status: Yes, score=52.0 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_RU_1,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,KAM_LOTTO1,KAM_LOTTO2,LOTTO_AGENT,LOTTO_FROM,LOTTO_MANY, LOTTO_WIN_02,LOTTO_YOU_WON_02,MISSING_HEADERS,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_LOTTO_SPAM2,STOX_51,SUBJ_ALL_CAPS, THOUS_EMAIL_ADDRS,UNCLAIMED_MONEY autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [82.151.104.66 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.46.87.68 listed in dnsbl.sorbs.net] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [82.151.104.66 listed in psbl.surriel.com] * 2.0 LOTTO_FROM Admits to being a lottery * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.5 STOX_51 Line Noise message subject * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 3.1 UNCLAIMED_MONEY BODY: People just leave money laying around * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_02 BODY: * Winner * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.belnet.ru (mail.belnet.ru [82.151.104.66]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n42M1Jpd011097 for ; Sat, 2 May 2009 15:01:25 -0700 Received: from User [213.46.87.68] by mail.belnet.ru with ESMTP (SMTPD-10.02) id A3D538F4; Sat, 02 May 2009 22:41:25 +0400 Reply-To: From: "Euro Millions Lottery" Subject: [SPAM] EURO MILLIONS LOTTERY WINNER !!!!!!!!! Date: Sat, 2 May 2009 20:41:23 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200905022241214.SM00424@User> X-IMAIL-SPAM-BULK: (93d4024700007e21) X-CTCH-RefID: str=0001.0A0B0209.49FCA6C6.0294,ss=3,sh,fgs=0 X-Greylist: Delayed for 01:18:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 02 May 2009 15:01:26 -0700 (PDT) X-Spam-Prev-Subject: EURO MILLIONS LOTTERY WINNER !!!!!!!!! Status: R X-Status: X-Keywords: X-UID: 306 Content-Length: 2676 EURO MILLIONS LOTTERY INTERNATIONAL. www.euro-millions.com FROM: INTERNATIONAL PROMOTION/PRIZE AWARD DEPT. REFERENCE: 897/60/IPDHJK662091 BATCH: EU-983-741-2883992MG02 Sir/Madam, The EURO MILLIONS Promotion team is proud to inform you of the Euro Millions Lottery Online International E-mail programs held on the 24TH OF APRIL 2009.And result where release on the 2ND OF MAY 2009. Your E-mail address attached to ticket number 07 09 31 29 41 07 02 with serial main number 605-990-291-681 which consequently won in the 1ST category, you have therefore been approved for a lump sum pay out of 1.000.000.00 Euro. (One Million Euro). CONGRATULATIONS!!!!!!!!!!!!!!! Due to mix up of some numbers and names, we ask that you keep your winning information confidential until your claims has been processed and your money remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 100,000 company and 50,000,000 individual email addresses and names from all over the world. This lottery was promoted and sponsored by European Union Lottery Board in order to enhance and promote the use of Internet Explorer Users and Microsoft-wares around the globe. This promotional program takes place once in a week . We hope with part of your winning you will take part in our middle of year 28 million Euro International Jackpot. To file in for the processing and release of your money, you are advised to contact our accredited claims agent with the information stated below: *************************************************************************** *********** Name: Mr. John Raymer Tel/Fax: +31 84 755 2015 Email: claimoffices@aol.nl *************************************************************************** ********** You are to furnish them with the following: 1.First Name: 2. Last Name: 3. Telephone: 4. Fax number: 5. Address: 6. Nationality:: 7. Reference Number: 8. Batch Number: NOTE: All winnings must be claimed not later than 15 days, thereafter unclaimed funds would be forfeited after a trio repeated forwarding of this message to you without your response. Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform us as soon as possible. Congratulations once more from our members of staff and thank you for being part of our promotional program. Sincerely yours, Mrs. Maria Van Plessis (Coordinator) Euro Millions International. From greg.williams0987@gmail.com Sun May 3 01:14:48 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************************** X-Spam-Status: Yes, score=29.5 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, J_CHICKENPOX_64,MILLIONS_01,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SARE_FRAUD_X4, SPF_NEUTRAL,STOX_30,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [203.151.232.104 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [203.151.232.104 listed in psbl.surriel.com] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 96] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 96] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from vps2.aww.de (vps2.aww.de [213.198.73.165]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n438EhSt028436 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 3 May 2009 01:14:48 -0700 Received: from User (host104.elife.co.th [203.151.232.104] (may be forged)) (authenticated bits=0) by vps2.aww.de (8.13.6.20060614/8.13.6) with ESMTP id n42JnIG6063168; Sat, 2 May 2009 19:50:10 GMT Message-Id: <200905021950.n42JnIG6063168@vps2.aww.de> Reply-To: From: "Greg Williams" To: greg.williams0987@gmail.com Subject: [SPAM] GOODDAY Date: Sat, 2 May 2009 20:53:13 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 08:33:03 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 03 May 2009 01:14:48 -0700 (PDT) X-Spam-Prev-Subject: GOODDAY Status: R X-Status: X-Keywords: X-UID: 307 Content-Length: 2246 Greg Williams, Private E-mail: greg.williams789@gmail.com SUBJECT: BENEFICIARY SUM OF 30 MILLION POUNDS STERLING GB. I am seeking for your co-operation to present you to my bank as the next of kin/will beneficiary to Mr.Heinz Menger, a foreign contractor from Cologne, Germany who died on a plane crash on July 25th 2000 with his wife Sigrid Menger. His wife and their two children also perished in the air France Concorde New York bound flight; please click here for verification. http://news.bbc.co.uk/1/hi/world/europe/859479.stm Before his death, he was a contractor to British National Petroleum Co-operation (BNPC) and has a bank balance with my bank to the tune of (30 million pounds sterling GBP) which will be paid to you as his next of kin/will beneficiary. For your information, I am the Branch Manager with HSBC Bank Plc London. The board of directors of HSBC Bank Plc which I am also a member, mandated me to look for any known relation of Mr.Heinz Menger, since after his death. However, all my efforts traces abortive, that is the main reason I am writing you this to ask for your co-operation for us to claim this money because it will amount to injustice if I do not take this decisive step to secure this deposit and invest it, because if nobody comes forward to claim the fund it will be forfeited to the government, based on that I have contacted you to assist me in making this transaction a reality. I only have to approve you as the next of kin/will beneficiary and the fund will be paid to you as the beneficiary. We are to share this money between ourselves and also donate 10% to charity and the tsunami victims if you are really interested in this offer you should contact me through this email address: greg.williams789@gmail.com For detail of this transaction and procedures, please do forward me your full address, phone number/mobile number,your company name or occupation these info will enable me commence immediately to secure all legal documents in your favor on your acceptance to fully co-operate with me. I await your urgent response at my private email greg.williams789@gmail.com to enable us start this project and nurture it to reality. Yours faithfully, Greg Williams, From krnelson@nb.sympatico.ca Tue May 5 17:35:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n460Z2e3030416 for ; Tue, 5 May 2009 17:35:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******** X-Spam-Status: Yes, score=8.1 required=5.0 tests=BAYES_99,FREEMAIL_FORGED, J_CHICKENPOX_47,LOTTO_AGENT,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,RBL_PSBL_01, SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [206.47.199.151 listed in psbl.surriel.com] * -0.0 SPF_PASS SPF: sender matches SPF record * 0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Tue, 05 May 2009 17:35:03 -0700 (PDT) Received: from simq1-srv.bellnexxia.net (simq1-qfe0.srvr.bell.ca [206.47.199.151]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n460Y07J006631 for ; Tue, 5 May 2009 17:34:04 -0700 Received: from simip9-ac.srvr.bell.ca ([206.47.199.87]) by simmts12-srv.bellnexxia.net (InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP id <20090505233345.EHEY1599.simmts12-srv.bellnexxia.net@simip9-ac.srvr.bell.ca> for ; Tue, 5 May 2009 19:33:45 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AmgfANdoAErOL8cR/2dsb2JhbACBUIttDTPCRINvBQ Received: from simfep4.srvr.bell.ca (HELO smtpacout.sympatico.ca) ([206.47.199.17]) by simip9-ac.srvr.bell.ca with SMTP; 05 May 2009 19:40:03 -0400 X-Mailer: Openwave WebEngine, version 2.8.10 (webedge20-101-191-20030113) X-Originating-IP: [87.106.70.19] From: Toyota Company Reply-To: kellyscott74@aim.com To: Subject: [SPAM] Confirm and claim your award Date: Tue, 5 May 2009 19:33:45 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Message-Id: <20090505233345.EHEY1599.simmts12-srv.bellnexxia.net@simip9-ac.srvr.bell.ca> X-Greylist: Delayed for 00:51:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 05 May 2009 17:34:04 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n460Y07J006631 X-Spam-Prev-Subject: Confirm and claim your award Status: R X-Status: X-Keywords: X-UID: 308 You have won our toyota sales promotion of 1,000000 and a car.Send your Name,Address,Age and Occupation for claim:Claimsofficer:Mr Kelly Scott Email:kellyscott74@aim.com regards, Joanna Kelvin From hcunningham@rrohio.com Wed May 6 06:05:32 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n46D5TFo008095 for ; Wed, 6 May 2009 06:05:31 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****** X-Spam-Status: Yes, score=6.7 required=5.0 tests=BAYES_99,FREEMAIL_FORGED, MSGID_FROM_MTA_HEADER,TO_MALFORMED autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.2 TO_MALFORMED To: has a malformed address * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Wed, 06 May 2009 06:05:31 -0700 (PDT) Received: from hrndva-commlb.mail.rr.com (hrndva-commlb.mail.rr.com [71.74.57.9]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n46D4v73026920 for ; Wed, 6 May 2009 06:05:01 -0700 Received: from rrcs-agw-01.hrndva.rr.com ([24.28.200.151]) by hrndva-comm-mta01.mail.rr.com with ESMTP id <20090506124928.XDT26812.hrndva-comm-mta01.mail.rr.com@rrcs-agw-01.hrndva.rr.com> for ; Wed, 6 May 2009 12:49:28 +0000 Message-Id: <7h9gbp$d2l3ha@rrcs-agw-01b.hrndva.rr.com> Received: from unknown (HELO rrcs-out.biz.rr.com) ([172.28.200.142]) by rrcs-agw-01b.hrndva.rr.com with SMTP; 06 May 2009 08:49:28 -0400 X-Mailer: Openwave WebEngine, version 2.8.17 (webedge20-101-1107-20041027) From: Joan Reply-To: siemensagt@gmail.com To: Subject: [SPAM] Winner Date: Wed, 6 May 2009 7:49:28 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 00:15:27 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 06 May 2009 06:05:01 -0700 (PDT) X-Spam-Prev-Subject: Winner Status: R X-Status: X-Keywords: X-UID: 309 Fill for claim of 750,000,00 GBP in the Siemens Promo. Send us email about your full infor. Name:........................... Country:........................ Sex:............................ Age/Tell Number:................ From offer@actionaidinternational.com Mon May 4 14:18:36 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.1 required=5.0 tests=BAYES_99,BL_COUNTRY_FR_2, FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_54,J_CHICKENPOX_55,J_CHICKENPOX_71,J_CHICKENPOX_84, LOTTO_YOU_WON_03,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha * 0.6 J_CHICKENPOX_55 BODY: 5alpha-pock-5alpha * 0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 53] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 53] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [90.2.38.90 listed in dnsbl.sorbs.net] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp2f.orange.fr (smtp2f.orange.fr [80.12.242.150]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n44LIVPC024710 for ; Mon, 4 May 2009 14:18:36 -0700 Received: from smtp2f.orange.fr (mwinf2f14 [10.232.18.42]) by mwinf2f05.orange.fr (SMTP Server) with ESMTP id 96BBA1C0E248 for ; Mon, 4 May 2009 21:27:57 +0200 (CEST) Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf2f14.orange.fr (SMTP Server) with ESMTP id B15F98000173; Mon, 4 May 2009 21:27:52 +0200 (CEST) Received: from cabinetfar.fr (ASt-Lambert-153-1-115-90.w90-2.abo.wanadoo.fr [90.2.38.90]) by mwinf2f14.orange.fr (SMTP Server) with ESMTP id 2060E80000AC; Mon, 4 May 2009 21:27:52 +0200 (CEST) X-ME-UUID: 20090504192752132.2060E80000AC@mwinf2f14.orange.fr Received: from User ([66.161.159.130]) by cabinetfar.fr with Microsoft SMTPSVC(6.0.3790.211); Mon, 4 May 2009 21:29:54 +0200 Reply-To: From: "Action Aid International" Subject: [SPAM] Your Online Job Application!!! Date: Mon, 4 May 2009 15:27:51 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: X-OriginalArrivalTime: 04 May 2009 19:29:54.0828 (UTC) FILETIME=[B3D73CC0:01C9CCEE] To: undisclosed-recipients:; X-Greylist: Delayed for 01:16:48 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 04 May 2009 14:18:36 -0700 (PDT) X-Spam-Prev-Subject: Your Online Job Application!!! Status: R X-Status: X-Keywords: X-UID: 310 Content-Length: 2589 Actionaid International Registered Charity Number 274467 I.R.S.Number 31-6019598 www.actionaid.org.uk howeb2@gmail.com Good Day, It is my pleasure to write you in respect of my Company,I am Bright Howe Executive Director Actionaid International.Our organization is a charity foundation which enhances social sensitivity to the problem of children.We are in search of a reliable representative who can help us establish a medium of getting to our customers in canada and the USA as legally receiving cash,certified check,money order,bank wire transfer and all forms of payment on our behalf from our donors as our representative,all you need to do is receive this payment from our clients in the states, canada in form of check or money orders,travellers check and bank wire transfer,then get it cashed in your bank after which you deduct your 10% commission and forward the balance to the company via western union or money gram where the funds are urge and urgently needed. Actionaid International APPLICATION FORM FULL NAME HOME ADDRESS (NOT POST OFFICE BOX)..... CITY ................. STATE..................... ZIP CODE........... COUNTRY .............. PHONE NUMBER (S) HOME ....... CELL ........... GENDER ........... MARITAL STATUS.......... AGE ............... NATIONALITY.......... BANK NAME.............. Send the following information to my private email account : howeb2@gmail.com,for more details and information about the job. (Information included in this application form is confidential between you and me, and the full name and contact info should be included as it should be written on the payments being issued over to you, you should also include a valid phone number for easy contact) ATTESTATION According to how you have been briefed earlier by me. You are required and mandated to receive payment on behalf of the above mentioned firm. You are to deduct 10% of all funds processed on a particular order and forward the balance payment via Western Union Money Transfer or money gram as I would be instructing you on receipt of the payments. In agreement to this kindly append signature below =============================================================== Bright Howe . Director Actionaid International Bright Howe Director Actionaid International www.actionaid.org.uk howeb2@gmail.com From lotterycompany@financier.com Mon May 4 15:46:07 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.9 required=5.0 tests=BAYES_99,DEAR_WINNER, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3, KAM_LOTTO1,LOTTO_ADMITS,LOTTO_WIN_01,LOTTO_YOU_WON_02,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9986] * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 LOTTO_WIN_01 BODY: Winning * * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.amnettgu.com (mail.amnettgu.com [200.30.157.16]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n44Mk2uB026896; Mon, 4 May 2009 15:46:06 -0700 Message-Id: <200905042246.n44Mk2uB026896@ga.impsec.org> Received: from User ([77.208.79.99]) by mail.amnettgu.com (IceWarp 9.3.2 RHEL5.2) with ASMTP id LJF02458; Mon, 04 May 2009 10:27:58 -0600 Reply-To: From: "Lottomatica" Subject: [SPAM] LOTTOMATICA WINNER DETAILS Date: Tue, 5 May 2009 00:24:12 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:21:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 04 May 2009 15:46:06 -0700 (PDT) X-Spam-Prev-Subject: LOTTOMATICA WINNER DETAILS Status: R X-Status: X-Keywords: X-UID: 311 Content-Length: 1238 Dear winner, Our records indicate that you have qualified as one the lucky winners to receive the LOTTOMATICA International winning prize jackpot. |WINNING DETAILS Draw#: 1077 Batch#: XX8032XX Reference#: 77ES/411/-00775ES Credited to File: LTO/001355011 Results were released on the 1st May 2009 in Madrid. Your E-mail Address attached, won you a sum of 1.000.000.00 (One Million Euro). The fastest and easiest way to receive your prize award is to confirm your winning as soon as possible. Please do so by contacting Estrada Claims Agency, Madrid- Spain within 7days from the date of the receipt of this notification: CONTACT: ANTONIO ESTRADA E-MAIL: agentmd@luckymail.com TELEPHONE: 0034693533386 Remember to quote your - "WINNING DETAILS" - Congratulations, Maripau Callejon Lottomatica S.p.A Media Communication, Annexe, Madrid Spain =========================================================================================== Warning! Fraudulent emails are circulating that appears to be using LOTTOMATICA International addresses, but are not from The LOTTOMATICA International. PLEASE REPORT IMMEDIATELY. Copyright 2009 The LOTTOMATICA International Lottery Inc. All rights reserved. Terms of Service - Guideline From lotterycompany@financier.com Mon May 4 16:17:02 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.9 required=5.0 tests=BAYES_99,DEAR_WINNER, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3, KAM_LOTTO1,LOTTO_ADMITS,LOTTO_WIN_01,LOTTO_YOU_WON_02,L_SOME_STD_PROBS, MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 LOTTO_WIN_01 BODY: Winning * * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.elfinanciero.cl (diariofinanciero.cl [200.29.67.38] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n44NGo3K027985 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 4 May 2009 16:16:57 -0700 Message-Id: <200905042316.n44NGo3K027985@ga.impsec.org> Received: from User ([77.208.79.99]) by mail.elfinanciero.cl (Merak 8.0.3) with ASMTP id LAS26311; Mon, 04 May 2009 18:23:58 -0400 Reply-To: From: "Lottomatica" Subject: [SPAM] LOTTOMATICA WINNER DETAILS Date: Tue, 5 May 2009 00:23:57 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:52:51 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 04 May 2009 16:16:59 -0700 (PDT) X-Spam-Prev-Subject: LOTTOMATICA WINNER DETAILS Status: R X-Status: X-Keywords: X-UID: 312 Content-Length: 1238 Dear winner, Our records indicate that you have qualified as one the lucky winners to receive the LOTTOMATICA International winning prize jackpot. |WINNING DETAILS Draw#: 1077 Batch#: XX8032XX Reference#: 77ES/411/-00775ES Credited to File: LTO/001355011 Results were released on the 1st May 2009 in Madrid. Your E-mail Address attached, won you a sum of 1.000.000.00 (One Million Euro). The fastest and easiest way to receive your prize award is to confirm your winning as soon as possible. Please do so by contacting Estrada Claims Agency, Madrid- Spain within 7days from the date of the receipt of this notification: CONTACT: ANTONIO ESTRADA E-MAIL: agentmd@luckymail.com TELEPHONE: 0034693533386 Remember to quote your - "WINNING DETAILS" - Congratulations, Maripau Callejon Lottomatica S.p.A Media Communication, Annexe, Madrid Spain =========================================================================================== Warning! Fraudulent emails are circulating that appears to be using LOTTOMATICA International addresses, but are not from The LOTTOMATICA International. PLEASE REPORT IMMEDIATELY. Copyright 2009 The LOTTOMATICA International Lottery Inc. All rights reserved. Terms of Service - Guideline From petejohnsonphhf@live.fr Tue May 5 00:14:44 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.9 required=5.0 tests=BAYES_99,DATE_IN_PAST_96_XX, FORGED_MUA_OUTLOOK,J_CHICKENPOX_31,J_CHICKENPOX_41,J_CHICKENPOX_57, J_CHICKENPOX_61,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, RCVD_NUMERIC_HELO,SPF_SOFTFAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [74.86.114.75 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.7 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 2.1 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.si-sv3256.com (mail.si-sv3256.com [74.86.114.75]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n457EejE008372 for ; Tue, 5 May 2009 00:14:44 -0700 Message-Id: <200905050714.n457EejE008372@ga.impsec.org> Received: from 41.208.168.232 [41.208.168.232] by mail.si-sv3256.com with SMTP; Tue, 5 May 2009 09:53:39 +0300 Reply-To: From: "Peter Johnson" To: petejohnsonp@live.fr Subject: [SPAM] Hello Friend, Date: Tue, 28 Apr 2009 18:16:30 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:18:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 05 May 2009 00:14:44 -0700 (PDT) X-Spam-Prev-Subject: Hello Friend, Status: R X-Status: X-Keywords: X-UID: 313 Hello Friend, This mail correspondence may come to you as a surprise due to the fact that we have not met,i know that this is an unlikely platform to start this kind of relationship but i am constrained by the present situation of my family and i request you to permit me use this medium to introduce myself,I am a liberian and was the personal aide on domestic affairs to our former president,Mr.Charles Taylor. I am currently in Dakar,Senegal and would need your co-operation in moving out some funds from here for investments in your country. For your help,i will be happy to share the funds with you according to an agreed percentage. Please indicate your interest in working with me so that i can give you full details.If i do not hear from you in 7 days, i shall consider it that you are not favourably disposed to accept my offer. Thanks, Peter Johnson From wadknightly001@gmail.com Tue May 5 02:36:27 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.9 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,DATE_IN_FUTURE_06_12,DEAR_SOMETHING,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SPF_NEUTRAL, THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9995] * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail7.sea5.speakeasy.net (mail7.sea5.speakeasy.net [69.17.117.9]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n459aM4X011967 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 5 May 2009 02:36:27 -0700 Message-Id: <200905050936.n459aM4X011967@ga.impsec.org> Received: (qmail 28640 invoked from network); 5 May 2009 09:36:08 -0000 Received: from unknown (HELO User) (wade@[216.250.221.147]) (envelope-sender ) by mail7.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 5 May 2009 09:36:06 -0000 Reply-To: From: "Wade Knightly" Subject: [SPAM] Investment Partnership Date: Tue, 5 May 2009 10:43:28 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: Investment Partnership Status: R X-Status: X-Keywords: X-UID: 314 Content-Length: 1387 RE: PROPERTY, LOAN AND EQUITY FINANCING Dear Sir, I am Wade Knightly. I write you this email on behalf of my employer who is interested in working with you after getting your contact information from an Internet directory My employer is a businessman based in Scotland and a licensed financial advisor. We represent a client who wishes to convert her assets into investments and after looking at the growth prospects we have decided to invest in your country. We shall be considering several sectors with our main focus on Property Development, Loan and Equity Financing. We do need to register a new company and have a citizen as one of its directors and this is why my employer has asked me to contact you as we would like to work with you in accomplishing our investment aims in your country. As I cannot ascertain if your email is still functional and if you will have interest in this process, I have kept the details short and simple. Kindly contact me if you would like to work with us so that we can discuss further. You may reach me on the telephone number provided below, however as the details to be sent would be fairly large, it would be best to communicate by email. Please send your response to my private email: wadeknightly@inbox.com I anticipate your response. Yours Sincerely. Wade Knightly. Tel: (0044) 702 402 3508 Email: wadeknightly@inbox.com From p.wong2009@live.com Tue May 5 03:47:20 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.4 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, BL_COUNTRY_TW_1,BL_COUNTRY_TW_2,DATE_IN_PAST_24_48,DEAR_FRIEND, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,J_CHICKENPOX_61,MILLIONS_01,MILLION_USD,MSOE_MID_WRONG_CASE, RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, RCVD_IN_SORBS_WEB,SPF_SOFTFAIL,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [220.130.6.14 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 1.2 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [194.24.158.8 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [194.24.158.8 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [220.130.6.14 listed in tw.countries.nerd.dk] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from twimc.com.tw (twimc.com.tw [220.130.6.14]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n45AlDsu013780 for ; Tue, 5 May 2009 03:47:20 -0700 Received: from User (vie-nas-ge-0-2.onenet.at [194.24.158.8]) by twimc.com.tw (Postfix) with ESMTP id 528C4374581; Tue, 5 May 2009 12:16:04 +0800 (CST) Reply-To: From: "Mr.Peter Wong" Subject: [SPAM] From Mr.Peter Wong,(please contact me for more info) Date: Sun, 3 May 2009 06:17:40 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090505041604.528C4374581@twimc.com.tw> To: undisclosed-recipients:; X-Greylist: Delayed for 06:23:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 05 May 2009 03:47:20 -0700 (PDT) X-Spam-Prev-Subject: From Mr.Peter Wong,(please contact me for more info) Status: R X-Status: X-Keywords: X-UID: 315 Content-Length: 1148 Dear Friend, An Iraqi named Haider Hanoon,a business man made a numbered fixed deposit of (346,736,899.68 HKD) for 18 calendar months, this is valued to Fourty Four million Five Hundred Thousand United State Dollars only in my branch. Upon maturity several notices was sent to him, even during the war, six years ago (2003). Again after the war another notification was sent and still no response came from him. We later found out that Abdullah Al-Hakim Rashid and his family had been killed during the war in Gunfire that hit their home at Mukaradeeb where his personal oil well was. My proposal to you is that I prepared to front you as the sole beneficiary of my deceased client so that I can instruct HANG SENG BANK to release the deposit to you as the closest surviving relation. Upon receipt of the deposit, I am prepared to share the money with you in half 50/50 percentage. If you are interested do send me your full names, current home address, phone number, your occupation to this email account (p.wong2009@yahoo.com.hk) Your earliest reply will be appreciated. Yours Sincerely, Mr.Peter Wong E-mail: p.wong2009@yahoo.com.hk From info@national-lottery.co.uk Wed May 6 05:33:56 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=22.0 required=5.0 tests=BAYES_99,DEAR_WINNER, FILL_THIS_FORM_01,FILL_THIS_FORM_02,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_3, LOTTERY_PH_004470,LOTTO_ADMITS,LOTTO_FROM,MILLIONS_01,RCVD_IN_BRBL, SPAMMY_WEBMAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 LOTTO_FROM Admits to being a lottery * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 1.0 FILL_THIS_FORM_02 BODY: Fill in your personal info * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [194.29.203.145 listed in b.barracudacentral.org] * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 2.0 LOTTERY_PH_004470 LOTTERY_PH_004470 * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? Received: from home.mtulink.com (home.mtulink.com [194.29.203.145]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n46CXqm0026130 for ; Wed, 6 May 2009 05:33:56 -0700 Received: from mtulink.com (localhost [127.0.0.1]) by home.mtulink.com (Postfix) with SMTP id D4CA0287927; Wed, 6 May 2009 13:50:43 +0200 (CEST) Received: from 41.219.150.83 (SquirrelMail authenticated user cmberg) by home.mtulink.com with HTTP; Wed, 6 May 2009 13:50:43 +0200 (CEST) Message-ID: <63523.41.219.150.83.1241610643.squirrel@home.mtulink.com> Date: Wed, 6 May 2009 13:50:43 +0200 (CEST) Subject: [SPAM] LUCKY No: 887-13-865-23-01-09 From: "Uk National Lottery" To: X-Priority: 3 Importance: Normal X-MSMail-Priority: Normal Reply-To: drkyleevan@googlemail.com X-Mailer: SquirrelMail (version 1.2.6) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Greylist: Delayed for 00:33:20 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 06 May 2009 05:33:56 -0700 (PDT) X-Spam-Prev-Subject: LUCKY No: 887-13-865-23-01-09 Status: R X-Status: X-Keywords: X-UID: 316 UK NATIONAL LOTTERY HEADQUARTERS P O Box 1010 Liverpool, (Customer Services) Dear Winner, We are pleased to inform you of the result of the just concluded annual final draws of UNITED KINGDOM NATIONAL PROGRAM. After this automated computer ballot, your e-mail address emerged as one of two winnersin the category "A" You are therefore been approve to claim the sum of 1,000,000 (One Million Pounds Sterling) with the information below: REF No UK/9420X2/68/@ BATCH No: 2005MJL-01 LUCKY No: 887-13-865-23-01-09 TICKET No: 56475600545188 Contact the processing Consultant : Contact Person: Dr Kyle Evan Email: drkyleevan@googlemail.com Telephone: +44 703 5970 593. PAYMENT PROCESSING FORM: (1) FULL NAME (2) FULL ADDRESS (3) NATIONALITY (4 ) AGE (5) OCCUPATION (6) TELEPHONE NUMBER (7) SEX (8) CURRENT COUNTRY (9) MARITAL STATUS Best Regards, Caroline Bryan. Uk National Lottery. From alimatu_manee52@msn.com Wed May 6 08:24:12 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.1 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FILL_THIS_FORM_01,FREEMAIL_FROM,FREEMAIL_REPLYTO, HTML_MESSAGE,MISSING_HEADERS,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3,SARE_FRAUD_X4, SARE_FRAUD_X5,SPF_PASS,SUBJ_ALL_CAPS,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9998] * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.6 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from blu0-omc2-s2.blu0.hotmail.com (blu0-omc2-s2.blu0.hotmail.com [65.55.111.77]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n46FO8SB031018 for ; Wed, 6 May 2009 08:24:12 -0700 Received: from BLU139-W7 ([65.55.111.73]) by blu0-omc2-s2.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 6 May 2009 08:07:43 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_b8a1ff38-77cf-4d29-a369-dfdf71cf4cf7_" X-Originating-IP: [41.203.236.72] Reply-To: From: alimatu manee Subject: [SPAM] PLEASE CONSIDER THIS, URGENT RESPOND NEEDED Date: Wed, 6 May 2009 15:07:42 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 06 May 2009 15:07:43.0221 (UTC) FILETIME=[67E60250:01C9CE5C] X-Greylist: Delayed for 00:16:23 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 06 May 2009 08:24:12 -0700 (PDT) X-Spam-Prev-Subject: PLEASE CONSIDER THIS, URGENT RESPOND NEEDED Status: R X-Status: X-Keywords: X-UID: 317 Content-Length: 8750 --_b8a1ff38-77cf-4d29-a369-dfdf71cf4cf7_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FROM THE DESK OF MRS ALIMATU MANE=20 THE CHIEF AUDITOR IN CHARGE OF FOREIGN=20 REMITTANCE DEPARTMENT=2C BANK OF AFRICA (B.O.A)=20 =20 Dear Partner=2C=20 =20 I presumed that all is well with you and your family. Please let this do no= t be a surprise proposal to you because I got your contact and information = from the international directory few weeks ago before I decided to contact = you on this magnitude and lucrative transaction=2C for our future survival = in life. Moreover=2C I have laid all the solemn trust in you before I decid= ed to disclose this successful & confidential transaction to you.=20 =20 I am MRS ALIMATU MANE=2C THE CHIEF AUDITOR INCHARGE OF THE FOREIGN REMITTAN= CE UNIT of our bank and I have the intention to contact you over this finan= cial transaction worth of USD$18.3M ( EIGHTEEN MILLION THREE HUNDRED THOUSA= ND U.S.A DOLLARS ) for our successful transfer. This is an abandoned sum th= at belongs to one of our bank foreign customers who died along with his ent= ire family through plane crash disaster since few years ago. Meanwhile I wa= s very fortune to came across the deceased file when I was arranging the ol= d and abandoned customers files in other to sign and submit to the entire b= ank management for an official re-documentation and audit of the year again= st 2008.=20 =20 Be informed clearly that it was stated in our banking rules and regulations= which was signed lawfully that if such fund remains unclaimed till the per= iod of 5 years started from the date when the beneficiary died=2C the money= will be transferred into the treasury as an unclaimed fund. As an honour a= nd advantage bestowed to our foreign customers base on the rules guiding ou= r bank=2C it was stated obviously that If you are not a Burkina-Faso citize= n=2C you have the absolute authority to claim the fund hence you are a fore= igner despite your differences from the country of origin of the deceased.= =20 =20 So the request of you as a foreigner is very necessary to apply for the cla= im and transfer of the said fund smoothly into your reliable bank account a= s the NEXT OF KIN OR EXTENDED RELATIVE to the deceased. On the transfer of = this into your account=2C (30%) will be your share in respect of the accoun= t provision and your assistance rendered during the transfer of the said fu= nd into your bank account=2C (60%) will be my own share being the co-ordina= tor of this transaction while the rest (10%) will be shared to the respecta= ble organisation centres such as Charity Organisation=2C Motherless Babies = homes and helpless disabled people in the world.=20 =20 If you are really and very sure of your trustworthy=2C accountability and a= lso confidentiality on this transaction=2C then contact me and agree that y= ou will not change your mind to cheat or disappoint me when the fund hits y= our account. Besides you should not entertain any kind of fear because I am= very sure of the success as an insider in the bank. Should you be interest= ed=2C please contact me through my private email=3B (alimatu_mane@ubbi.com)= so we can commence all arrangements while I will then give you more inform= ation?s on how we would handle this fund transfer and project. Please reply= me with this assurance=2C come up with the information's showed below:- =20 =20 1) YOUR FULL NAME................................... 2) YOUR AGE............................................... 3) MARITAL STATUSES............................... 4) YOUR CELL PHONE NUMBER................... 5) YOUR FAX NUMBER................................. 6) YOUR COUNTRY....................................... 7) YOUR OCCUPATION................................. 8) SEX.......................................................... 9) YOUR RELIGION....................................... 10) YOUR PRIVATE E-MAIL ADDRESS..........=20 =20 I expect your urgent mail and response.=20 =20 Yours sincerely=2C=20 =20 MRS ALIMATU MANE. = --_b8a1ff38-77cf-4d29-a369-dfdf71cf4cf7_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
FROM THE DESK OF MRS ALIMATU MANE
THE CHIEF AUDITOR IN CHA= RGE OF FOREIGN
REMITTANCE DEPARTMENT=2C BANK OF AFRICA (B.O.A)
&nbs= p=3B
Dear Partner=2C
 =3B
I presumed that all is well with = you and your family. Please let this do not be a surprise proposal to you b= ecause I got your contact and information from the international directory = few weeks ago before I decided to contact you on this magnitude and lucrati= ve transaction=2C for our future survival in life. Moreover=2C I have laid = all the solemn trust in you before I decided to disclose this successful &a= mp=3B confidential transaction to you.
 =3B
I am MRS ALIMATU MA= NE=2C THE CHIEF AUDITOR INCHARGE OF THE FOREIGN REMITTANCE UNIT of our bank= and I have the intention to contact you over this financial transaction wo= rth of USD$18.3M ( EIGHTEEN MILLION THREE HUNDRED THOUSAND U.S.A DOLLARS ) = for our successful transfer. This is an abandoned sum that belongs to one o= f our bank foreign customers who died along with his entire family through = plane crash disaster since few years ago. Meanwhile I was very fortune to c= ame across the deceased file when I was arranging the old and abandoned cus= tomers files in other to sign and submit to the entire bank management for = an official re-documentation and audit of the year against 2008.
 = =3B
Be informed clearly that it was stated in our banking rules and reg= ulations which was signed lawfully that if such fund remains unclaimed till= the period of 5 years started from the date when the beneficiary died=2C t= he money will be transferred into the treasury as an unclaimed fund. As an = honour and advantage bestowed to our foreign customers base on the rules gu= iding our bank=2C it was stated obviously that If you are not a Burkina-Fas= o citizen=2C you have the absolute authority to claim the fund hence you ar= e a foreigner despite your differences from the country of origin of the de= ceased.
 =3B
So the request of you as a foreigner is very neces= sary to apply for the claim and transfer of the said fund smoothly into you= r reliable bank account as the NEXT OF KIN OR EXTENDED RELATIVE to the dece= ased. On the transfer of this into your account=2C (30%) will be your share= in respect of the account provision and your assistance rendered during th= e transfer of the said fund into your bank account=2C (60%) will be my own = share being the co-ordinator of this transaction while the rest (10%) will = be shared to the respectable organisation centres such as Charity Organisat= ion=2C Motherless Babies homes and helpless disabled people in the world. <= BR> =3B
If you are really and very sure of your trustworthy=2C acco= untability and also confidentiality on this transaction=2C then contact me = and agree that you will not change your mind to cheat or disappoint me when= the fund hits your account. Besides you should not entertain any kind of f= ear because I am very sure of the success as an insider in the bank. Should= you be interested=2C please contact me through my private email=3B (alimatu_mane@ubbi.com) so we can commence all arrangements while I will then giv= e you more information?s on how we would handle this fund transfer and proj= ect. Please reply me with this assurance=2C come up with the information's = showed below:- =3B
 =3B
1) YOUR FULL NAME..................= .................
2) YOUR AGE...........................................= ....
3) MARITAL STATUSES...............................
4) YOUR CELL = PHONE NUMBER...................
5) YOUR FAX NUMBER......................= ...........
6) YOUR COUNTRY.......................................
7)= YOUR OCCUPATION.................................
8) SEX................= ..........................................
9) YOUR RELIGION.............= ..........................
10) YOUR PRIVATE E-MAIL ADDRESS..........  =3B
I expect your urgent mail and response.
 =3B
Your= s sincerely=2C
 =3B
MRS ALIMATU MANE.
= --_b8a1ff38-77cf-4d29-a369-dfdf71cf4cf7_-- From tclooper@comporium.net Wed May 6 22:47:44 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.2 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, DATE_IN_PAST_24_48,DEAR_FRIEND,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_61,MILLIONS_01,MILLION_USD, MISSING_HEADERS,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,SPF_PASS,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * -0.0 SPF_PASS SPF: sender matches SPF record * 1.2 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date * 1.3 MISSING_HEADERS Missing To: header * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [194.24.158.8 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [194.24.158.8 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from rg4.comporium.net (rg4.comporium.net [208.104.2.24]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n475leWb022034 (version=TLSv1/SSLv3 cipher=DES-CBC3-SHA bits=168 verify=FAIL) for ; Wed, 6 May 2009 22:47:44 -0700 Received: from vie-nas-ge-0-2.onenet.at (EHLO User) ([194.24.158.8]) by rg4.comporium.net (MOS 3.8.4-GA FastPath queued) with ESMTP id BOG34755 (AUTH tclooper@comporium.net); Thu, 07 May 2009 01:27:11 -0400 (EDT) Reply-To: From: "Mr.Peter Wong" Subject: [SPAM] From Mr.Peter Wong,(please contact me for more info) Date: Tue, 5 May 2009 07:30:37 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200905070527.BOG34755@rg4.comporium.net> X-Junkmail-Status: score=52/70, host=rg4.comporium.net X-Junkmail-SD-Raw: score=bulk(2), refid=str=0001.0A090207.4A026497.01FE,ss=3,sh,fgs=0, ip=194.24.158.8, so=2007-03-13 10:31:19, dmn=5.7.1/2008-09-02 X-Greylist: Delayed for 00:16:55 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 06 May 2009 22:47:44 -0700 (PDT) X-Spam-Prev-Subject: From Mr.Peter Wong,(please contact me for more info) Status: R X-Status: X-Keywords: X-UID: 318 Content-Length: 1148 Dear Friend, An Iraqi named Haider Hanoon,a business man made a numbered fixed deposit of (346,736,899.68 HKD) for 18 calendar months, this is valued to Fourty Four million Five Hundred Thousand United State Dollars only in my branch. Upon maturity several notices was sent to him, even during the war, six years ago (2003). Again after the war another notification was sent and still no response came from him. We later found out that Abdullah Al-Hakim Rashid and his family had been killed during the war in Gunfire that hit their home at Mukaradeeb where his personal oil well was. My proposal to you is that I prepared to front you as the sole beneficiary of my deceased client so that I can instruct HANG SENG BANK to release the deposit to you as the closest surviving relation. Upon receipt of the deposit, I am prepared to share the money with you in half 50/50 percentage. If you are interested do send me your full names, current home address, phone number, your occupation to this email account (p.wong2009@yahoo.com.hk) Your earliest reply will be appreciated. Yours Sincerely, Mr.Peter Wong E-mail: p.wong2009@yahoo.com.hk From dr.ronoh44@msn.com Thu May 7 00:39:53 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.4 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE, HTML_STOOPID_01,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_53, J_CHICKENPOX_61,J_CHICKENPOX_64,J_CHICKENPOX_71,MILLIONS_01,MILLION_USD, MISSING_HEADERS,NA_DOLLARS,PHISH_05,RCVD_IN_BL_SPAMCOP_NET,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SPF_PASS,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 HTML_STOOPID_01 RAW: stupid HTML: empty FONT tag * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from blu0-omc4-s16.blu0.hotmail.com (blu0-omc4-s16.blu0.hotmail.com [65.55.111.155]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n477dnqE025110 for ; Thu, 7 May 2009 00:39:53 -0700 Received: from BLU130-W37 ([65.55.111.136]) by blu0-omc4-s16.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 7 May 2009 00:18:04 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_e68c55cd-1aa0-4ef9-977c-1a9e25c5875c_" X-Originating-IP: [41.191.85.17] Reply-To: From: "Dr. Ronoh" Subject: [SPAM] Dr.Ronoh Joseph, Date: Thu, 7 May 2009 07:18:04 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 07 May 2009 07:18:04.0528 (UTC) FILETIME=[F6806F00:01C9CEE3] X-Greylist: Delayed for 00:21:44 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 07 May 2009 00:39:53 -0700 (PDT) X-Spam-Prev-Subject: Dr.Ronoh Joseph, Status: R X-Status: X-Keywords: X-UID: 319 Content-Length: 10400 --_e68c55cd-1aa0-4ef9-977c-1a9e25c5875c_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Dr.Ronoh Joseph=2C=20 In-Charge of Foreign Unit=20 International Bank Cotonou. Benin Republique=2C E-mail! drronoh101@sify.com Greetings=2C=20 (I NEED TRUST)=20 I am Dr.Joseph Ronoh=2CThe Chief Auditor/Information Manager=2CIn-Charge of= Foreign Unit of our bank and i have had the intent to contact you over thi= s financial transaction/transfer worth the sum of Nineteen Million Three Hu= ndred Thousand U.S Dollars (US$19.3M)for our progress and richness.=20 =20 An Iraqi named Abdullah Al-Hakim Rashid=2Ca business man made a numbered fi= xed deposit of ($19.3) for 18 calendar months=2Cthis is valued to ninethee= n million three hundred United States dollars only in my branch.=20 Upon maturity several notices was sent to him=2C even during the war=2C six= years ago (2003).Again after the war another notification was sent and sti= ll no response came from him. We later found out that Abdullah Al-Hakim Ras= hid and his family had been killed during the war in Gunfire that hit their= home at Mukaradeeb where his personal oil well was.My proposal to you is t= hat I prepared to front you as the sole beneficiary of my deceased customer= i can transfer the fund into your norminated bank account=20 =20 I am prepared to share money as following:-I will not fail to inform you th= at this transaction is 100% risk free. On smooth conclusion of this transac= tion=2C you will be entitled to {39%}being US$7=2C527=2C000.00)will be your= share in respect of the account provision and your assistance rendered dur= ing the transfer of the fund into your bank account=2C{ 52% } being (US$10= =2C036=2C000.00) will be my share being the codinator and the pillar of the= transaction while the rest { 9% } being (US$1=2C737=2C000.00) will be shar= ed to the respectable Organisations Centers such as Charity Organisation=2C= Motherless Babies homes=2C and helpless disabled people in the World. =20 Meanwhile all the whole arrangement to put claim over this fund as the bona= fide next of kin to the deceased=2C get the required approval and transfer = this money to a foreign account has been put in place and directives and ne= eded information will be relayed to you as soon as you indicate your intere= st and willingness to assist us and also benefit your self to this great bu= siness opportunity.=20 =20 In fact I could have done this deal alone but because of my position in thi= s country as a civil servant(A Banker)=2Cwe are not allowed to operate a fo= reign account and would eventually raise an eye brow on my side during the = time of transfer because I work in this bank. This is the actual reason why= it will require a second party or fellow who will forward claims as the ne= xt of kin with affidavit of trust of oath to the Bank and also present a fo= reign account where he will need the money to be re-transferred into on his= request as it may be after due verification and clarification by the corre= spondent branch of the bank where the whole money will be remitted from to = your own designation bank account.=20 =20 I will be monitoring the whole situation here in this bank until you confir= m the money in your account and ask me to come down to your country for sub= sequent sharing of the fund according to percentages previously indicated a= nd further investment=2C either in your country or any country you advice u= s to invest in. All other necessary vital information will be sent to you w= hen I hear from you.And i want you to assure me solemnly that you are a trs= utwothy=2Creliable=2Chonest and capable to avoid cheating me in this busine= ss.If you are really sure of your integerity=2C=20 =20 Reply through my private email ( drronoh101@sify.com ) immediatelly you re= ceive this mail for more detailed information on how to process the transfe= r of the fund into your account will be.Am looking forward hearing from you= .=20 I look forward to receive your phone number and email so that I get back to= you.=20 =20 Yours faithfully=2C=20 Dr.Dr.RONOH JOSEPH Telephone +229-9315-2461= --_e68c55cd-1aa0-4ef9-977c-1a9e25c5875c_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Dr.Ronoh Joseph=2C
In-Charge of Foreign Unit =
International Bank
Cotonou. Benin Republique=2C

Greetings=2C
 =3B =3B =3B =3B =3B =3B&= nbsp=3B =3B =3B =3B =3B =3B =3B =3B =3B&nbs= p=3B =3B =3B =3B =3B(I NEED TRUST)
I am Dr.Joseph Ronoh=2CThe Chief Auditor/Informat= ion Manager=2CIn-Charge of Foreign Unit of our bank and i have had the inte= nt to contact you over this financial transaction/transfer worth the sum of=  =3BNineteen Million =3BThree Hundred Thousand U.S Dollars (US$19.3= M)for our progress and richness.
 =3B
An Iraqi n= amed Abdullah Al-Hakim Rashid=2Ca business man made a numbered fixed deposi= t of ($19.3) for =3B =3B18 calendar months=2Cthis is valued to = =3Bninetheen million three hundred United States dollars only in my branch.=
Upon matur= ity several notices was sent to him=2C even during the war=2C six years ago= (2003).Again after the war another notification was sent and still no resp= onse came from him. We later found out that Abdullah Al-Hakim Rashid and hi= s family had been killed during the war in Gunfire that hit their home at M= ukaradeeb My proposal to you is that I prepared to front yo= u as the sole beneficiary of my deceased customer i can transfer the fund i= nto your norminated bank account =3B=
 =3B
I am prepared to share =3Bmoney =3Bas following:-I will not fail to inform you that this= transaction is 100% risk free. On smooth conclusion of this transaction=2C= you will be entitled to {39%}being US$7=2C527=2C000.00)will be your share = in respect of the account provision and your assistance rendered during the= transfer of the fund into your bank account=2C{ 52% } being (US$10=2C036= =2C000.00) will be my share being the codinator and the pillar of the trans= action while the rest { 9% } being (US$1=2C737=2C000.00) will be shared to = the respectable Organisations Centers such as Charity Organisation=2C Mothe= rless Babies homes=2C and helpless disabled people in the World.
 =3B
Meanwhile all the whole arrangement to put claim = over this fund as the bonafide next of kin to the deceased=2C get the requi= red approval and transfer this money to a foreign account has been put in p= lace and directives and needed information will be relayed to you as soon a= s you indicate your interest and willingness to assist us and also benefit = your self to this great business opportunity.
 =3B
In fact I could have done this deal alone but bec= ause of my position in this country as a civil servant(A Banker)=2Cwe are n= ot allowed to operate a foreign account and would eventually raise an eye b= row on my side during the time of transfer because I work in this bank. Thi= s is the actual reason why it will require a second party or fellow who wil= l forward claims as the next of kin with affidavit of trust of oath to the = Bank and also present a foreign account where he will need the money to be = re-transferred into on his request as it may be after due verification and = clarification by the correspondent branch of the bank where the whole money= will be remitted from to your own designation bank account.
 =3B
I will be monitoring the whole situation here in = this bank until you confirm the money in your account and ask me to come do= wn to your country for subsequent sharing of the fund according to percenta= ges previously indicated and further investment=2C either in your country o= r any country you advice us to invest in. All other necessary vital informa= tion will be sent to you when I hear from you.A= nd i want you to assure me solemnly that you are a trsutwothy=2Creliable=2C= honest and capable to avoid cheating me in this business.If you are really = sure of your integerity=2C
 =3B
Reply through my private email ( drronoh101@sify.c= om =3B) =3B immediatelly you receive this mail for more detaile= d information on how to process the transfer of the fund into your account = will be.Am looking forward hearing from you.

I look forward to receive your phone number and email so that I ge= t back to you.
 =3B
Yours faithfully=2C
Dr.Dr.RONOH JOSEPH=
Telephone +229-9315-2461
= --_e68c55cd-1aa0-4ef9-977c-1a9e25c5875c_-- From alhaji_danco600@universia.cl Thu May 7 05:29:49 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,FILL_THIS_FORM_01,FREEMAIL_FROM, HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,J_CHICKENPOX_41,J_CHICKENPOX_42, J_CHICKENPOX_44,J_CHICKENPOX_46,J_CHICKENPOX_47,J_CHICKENPOX_53, J_CHICKENPOX_71,J_CHICKENPOX_74,LOTTO_YOU_WON_03,MILLIONS_01,MILLION_USD, MIME_HTML_ONLY,PHISH_05,RAZOR2_CHECK,SARE_FRAUD_X3,SARE_FRAUD_X4, SARE_FRAUD_X5,SARE_FRAUD_X6,SPAMMY_WEBMAIL,SPF_HELO_PASS,SPF_PASS,STOX_30, SUBJ_ALL_CAPS,UPPERCASE_75_100,US_DOLLARS_3,XHTML_01 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 0.6 J_CHICKENPOX_46 BODY: 4alpha-pock-6alpha * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.5 MILLION_USD BODY: Talks about millions of dollars * 0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 XHTML_01 RAW: Has XML-ish tags in HTML body * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 1.5 UPPERCASE_75_100 message body is 75-100% uppercase * 0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from daganzo.mx1.universia.net (daganzo.mx1.universia.net [195.149.210.98]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n47CTjnS000973 for ; Thu, 7 May 2009 05:29:49 -0700 Received: from mail.universia.net (baterno.univ.corp [192.168.41.103]) by daganzo.mx1.universia.net (Postfix) with SMTP id ACA681E0513; Thu, 7 May 2009 13:44:25 +0200 (CEST) Received: from 41.203.239.161 (SquirrelMail authenticated user alhaji_danco600@universia.cl) by mail.universia.net with HTTP; Thu, 7 May 2009 07:44:26 -0400 (CLT) Message-ID: <49001.41.203.239.161.1241696666.squirrel@mail.universia.net> Date: Thu, 7 May 2009 07:44:26 -0400 (CLT) Subject: [SPAM] PLEASE YOU HAVE ADVISED TO KEEP THIS TRANSACTION VERY SECRET AND CONFIDENTIAL From: "alhaji_danco4000@ymail.com" User-Agent: SquirrelMail/1.4.2 MIME-Version: 1.0 Content-Type: text/html;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal To: undisclosed-recipients:; X-Greylist: Delayed for 00:45:16 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 07 May 2009 05:29:49 -0700 (PDT) X-Spam-Prev-Subject: PLEASE YOU HAVE ADVISED TO KEEP THIS TRANSACTION VERY SECRET AND Status: R X-Status: X-Keywords: X-UID: 320 Content-Length: 4312
TREAT AS URGENT PLEASE !!!!!!!
FROM THE DESK OF DR ALHAJI DANCO
BILL AND EXCHANGE MANAGER
BANK OF AFRICA (BOA)
OUAGADOUGOU - BURKINA FASO
DEAR FRIEND,
I AM MR.ALHAJI DANCO,THE BILL AND EXCHANGE MANAGER IN THE BANK OF AFRICA (BOA), OUAGADOU-BURKINA FASO,IN WEST AFRICA. WITH DUE RESPECT AND REGARDS,I HAVE DECIDED TO CONTACT YOU ON A BUSINESS TRANSACTION THAT WILL BE VERY BENEFICIAL TO BOTH OF US AT HE END OF THE TRANSACTION.IN THE BANK HERE I DISCOVERD A VERY HUGE SUM OF MONEY BELONGING TO A DECEASED PERSON, A FOREIGNER WHO DIED IN A PLANE CRASH WITH HIS ENTIRE FAMILY SOME YEARS BACK HERE AND THE FUND HAS BEEN DORMANT IN HIS ACCOUNT WITH THE BANK HERE,WITHOUT ANYBODY TO CLAIM THE FUND EITHER A MEMBER OF HIS FAMILY OR HIS RELATIVE.
I KEPT THIS INFORMATION SECRET WITHIN MYSELF TO ENABLE THE WHOLE PLAN AND IDEA I HAVE BEEN NURSING OVER THIS FUND IN THE BANK HERE TO BE PROFITABLE AND SUCCESSFUL DURING THE TIME OF EXECUTION OF THIS TRANSACTION.THE AMOUNT INVOLVED IN THIS DEAL IS TEN MILLION UNITED STATES DOLLARS($10,000,000).MEANWHILE,ALL THE WHOLE ARRANGEMENTS AND STRATEGIES NEEDED TO HELP YOU PUT CLAIM OVER THIS FUND AS THE BONA-FIDE NEXT OF KIN OR BENEFICIARY TO THE DECEASED, WILL BEFORWARD TO YOU UPON YOUR ACCEPTANCE TO EXECUTE THIS BUSINESS WITH ME.I WILL SEND YOU ALL THE NECESSARY INFORMATION THAT WILL HELP YOU MAKE SUCCESSFUL CLAIM OF THIS FUND AS SOON AS YOU INDICATE YOUR INTEREST AND WILLINGNESS TO ASSIST ME AND ALSO SHARE THE GREAT BENEFIT TOGETHER WITH ME.
IN FACT,I COULD HAVE DONE THIS DEAL ALONE BUT BECAUSE OF MY POSITION HERE AS A CITIZEN OF THIS COUNTRU AND AS A CIVIL SERVANT(BANK WORKER), WE ARE NOT ALLOWED TO OPERATE A FOREIGN BANK ACCOUNT.THAT WOULD EVENTUALLY RAISE AN EYE BROWN ON MY SIDE DURING THE TIME OF TRANSFER IF I WANT TO CLAIM THE FUND MYSELF ALONE BECAUSE I WORK IN THIS BANK.THIS IS THE ACTUAL REASON WHY IT WILL REQUIRE A FOREIGNER AS A SECOND PARTY,WHO WILL FORWARD CLAIMS AS THE NEXT OF KIN WITH AFFIDAVIT OF TRUST OF OATH TO THE BANK AND ALSO PRESENT A FORIEGN ACCOUNT WHERE THE SAID AMOUNT OF MONEY ($10,MILLION UNTED STATE DOLLARS) WILL BE TRANSFERRED INTO AFTER DUE VERIFICATIONS AND CLARIFICATIONS IN THE BANK HERE.
I
WILL NOT FAIL TO INFORM YOU THAT THIS TRANSACTION IS 100% RISK FREE, ON SMOOTH CONCLUSION OF THIS TRANSACTION, YOU WILL BE ENTITLED TO 35% OF THE TOTAL SUM AS GRATIFICATION, WHILE 5% WILL BE SET ASIDE TO TAKE CARE OF EXPENSES THAT MAY ARISE DURING THE TIME OF TRANSFERRING THE FUND WICH WILL INCLUDE,TELEPHONE BILLS, INTERNET COST,TRANSPORTATION COST, ETC, WHILE 60% WILL BE FOR ME AS THE INITIATOR OF THE DEAL.PLEASE YOU HAVE BEEN ADVICED TO KEEP THIS TRANSACTION VERY CONFIDENTIAL A TOP SECRET AS I AM STILL IN SERVICE AND INTEND TO RETIRE HONOURABLY FROM SERVICE AFTER WE MIGHT HAVE CONCLUDED THIS DEAL WITH EXCELLENT SUCCESS.
I WILL BE MONITORING THE WHOLE SITUATION HERE IN THE BANK UNTIL YOU CONFIRM THE MONEY IN YOUR ACCOUNT AND ASK ME AND MY ENTIRE FAMILY TO COME DOWN TO YOUR COUNTRY FOR SUBSEQUENT SHARING OF THE FUND ACCORDING TO PERCENTAGES WHICH I HAVE CLEARLY INDICATED AND FURTHER INVESTMENT,EITHER IN YOUR COUNTRY OR ANY OTHER COUNTRY YOU MAY ADVICE US TO JOINTLY INVEST.
ALL OTHER NECESSARY INFORMATION WILL BE SENT TO YOU WHEN I HEAR FROM YOU.
PLEASE I SUGGEST THAT YOU GET BACK TO ME AS SOON AS POSSIBLE,STATING YOUR INTEREST CLEARLY ABOUT THIS TRANSACTION.
THANKS AND BEST REGARDS.
YOURS FAITHFULLY,
DR ALHAJI DANCO

MY FULL PARTICULARS ARE AS FOLLOWS:
Full Name:______________
Address:______________
Occupation:______________
Country:______________
Telephone:______________
Sex:______________
Age:______________


Portal Universia Chile - Red de universidades red de oportunidades.
http://www.universia.cl


From wilson.m@voila.fr Fri May 8 14:30:04 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n48LU4BJ025791 for ; Fri, 8 May 2009 14:30:04 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******* X-Spam-Status: Yes, score=7.9 required=5.0 tests=BAYES_95,DEAR_FRIEND, FREEMAIL_FROM,MILLIONS_01,PHISH_05,RCVD_IN_BRBL,SARE_FREE_WEBM_FrVoila autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [66.113.136.12 listed in b.barracudacentral.org] * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9684] * 0.4 SARE_FREE_WEBM_FrVoila Sender used free email account - may be * spammer Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Fri, 08 May 2009 14:30:04 -0700 (PDT) Received: from smapp01.siteprotect.com (smapp01.siteprotect.com [66.113.136.12] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n48LRj6i025890 for ; Fri, 8 May 2009 14:27:49 -0700 Received: from smapp01.siteprotect.com (localhost [127.0.0.1]) by smapp01.siteprotect.com (8.11.6/8.11.6) with ESMTP id n48KYav18851; Fri, 8 May 2009 15:34:36 -0500 Date: Fri, 8 May 2009 15:34:36 -0500 Message-Id: <200905082034.n48KYav18851@smapp01.siteprotect.com> From: "Wilson Moumoudu" To: dr.wilson_moumoudu@yahoo.fr Subject: [SPAM] It may interest you. X-Greylist: Delayed for 00:46:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 08 May 2009 14:27:50 -0700 (PDT) X-Spam-Prev-Subject: It may interest you. Status: R X-Status: X-Keywords: X-UID: 321 Dear friend, Greetings to you and your family. Please don't be offended because i know you do not know me but i really need your help in transferring the sum of (14.5 million dollars) into a foriegn account with your foriegn help, please if you know you can assist me then contact me so we can discuss more about this project. I will be very glad to recieve your response and due to your response it will enable me to brief you more on how to transfer this fund into your account or your credit card if the need maybe, please if you have any question you're very very free to ask me and i will be glad to answer your questions to my best ability, thanks for your understanding and i am hoping to recieve your positive response. Fill this information 1. Direct Phone Number........... 2. Present Home Address.......... Kind regards. Wilson Moumoudu From mrsamandajohnson2310@msn.com Thu May 7 08:32:32 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************* X-Spam-Status: Yes, score=21.0 required=5.0 tests=ADVANCE_FEE_2,BAYES_50, BL_COUNTRY_NG_2,FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MISSING_HEADERS,SARE_FRAUD_X3, SARE_FRAUD_X4,SPF_PASS,STOX_30,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5000] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam Received: from blu0-omc4-s24.blu0.hotmail.com (blu0-omc4-s24.blu0.hotmail.com [65.55.111.163]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n47FWTFa006487 for ; Thu, 7 May 2009 08:32:32 -0700 Received: from BLU127-W51 ([65.55.111.136]) by blu0-omc4-s24.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 7 May 2009 08:16:04 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_6ccd8090-a947-4163-b63b-e81ead6a0142_" X-Originating-IP: [82.128.69.154] Reply-To: From: Mrsamanda Johnson Subject: [SPAM] Please Can You help me !! Date: Thu, 7 May 2009 15:16:04 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 07 May 2009 15:16:04.0076 (UTC) FILETIME=[BCD82AC0:01C9CF26] X-Greylist: Delayed for 00:16:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 07 May 2009 08:32:32 -0700 (PDT) X-Spam-Prev-Subject: Please Can You help me !! Status: R X-Status: X-Keywords: X-UID: 322 Content-Length: 5067 --_6ccd8090-a947-4163-b63b-e81ead6a0142_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: 8bit Greetings in the name of Jesus Christ. Please Can You help me !! I am Mrs.Amanda Johnson, A widow to the Late Clark Johnson, I am 73years old, and I am now a new Christian convert, suffering from long time, cancer of the ear. From all indications my condition is really deteriorating and it's quite obvious that I won't live long according to my doctors. This is because my cancer stage has gotten to a very bad stage.My late husband was killed during the U.S raid, against terrorism in Afghanistan when he traveled to Afghanistan to monitor a Hospital/a Humanitarian Found at (HHF) he was setting up for the benefit of the Afghan masses as of then; whose majority and 99 percent of them are Muslims/ Islamic scholars and loyalists. During the period of our marriage we couldnt produce any child.My late husband was very wealthy and after his death, I inherited all his businesses and wealth, and when I noticed that my condition is not improving rather it gets worsen by the day I decided to divide part of this wealth, to contribute to Charity and the development of the churches in Africa, America, Asia and Europe. I selected you after visiting the internet and I prayed over it.I am willing to donate the fund to you for charity, the less privileged,churches, orphanages and widows, Propagating the word of God and to ensure that the house of God is maintained. I took this decision upon myself because I don't have any child that will inherit this money and my husband relatives are not Christians and I don't want my husband's hard earned money to be misused by unbelievers. Because I have come to find out that wealth acquisition without Christ is vanity upon vanity. Please I want you to note that this fund is deposited with BANK for security purpose. And upon my instruction, you will file in an application for the transfer of the fund in your name with the bank.May the Grace of our Lord Jesus Christ, the love of God, and the fellowship of the Holy Spirit be with you and your family. Await Your Urgent Reply to this my address:(mrs_amandaj@yahoo.com.au) any delay in your reply will give me room in sourcing for a church, another person or Christian individual for this same purpose. Yours in Christ. Mrs Amanda Johnson. --_6ccd8090-a947-4163-b63b-e81ead6a0142_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: 8bit

Greetings in the name of Jesus Christ.
 
Please Can You help me !!

I am Mrs.Amanda Johnson, A widow to the Late Clark Johnson, I am 73years old, and I am now a new Christian convert, suffering from long time, cancer of the ear. From all indications my condition is really deteriorating and it's quite obvious that I won't live long according to my doctors.

This is because my cancer stage has gotten to a very bad stage.My late husband was killed during the U.S raid, against terrorism in Afghanistan when he traveled to Afghanistan to monitor a Hospital/a Humanitarian Found at (HHF) he was setting up for the benefit of the Afghan masses as of then; whose majority and 99 percent of them are Muslims/ Islamic scholars and loyalists. During the period of our marriage we couldnt produce any child.My late husband was very wealthy and after his death, I inherited all his businesses and wealth, and when I noticed that my condition is not improving rather it gets worsen by the day I decided to divide part of this wealth, to contribute to Charity and the development of the churches in Africa, America, Asia and Europe. I selected you after visiting the internet and I prayed over it.I am willing to donate the fund to you for charity, the less privileged,churches, orphanages and widows, Propagating the word of God and to ensure that the house of God is maintained.

I took this decision upon myself because I don't have any child that will inherit this money and my husband relatives are not Christians and I don't want my husband's hard earned money to be misused by unbelievers. Because I have come to find out that wealth acquisition without Christ is vanity upon vanity.

Please I want you to note that this fund is deposited with BANK for security purpose. And upon my instruction, you will file in an application for the transfer of the fund in your name with the bank.May the Grace of our Lord Jesus Christ, the love of God, and the fellowship of the Holy Spirit be with you a nd your family.

Await Your Urgent Reply to this my address:(mrs_amandaj@yahoo.com.au) any delay in your reply will give me room in sourcing for a church, another person or Christian individual for this same purpose.
 
Yours in Christ.

Mrs Amanda Johnson.


--_6ccd8090-a947-4163-b63b-e81ead6a0142_-- From 2MIDAVO20@GMAIL.COM Thu May 7 11:51:14 2009 Return-Path: <2MIDAVO20@GMAIL.COM> X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=24.7 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_60,BL_COUNTRY_KR_1,BL_COUNTRY_KR_2,FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_3, MILLIONS_01,MISSING_HEADERS,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3, SPF_NEUTRAL autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [211.233.14.137 listed in b.barracudacentral.org] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [203.151.232.104 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [203.151.232.104 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_KR_1 RBL: Mail client in Korea * [211.233.14.137 listed in psbl.surriel.com] [211.233.14.137 listed in kr.countries.nerd.dk] * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 1.3 MISSING_HEADERS Missing To: header * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7581] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from digiteki.com (digiteki.com [211.233.14.137]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n47Ip7nA012155 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 7 May 2009 11:51:14 -0700 Received: from User (host104.elife.co.th [203.151.232.104] (may be forged)) (authenticated bits=0) by digiteki.com (8.12.8/8.12.8) with ESMTP id n461TNUN024667; Wed, 6 May 2009 10:29:33 +0900 Message-Id: <200905060129.n461TNUN024667@digiteki.com> Reply-To: From: "David Walker"<2MIDAVO20@GMAIL.COM> Subject: [SPAM] In Respect To Late Edwards Estate! Date: Wed, 6 May 2009 02:28:32 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 41:14:23 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 07 May 2009 11:51:14 -0700 (PDT) X-Spam-Prev-Subject: In Respect To Late Edwards Estate! Status: R X-Status: X-Keywords: X-UID: 323 Content-Length: 2103 Hello, I will like to seek your help in a business proposal , which although is sensitive by nature and not what I should discuss with someone I dont know and have not met using a medium such as this but I do not have a choice . I am Mr. David Walker, personal attorney to late Dr. Edward, who died of a cardiac arrest a few years ago leaving behind a large sum of money with a commercial bank in the Island of Seychelles which is a tax free zone, a place where plenty of rich people tend to hide away funds not ready to be used or invested. I will not mention the amount of money which runs into several millions in United States Dollars and name of bank presently until we have agreed to deal. I trust you will understand the need for such precautions. So far, valuable efforts has been made to get to his people but to no avail, as he had no known relatives more because he left his next of kin column in his account opening forms blank and he has no known relative. Due to this development the bank has come forward to ask us as his personal attorneys to bring forward a close relative to claim the funds otherwise as the Seychelles national laws would have it, any dormant account for five years will be declared unclaimed and then paid into the government purse. To avert this negative development my colleagues and I have decided to look for a reputable person to act as the next of kin to late Dr. Edward so that the funds could be processed and released into his account, which is where you come in. my law firm will also act as your personal attorneys since we will be portraying you as being directly related to our late client being from the same country. All legal documents to aid your claim for this fund and to prove your relationship with the deceased will be provided by us. Your help will be appreciated with 30% of the total sum which I would disclose in my next email Please accept my apologies, keep my confidence and disregard this letter if you do not appreciate this proposition I have offered you. I wait anxiously for your response. Yours Faithfully, David Walker From 2MIDAVO20@gmail.com Fri May 8 00:03:45 2009 Return-Path: <2MIDAVO20@gmail.com> X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.8 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_60,BL_COUNTRY_KR_1,BL_COUNTRY_KR_2,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,MILLIONS_01,MISSING_HEADERS, MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SPF_NEUTRAL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [211.233.14.137 listed in b.barracudacentral.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [203.151.232.104 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [203.151.232.104 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_KR_1 RBL: Mail client in Korea * [211.233.14.137 listed in kr.countries.nerd.dk] * 0.5 BL_COUNTRY_KR_2 Mail client in Korea * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7552] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from digiteki.com (digiteki.com [211.233.14.137]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4873c6a000647 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 8 May 2009 00:03:43 -0700 Received: from User (host104.elife.co.th [203.151.232.104] (may be forged)) (authenticated bits=0) by digiteki.com (8.12.8/8.12.8) with ESMTP id n452ToUN005905; Tue, 5 May 2009 11:30:00 +0900 Message-Id: <200905050230.n452ToUN005905@digiteki.com> Reply-To: From: "David Walker"<2MIDAVO20@gmail.com> Subject: [SPAM] In Respect To Late Edwards Estate! Date: Tue, 5 May 2009 03:27:42 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: In Respect To Late Edwards Estate! Status: R X-Status: X-Keywords: X-UID: 324 Content-Length: 2103 Hello, I will like to seek your help in a business proposal , which although is sensitive by nature and not what I should discuss with someone I dont know and have not met using a medium such as this but I do not have a choice . I am Mr. David Walker, personal attorney to late Dr. Edward, who died of a cardiac arrest a few years ago leaving behind a large sum of money with a commercial bank in the Island of Seychelles which is a tax free zone, a place where plenty of rich people tend to hide away funds not ready to be used or invested. I will not mention the amount of money which runs into several millions in United States Dollars and name of bank presently until we have agreed to deal. I trust you will understand the need for such precautions. So far, valuable efforts has been made to get to his people but to no avail, as he had no known relatives more because he left his next of kin column in his account opening forms blank and he has no known relative. Due to this development the bank has come forward to ask us as his personal attorneys to bring forward a close relative to claim the funds otherwise as the Seychelles national laws would have it, any dormant account for five years will be declared unclaimed and then paid into the government purse. To avert this negative development my colleagues and I have decided to look for a reputable person to act as the next of kin to late Dr. Edward so that the funds could be processed and released into his account, which is where you come in. my law firm will also act as your personal attorneys since we will be portraying you as being directly related to our late client being from the same country. All legal documents to aid your claim for this fund and to prove your relationship with the deceased will be provided by us. Your help will be appreciated with 30% of the total sum which I would disclose in my next email Please accept my apologies, keep my confidence and disregard this letter if you do not appreciate this proposition I have offered you. I wait anxiously for your response. Yours Faithfully, David Walker From soludoprof.charles82@gmail.com Fri May 8 06:58:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************* X-Spam-Status: Yes, score=37.0 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_FR_2,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_25,J_CHICKENPOX_26, J_CHICKENPOX_27,J_CHICKENPOX_28,J_CHICKENPOX_51,J_CHICKENPOX_73,MILLIONS_01, MILLION_USD,MSOE_MID_WRONG_CASE,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,SARE_FRAUD_X3, SARE_FRAUD_X4,SPF_NEUTRAL,STOX_30,SUBJ_ALL_CAPS,UPPERCASE_75_100 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [24.180.134.53 listed in dnsbl.sorbs.net] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 0.6 J_CHICKENPOX_25 BODY: 2alpha-pock-5alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_51 BODY: 5alpha-pock-1alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_26 BODY: 2alpha-pock-6alpha * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_27 BODY: 2alpha-pock-7alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.6 J_CHICKENPOX_28 BODY: 2alpha-pock-8alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 1.5 UPPERCASE_75_100 message body is 75-100% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp2f.orange.fr (smtp2f.orange.fr [80.12.242.150]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n48DwY25012054 for ; Fri, 8 May 2009 06:58:38 -0700 Received: from smtp2f.orange.fr (mwinf2f16 [10.232.18.116]) by mwinf2f05.orange.fr (SMTP Server) with ESMTP id B88F31C0DC29 for ; Fri, 8 May 2009 13:06:59 +0200 (CEST) Received: from User (24-180-134-53.dhcp.aldl-nbb.mi.charter.com [24.180.134.53]) by mwinf2f16.orange.fr (SMTP Server) with ESMTP id 36933800015B; Fri, 8 May 2009 13:05:30 +0200 (CEST) X-ME-UUID: 20090508110531223.36933800015B@mwinf2f16.orange.fr Reply-To: From: "Prof. Charles Soludo" Subject: [SPAM] CHANGE OF ONWERSHIP FROM YOUR RE-PRESENTATIVES (GIVE YOUR DIRECTIONS). Date: Fri, 8 May 2009 12:06:50 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090508110531.36933800015B@mwinf2f16.orange.fr> To: undisclosed-recipients:; X-Greylist: Delayed for 02:02:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 08 May 2009 06:58:38 -0700 (PDT) X-Spam-Prev-Subject: CHANGE OF ONWERSHIP FROM YOUR RE-PRESENTATIVES (GIVE YOUR DIRECTIONS). Status: R X-Status: X-Keywords: X-UID: 325 Content-Length: 3240 FROM: PROFESSOR CHARLES SOLUDO. EXECUTIVE GOVERNOR, CENTRAL BANK OF NIGERIA. CBN BUILDING TINUBU SQUARE, LAGOS NIGERIA. Private Mobile Tel.:+234-706-055-6652. Official E-mail: cbnpaymentunit2009@gmail.com ATTN: BENEFICIARY. CHANGE OF ONWERSHIP FROM YOUR RE-PRESENTATIVES (GIVE YOUR DIRECTIONS). THIS IS TO NOTIFY YOU THAT YOUR OVER DUE INHERITANCE FUNDS HAS BEEN GAZETTED TO BE RELEASED, VIA KEY TELEX TRANSFER (KTT) -DIRECT WIRE TRANSFER TO YOU OR THROUGH ANY OF OUR CORRESPONDENT BANK NOMINATED BY THE SENATE COMMITTEE FOR FOREIGN OVER DUE FUND TRANSFER. IT WAS LATTER MADE KNOWN TO US THAT YOUR FUNDS HAS BEEN TRANSFERED TO OUR BANK AND ITS BEEN LODGE IN AN ACCOUNT HERE WITH OUR BANK. AND YOU ARE ADVISED TO CONFIRM TO US IMMEDIATELY YOU RECEIVED THIS EMAIL SO THAT WE DONT MAKE A WRONG TRANSFER DUE TO PROBLEMS WE ARE HAVING WITH SOMEBODY WHO CLAIM TO BE A RE-PRESENTATIVES THAT WAS SENT BY YOU. MEANWHILE, A WOMAN WHO CAME TO MY OFFICE FEW DAYS AGO WITH A LETTER, CLAIMING TO BE YOUR TRUE REPRESENTATIVE. HERE ARE HER INFORMATION?S FOR YOU TO CONFIRM TO THIS OFFICE IF THIS WOMAN IS TRULY FROM YOU OR NOT SO THAT THE FEDERAL GOVERNMENT WILL NOT BE HELD RESPONSIBLE FOR PAYING INTO ANY WRONG ACCOUNTS. CLAIM?S NAME: JANET WHITE BANK NAME: CITI BANK ARIZONA, USA. ACCOUNT NUMBER: 6503809428. PLEASE, DO RE-CONFIRM TO THIS OFFICE, AS A MATTER OF URGENCY IF THIS WOMAN IS FROM YOU. YOU ARE REQUESTED TO FILL AND SEND THIS INFORMATION?S FOR VERIFICATIONS PURPOSES SO THAT YOUR FUND VALID US$15.5M (FIFTY FIVE MILLION, FIVE HUNDRED THOUSAND UNITED STATE DOLLARS) WILL BE REMITTED INTO YOUR NOMINATED BANK ACCOUNT ANY WHERE. THIS FUND IS AS A RESULT OF INHERITANCE ON YOUR BEHALF. INFORMATION NEEDED FROM YOU FOR VERIFICATION IS AS FOLLOWS: 1. YOUR NAME:.............................. 2. YOUR FULL ADDRESS:...................... 3. YOUR TELEPHONE ......................... 4. FAX.......................... 5. AGE............................ 6. SEX............................ 7. YOUR OCCUPATION.................. 8. YOUR NEXT OF KIN................................... AS SOON AS WE RECEIVE THIS, WE WILL COMMENCE WITH ALL NECESSARY PROCEDURES IN OTHER TO REMIT THIS MONEY INTO YOUR ACCOUNT.THE CENTRAL BANK GOVERNOR, IN CONJUNCTION WITH THE FEDERAL MINISTRY OF FINANCE (FMF) EXECUTIVE BOARD OF DIRECTORS AND THE SENATE COMMITTEE FOR FOREIGN OVER DUE INHERITANCE FUND HAVE APPROVED AND ACCREDITED THIS REPUTABLE BANK WITH THE OFFICE OF THE DIRECTOR, INTERNATIONAL REMITTANCE/ FOREIGN OPERATIONS, TO HANDLE AND TRANSFER ALL FOREIGN INHERITANCE FUNDS THIS QUARTER PAYMENT OF THE YEAR 2009. HOWEVER, WE SHALL PROCEED TO ISSUE ALL PAYMENTS DETAILS TO THE SAID MRS.WHITE, IF WE DO NOT HEAR FROM YOU WITHIN THE NEXT SEVEN WORKING DAYS FROM TODAY. WE ARE SORRY FOR ANY INCONVENIENCE THE DELAY IN TRANSFERRING OF THIS FUND MUST HAVE CAUSED YOU. NB:YOU ARE HEREBY ADVISED TO SCAN AND SEND TO ME YOUR FRONT AND BACK PAGE OF YOUR IDENTITY FOR YOUR IDENTIFICATION,ALSO YOU MUST SEND THIS CODE TO ME ALONG WHEN REPLYING: 242 CODE OF CONDUCT. CONGRATULATIONS. PROF.CHARLES SOLUDO. CENTRAL BANK OF NIG. EXECUTIVE GOVERNOR. CC:LEGAL AND CONFIDENTIAL. CC:OFFICE OF THE PRESIDENCY. CC:FEDERAL HIGH COURT OF NIGERIA. CC:NATIONAL HOUSE OF ASSEMBLY. From info@internationalmonetaryfundcommission.com Fri May 8 13:47:28 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********************************** X-Spam-Status: Yes, score=35.2 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, BL_COUNTRY_FR_2,DEAR_WINNER,FILL_THIS_FORM_02,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,HTML_COMMENTS,HTML_MESSAGE,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,KAM_LOTTO1,KAM_LOTTO2,LOTTERY_PH_004470, LOTTO_AGENT,LOTTO_MANY,LOTTO_RANDOM,LOTTO_WIN_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,MIME_HTML_ONLY,MSOE_MID_WRONG_CASE autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.5 LOTTO_RANDOM BODY: Random selection * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 1.0 FILL_THIS_FORM_02 BODY: Fill in your personal info * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_COMMENTS RAW: Has HTML comments * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.0 LOTTERY_PH_004470 LOTTERY_PH_004470 * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp2b.orange.fr (smtp2c.orange.fr [80.12.242.154]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n48KlOqN024490 for ; Fri, 8 May 2009 13:47:27 -0700 Received: from smtp2c.orange.fr (mwinf2c01 [10.232.23.23]) by mwinf2c15.orange.fr (SMTP Server) with ESMTP id B4A241C035EF for ; Fri, 8 May 2009 22:17:41 +0200 (CEST) Received: from User (host217-34-47-188.in-addr.btopenworld.com [217.34.47.188]) by mwinf2c01.orange.fr (SMTP Server) with ESMTP id 571CF7000081; Fri, 8 May 2009 22:17:11 +0200 (CEST) X-ME-UUID: 20090508201712356.571CF7000081@mwinf2c01.orange.fr Reply-To: From: "GBLC" Subject: [SPAM] GALA BINGO LOTTERY WINNINGS (Details within) Date: Fri, 8 May 2009 21:15:32 +0100 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090508201712.571CF7000081@mwinf2c01.orange.fr> To: undisclosed-recipients:; X-Greylist: Delayed for 00:29:08 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 08 May 2009 13:47:28 -0700 (PDT) X-Spam-Prev-Subject: GALA BINGO LOTTERY WINNINGS (Details within) Status: R X-Status: X-Keywords: X-UID: 326 Content-Length: 7758 Gala bingo
(YOUR WINNING CONFIRMATION GALAC001QC/APRIL/2009)
From the Desk of the Head Coordinator
FREE GALA BINGO E-MAIL LOTTERY PROMO
http://lotto.galabingo.co.uk
The Square Redford
Nottingham shire
DN22 6DB United Kingdom.
Tel: +448715039878
International + (44)702-407-8997
Fax No: + (44)702-407-7692
Office Hours Monday To Saturdays:
Ref: GACSL/208/77

Dear Esteem Winner,

Over the years the prestigious GALA BINGO lottery has set out and successfully organized sweepstakes on a daily, weekly, and annual basis. We have equally maintained a standard unrivaled in the industry as it concerns the pay out of winnings to successful participants.

In line with the commemorating event marking our 20th year anniversary we rolled out over £1,800.000.00 (One million, Eight hundred thousands British Pounds) for our 20th year Anniversary Draws.

Participants for the draws were randomly selected and drawn from a wide range of web hosts which enjoy our patronage. The selection was made through a computer draw system attaching personalized email addresses to ticket numbers.

Your email address as indicated was drawn and attached to Ticket Number 2093961 with serial numbers GL193007 and drew the lucky numbers (12)-(52)-(19)-(22)-(30)-(17) with a bonus number (66) which subsequently won you £250,000.00 (Two Hundred and Fifty Thousand Great British Pounds) as one of the 3 jackpot winners in this draw.

You have therefore been approved the entire winning sum of £250,000.00 (Two Hundred and Fifty Thousand Great British Pounds) in cash credited to File Ref GACSL/6488292-2009/09. The draws registered as Draw number one was conducted in Hampshire, United Kingdom on the 7th of May 2009. This lottery Draws is commemorative and as such special.

Please be informed by this Winning Notification to make contact with your designated corresponding claim official uk who shall by duty guide you through the process to facilitate the release of your winnings.

To file for your claim Please Contact your claims agent.

Contact information below:
Clearance Agent: Mr. Jeff Atkinson
Email: winners@lottogallabingo.com
Email: info@lottogallabingo.com
Tel: +(44)702-409-6560
International: + (44)702-409-6560
Fax Num: + (44)702-407-7692

You are advised to contact your claims agent with the following details to avoid unnecessary delays and complications.

Full Names: ............................................................................................ .........
Contact/Mailing Address: ..............................................................................
Direct Telephone Number/ Cell Phone Number: ........................................
Fax Numbers: ............................................................................................ ......
Nationality: ............................................................................................ ...........
Amount won: ............................................................................................ ......
Occupation: ............................................................................................ .........
Age / Sex: ............................................................................................ .............
Ticket Number: ............................................................................................ ....
Serial Number: ............................................................................................ .....
File Ref: ............................................................................................ ................
Lucky Numbers as indicated in this winning Notification: .........................

Thank you for being part of our commemorative 20th Anniversary Draws.

***Due to possible mix up of some numbers and email contacts, we ask that you keep this award strictly from public notice until your claim has been processed and your money remitted. This is part of our security protocol to avoid double claiming or unscrupulous acts by some participants of this program.***

Congratulations once more from all members and staff of this world promotional lottery programs.


Yours Sincerely,
Jeff Atkinson.
***Customer Support***
NB: Any claim not made before Fourteen(31) working days from date of notification will indicate that the winner has voluntarily forfeited his/her winnings.
From info@internationalmonetaryfundcommission.com Sat May 9 03:23:56 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.2 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, BL_COUNTRY_FR_2,DEAR_WINNER,FILL_THIS_FORM_02,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,HTML_COMMENTS,HTML_MESSAGE,JM_SOUGHT_FRAUD_1, JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,KAM_LOTTO1,KAM_LOTTO2,LOTTERY_PH_004470, LOTTO_AGENT,LOTTO_MANY,LOTTO_RANDOM,LOTTO_WIN_01,LOTTO_YOU_WON_02, MIME_HTML_ONLY,MSOE_MID_WRONG_CASE autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.5 LOTTO_RANDOM BODY: Random selection * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 1.0 FILL_THIS_FORM_02 BODY: Fill in your personal info * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_COMMENTS RAW: Has HTML comments * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.0 LOTTERY_PH_004470 LOTTERY_PH_004470 * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp2f.orange.fr (smtp2f.orange.fr [80.12.242.152]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n49ANofd014371 for ; Sat, 9 May 2009 03:23:56 -0700 Received: from smtp2f.orange.fr (mwinf2f09 [10.232.18.37]) by mwinf2f20.orange.fr (SMTP Server) with ESMTP id D24B11C0CBC3 for ; Sat, 9 May 2009 06:54:07 +0200 (CEST) Received: from User (host217-34-47-188.in-addr.btopenworld.com [217.34.47.188]) by mwinf2f09.orange.fr (SMTP Server) with ESMTP id 186FC800014F; Sat, 9 May 2009 06:53:33 +0200 (CEST) X-ME-UUID: 20090509045334100.186FC800014F@mwinf2f09.orange.fr Reply-To: From: "GBLC" Subject: [SPAM] GALA BINGO LOTTERY WINNINGS (Details within) Date: Sat, 9 May 2009 05:51:59 +0100 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090509045334.186FC800014F@mwinf2f09.orange.fr> To: undisclosed-recipients:; X-Greylist: Delayed for 04:46:55 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 09 May 2009 03:23:56 -0700 (PDT) X-Spam-Prev-Subject: GALA BINGO LOTTERY WINNINGS (Details within) Status: R X-Status: X-Keywords: X-UID: 327 Content-Length: 7750 Gala bingo
(YOUR WINNING CONFIRMATION GALAC001QC/APRIL/2009)
From the Desk of the Head Coordinator
FREE GALA BINGO E-MAIL LOTTERY PROMO
http://lotto.galabingo.co.uk
The Square Redford
Nottingham shire
DN22 6DB United Kingdom.
Tel: +448715039878
International + (44)702-407-8997
Fax No: + (44)702-407-7692
Office Hours Monday To Saturdays:
Ref: GACSL/208/77

Dear Esteem Winner,

Over the years the prestigious GALA BINGO lottery has set out and successfully organized sweepstakes on a daily, weekly, and annual basis. We have equally maintained a standard unrivaled in the industry as it concerns the pay out of winnings to successful participants.

In line with the commemorating event marking our 20th year anniversary we rolled out over £1,800.000.00 (One million, Eight hundred thousands British Pounds) for our 20th year Anniversary Draws.

Participants for the draws were randomly selected and drawn from a wide range of web hosts which enjoy our patronage. The selection was made through a computer draw system attaching personalized email addresses to ticket numbers.

Your email address as indicated was drawn and attached to Ticket Number 2093961 with serial numbers GL193007 and drew the lucky numbers (12)-(52)-(19)-(22)-(30)-(17) with a bonus number (66) which subsequently won you £250,000.00 (Two Hundred and Fifty Thousand Great British Pounds) as one of the 3 jackpot winners in this draw.

You have therefore been approved the entire winning sum of £250,000.00 (Two Hundred and Fifty Thousand Great British Pounds) in cash credited to File Ref GACSL/6488292-2009/09. The draws registered as Draw number one was conducted in Hampshire, United Kingdom on the 7th of May 2009. This lottery Draws is commemorative and as such special.

Please be informed by this Winning Notification to make contact with your designated corresponding claim official uk who shall by duty guide you through the process to facilitate the release of your winnings.

To file for your claim Please Contact your claims agent.

Contact information below:
Clearance Agent: Mr. Jeff Atkinson
Email: winners@lottogallabingo.com
Email: info@lottogallabingo.com
Tel: +(44)702-409-6560
International: + (44)702-409-6560
Fax Num: + (44)702-407-7692

You are advised to contact your claims agent with the following details to avoid unnecessary delays and complications.

Full Names: ............................................................................................ .........
Contact/Mailing Address: ..............................................................................
Direct Telephone Number/ Cell Phone Number: ........................................
Fax Numbers: ............................................................................................ ......
Nationality: ............................................................................................ ...........
Amount won: ............................................................................................ ......
Occupation: ............................................................................................ .........
Age / Sex: ............................................................................................ .............
Ticket Number: ............................................................................................ ....
Serial Number: ............................................................................................ .....
File Ref: ............................................................................................ ................
Lucky Numbers as indicated in this winning Notification: .........................

Thank you for being part of our commemorative 20th Anniversary Draws.

***Due to possible mix up of some numbers and email contacts, we ask that you keep this award strictly from public notice until your claim has been processed and your money remitted. This is part of our security protocol to avoid double claiming or unscrupulous acts by some participants of this program.***

Congratulations once more from all members and staff of this world promotional lottery programs.


Yours Sincerely,
Jeff Atkinson.
***Customer Support***
NB: Any claim not made before (31) working days from date of notification will indicate that the winner has voluntarily forfeited his/her winnings.
From franke77@sify.com Sat May 9 18:15:19 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.5 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DEAR_FRIEND,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,J_CHICKENPOX_57,J_CHICKENPOX_81,L_SOME_STD_PROBS,MILLIONS_01, MSOE_MID_WRONG_CASE,PHISH_05,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_SBL,RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SARE_FREE_WEBM_ZCom01, SUBJ_ALL_CAPS,URG_BIZ,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.6 SARE_FREE_WEBM_ZCom01 Sender used free email account - may be * spammer * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.182.250 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.182.250 listed in zen.spamhaus.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.182.250 listed in psbl.surriel.com] * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.6 J_CHICKENPOX_81 BODY: 8alpha-pock-1alpha * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from post-app3.tdpserver.net (tdpmailserv-1.net [38.119.86.4]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4A1FDeu007013 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sat, 9 May 2009 18:15:19 -0700 Received: from User (unknown [196.3.182.250]) by post-app3.tdpserver.net (Postfix) with ESMTPA id 494C180AEE; Sat, 9 May 2009 17:56:53 -0700 (PDT) Reply-To: From: "Franke John Bull" Subject: [SPAM] CAN YOU HANDLE THIS PROJECT? Date: Sun, 10 May 2009 01:59:22 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090510005654.494C180AEE@post-app3.tdpserver.net> To: undisclosed-recipients:; X-Greylist: Delayed for 00:15:29 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 09 May 2009 18:15:19 -0700 (PDT) X-Spam-Prev-Subject: CAN YOU HANDLE THIS PROJECT? Status: R X-Status: X-Keywords: X-UID: 328 Content-Length: 1679 Dear Friend, I have a proposal for you, this however is not mandatory nor will I in any manner compel you to honor the content against your will. I am Franke Johnbull,I work with a bank (one of the leading banks in Africa). Here in this bank exists a dormant account for the past 6 years which belongs to an American national who is now late, Mr. John Culbertson's, who died on Alaska Airlines on Alaska Airline Flight 261 in January 31, 2000. Reference: http://archives.cnn.com/2000/US/02/01/alaska.airlines.list/. When I discovered that there had been no deposits or withdrawals from this account for this long period, I decided to carry out a system investigation and discovered that none of the family members nor relations of the late person is aware of this account. Now I want an account overseas where the bank will transfer this fund. Thereafter, I will destroy all related documents to this account. It is careful network and for the past eleven months I have worked out everything to ensure a hitch-free operation. The amount plus all the accumulated interest is US$15,000,000.00 (Fifteen Million Dollars only). Now my questions are: - 1. Can you handle this project? 2. Can I give you this trust? 3. What will be your commission if you can facilitate the movement of this fund to your account? Consider these and get back to me as soon as possible with your full names,private telephone and fax numbers, corresponding postal address, etc. Finally,it is my humble request that the information as contained herein be accorded with every confidentiality and the necessary secrecy it deserves I expect your urgent response. Yours Sincerely, Franke John Bull. From mr_frankuba52@yahoo.com.hk Sat May 9 22:40:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=21.0 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,J_CHICKENPOX_52,J_CHICKENPOX_83, L_SOME_STD_PROBS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RDNS_NONE,STOX_30,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9998] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [200.29.132.22 listed in b.barracudacentral.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 96] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 96] * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.iponline.cl ([200.29.132.22]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4A5e3Am014016 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 9 May 2009 22:40:09 -0700 Message-Id: <200905100540.n4A5e3Am014016@ga.impsec.org> Received: from User ([195.225.63.117]) by mail.iponline.cl (Merak 7.4.2) with ASMTP id 5EI28148; Tue, 05 May 2009 06:51:33 -0400 Reply-To: From: "Mr.Frank Ubah" To: mr_frankuba52@yahoo.com.hk Subject: [SPAM] Key Telex Transfer CBN. Date: Tue, 5 May 2009 03:51:30 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 114:48:05 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 09 May 2009 22:40:09 -0700 (PDT) X-Spam-Prev-Subject: Key Telex Transfer CBN. Status: R X-Status: X-Keywords: X-UID: 329 Content-Length: 1520 Central Bank of Nigeria Foreign Operations/KTT Dept. Attn: Beneficiary, Your Over Due Contract/Inheritance Funds. This is to notify you that your over due contract funds has been gazettes to be Released,via key telex transfer (KTT) direct wiretransfer to you by the Senate house committee for foreign over due funds transfer. Meanwhile,a woman wrote to my office few days ago with a letter,claiming to be your True representative. Here are her informations: Name: Mrs. Ashley Boatwright Bank Name: The Commerce Bank Bank Address: 266 Timbermill Cir. Carrollton, Georgia 30116. Account Number: 7920507852,Routing No:026-013-673,Swift Code: CBNAUS33 Please, do reconfirm to this office, as a matter of urgency if this woman is from you So that the Bank will not be held responsible for paying into the wrong account Name. Central Bank of Nigeria have been approved and accredited by the Federal Ministry Of Finance and the Senate House committee for foreign over due funds,to pay all foreign Over due inheritance funds/contracts to respective original beneficiaries this first quarter Payment of the year 2009. However, we shall proceed to issue all payments details to the said Mrs.Ashley Boatwright, if we do not hear from you within the next seven working days. Best Regards, Mr. Frank Ubah Dir.Research Operations/Foreign Payment Cc: All foreign Inheritance/contract Funds Cc: Senate House Committee on foreign Payment Cc: Board of Directors Cc: Accountant General[AG] Cc: Ministry of finance From jhardin@impsec.org Sun May 10 23:11:16 2009 -0700 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.6 required=5.0 tests=BAYES_99,BL_COUNTRY_FR_2, FORGED_MUA_OUTLOOK,LOTTO_FROM,LOTTO_YOU_WON_02,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 LOTTO_FROM Admits to being a lottery * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [81.35.62.209 listed in dnsbl.sorbs.net] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 70] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 70] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp27.orange.fr (smtp27.orange.fr [80.12.242.96]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4B6BBEZ003171 for ; Sun, 10 May 2009 23:11:15 -0700 Received: from smtp27.orange.fr (mwinf2723 [10.232.12.123]) by mwinf2720.orange.fr (SMTP Server) with ESMTP id 0ED981C0C66F for ; Mon, 11 May 2009 07:35:48 +0200 (CEST) Received: from User (209.Red-81-35-62.dynamicIP.rima-tde.net [81.35.62.209]) by mwinf2723.orange.fr (SMTP Server) with ESMTP id C2F001C0008D; Mon, 11 May 2009 07:35:27 +0200 (CEST) X-ME-UUID: 20090511053527798.C2F001C0008D@mwinf2723.orange.fr From: "Microsoft email lottery 2009" Subject: [SPAM] Congratulations you have won Date: Mon, 11 May 2009 07:35:34 +0200 MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0117_01C2A9A6.1692CA2A" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090511053527.C2F001C0008D@mwinf2723.orange.fr> To: undisclosed-recipients:; X-Greylist: Delayed for 00:35:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 10 May 2009 23:11:16 -0700 (PDT) X-Spam-Prev-Subject: Congratulations you have won Status: R X-Status: X-Keywords: X-UID: 330 ------=_NextPart_000_0117_01C2A9A6.1692CA2A Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit You have won the 2009 Microsoft email lottery download the attachment to claim your winning price. ------=_NextPart_000_0117_01C2A9A6.1692CA2A X-Content-Security: [ga.impsec.org] original Content-Type was application/msword; Content-Type: Text/Plain; charset=US-ASCII X-Content-Type: APPLICATION/DEFANGED; name="mslot.3192DEFANGED-doc" X-Content-Disposition: attachment; filename="mslot.3192DEFANGED-doc" X-Content-Transfer-Encoding: base64 [ The following attachment was DELETED when this message was saved: ] [ A Application/DEFANGED (Name="mslot.3192DEFANGED-doc") segment of ab ] ------=_NextPart_000_0117_01C2A9A6.1692CA2A-- From p-mans44@msn.com Mon May 11 05:38:48 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.4 required=5.0 tests=BAYES_99,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_MESSAGE,MILLIONS_01,MISSING_HEADERS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SPF_PASS, THOUS_EMAIL_ADDRS,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from blu0-omc1-s28.blu0.hotmail.com (blu0-omc1-s28.blu0.hotmail.com [65.55.116.39]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4BCcija012831 for ; Mon, 11 May 2009 05:38:48 -0700 Received: from BLU125-W17 ([65.55.116.7]) by blu0-omc1-s28.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 11 May 2009 05:22:21 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_90cd0ecf-65d9-4ae9-9616-34546c9e11ed_" X-Originating-IP: [212.100.250.230] Reply-To: From: peter hickman Subject: [SPAM] Business,Call Me Date: Mon, 11 May 2009 12:22:21 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 11 May 2009 12:22:21.0470 (UTC) FILETIME=[2223B3E0:01C9D233] X-Greylist: Delayed for 00:16:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 11 May 2009 05:38:48 -0700 (PDT) X-Spam-Prev-Subject: Business,Call Me Status: R X-Status: X-Keywords: X-UID: 331 Content-Length: 2940 --_90cd0ecf-65d9-4ae9-9616-34546c9e11ed_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: 8bit Dear I wish to contact you personally for a business transaction of GBP 30,000,000(Thirty Million British Pounds Sterling) hopefully that you will respond positively to this offer. I need a reliable, honest and capable person who will be able to handle this transaction hence I am contacting you, and I believe that you will never turn down my request. I am the former Group Risk Director, Halifax Bank of Scotland and currently an Executive Member of Lloyds Banking Group, United Kingdom. With your sincere assistant and co-operation, we can finalise this transaction,and be rest assured that this deal is worth taking and highly profitable. At this moment, I will not issue the details of this transaction until your positive response is granted. For further correspondence regarding this business proposal, send your response to phickman1953@yahoo.com.hk for more details or ring me on Tel: +44 703 597 8470 for further discussion on this. Thanks for your attention. Kind regards. Peter Hickman Executive Member Lloyds Banking Group Plc Tel: +44 703 597 8470 Email: phickman1953@yahoo.com.hk --_90cd0ecf-65d9-4ae9-9616-34546c9e11ed_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: 8bit  Dear
 
I wish to contact you personally for a business transaction of GBP 30,000,000(Thirty Million British Pounds Sterling) hopefully that you will
respond positively to this offer.

I need a reliable, honest and capable person who will be able to handle this transaction hence I am contacting you, and I believe that you will never turn
down my request.
 
I am the former Group Risk Director, Halifax Bank of Scotland and currently an Executive Member of Lloyds Banking Group, United Kingdom.

With your sincere assistant and co-operation, we can finalise this transaction,and be rest assured that this deal is worth taking and highly
profitable.
 
At this moment, I will not issue the details of this transaction until your positive response is granted.

For further correspondence regarding this business proposal, send your response to phickman1953@yahoo.com.hk for more details or ring me on Tel: +44 703 597 8470 for further discussion on this.
 
Thanks for your attention.
 
Kind regards.

Peter Hickman
Executive Member
Lloyds Banking Group Plc
Tel: +44 703 597 8470
Email: phickman1953@yahoo.com.hk
 

--_90cd0ecf-65d9-4ae9-9616-34546c9e11ed_-- From info@nlotverbugern.info Mon May 11 21:38:09 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.1 required=5.0 tests=BAYES_99,FORGED_MUA_OUTLOOK, J_CHICKENPOX_47,J_CHICKENPOX_63,MISSING_HEADERS,MSGID_FROM_MTA_HEADER, MSOE_MID_WRONG_CASE,RBL_POXLAY_01,STOX_30,SUBJECT_NEEDS_ENCODING autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [62.194.110.250 listed in dnsbl.sorbs.net] * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.0 SUBJECT_NEEDS_ENCODING SUBJECT_NEEDS_ENCODING * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from p52.ich-1.com (p52.ich-1.com [67.19.130.210]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4C4c2Ba006712 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 11 May 2009 21:38:09 -0700 Message-Id: <200905120438.n4C4c2Ba006712@ga.impsec.org> Received: from h110250.upc-h.chello.nl ([62.194.110.250] helo=User) by p52.ich-1.com with esmtpa (Exim 4.69) (envelope-from ) id 1M3RR7-0002lu-3c; Mon, 11 May 2009 04:04:37 -0500 Reply-To: From: "Kopano Lesedi" Subject: [SPAM] Fonds Treuhnder Date: Mon, 11 May 2009 11:04:44 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - p52.ich-1.com X-AntiAbuse: Original Domain - impsec.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - nlotverbugern.info X-Greylist: Delayed for 19:29:03 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 11 May 2009 21:38:09 -0700 (PDT) X-Spam-Prev-Subject: Fonds Treuhnder Status: R X-Status: X-Keywords: X-UID: 332 Content-Length: 2041 Fonds Treuhnder, Mein Name ist Mr.Kopano Lesedi,ich bin der western Regional Auditor General der first national bank,sd afrika(FNB). Ich kann Ihne! n eine finanzielle Transaktion prsentieren, von der wir beide profitieren werden. Ich habe Ihre Daten whrend meiner Suche in auslndischen Branchenverzeichnissen gefunden. Als Regional Auditor General der Bank gehrt es zu meinen Aufgaben, am Jahresende einen Finanzreport an meine Hauptgeschftsstelle zu senden. Whrend ich standardmig eine Prfung der Konten in unserer Datenbank durchfhrte, die auch einen Jahresabschlubericht beinhaltete, entdeckte ich einen Betrag in Hhe von 5,500.000,00 US$ (fnf Millionen fnfhunderttausend US Dollar). Dieser Betrag wurde nicht von meiner Hauptgeschftsstelle registriert, es handelt sich hierbei um einen Mehrgewinn, den unsere Eastern Region Zweigstelle im letzten Quartal 2007 erwirtschaftet hat. Seitdem habe ich diese Summe in ein ESCROW Konto transferiert und veranlas! st, da sie diese Woche ber eine Diplomatic Agency als Familieneigentum nach Europa versandt wird. Ich suche nun nach einem auslndischen Begnstigten, der den Fonds in Europa vom einem angegliederten Diplomatic Offshore Payment Office in Empfang nehmen kann. Als eine Fhrungskraft der Bank kann ich nicht direkt mit diesem Geld in Verbindung gebracht werden, und nicht als Begnstigter auftreten. Daher bentige ich Ihre Hilfe, um das Geld treuhnderisch in Empfang zu nehmen, damit wir es danach teilen knnen. Fr Sie besteht praktisch kein Risiko, alles was Sie tun mssen, ist als ursprnglicher Einzahler aufzutreten, der dieses Geld bei der Diplomatic Agency deponiert hat. Falls Sie mein Angebot akzeptieren und mit mir zusammenarbeiten, wrde mich das sehr freuen. Sobald ich Ihre Antwort auf mein email adresse (succsouth2009@gmail.com) und senden sie ihre(Adresse,email adresse und Telefonnummer) erhalten habe, werde ich Sie mit den Details vertraut machen und unser Treffen in Europa arrangieren. Mit freundlichen Gren Mr.Kopano Lesedi From dr.Mansurmuhtar@fmf.gov.ng Tue May 12 01:12:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************************** X-Spam-Status: Yes, score=28.1 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_FR_2,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,LOTTO_YOU_WON_03, MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9978] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp2e.orange.fr (smtp2e.orange.fr [80.12.242.113]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4C8CZCS012549 for ; Tue, 12 May 2009 01:12:39 -0700 Received: from smtp2e.orange.fr (mwinf2e11 [10.232.14.39]) by mwinf2e20.orange.fr (SMTP Server) with ESMTP id 71FD31C06240 for ; Tue, 12 May 2009 07:26:56 +0200 (CEST) Received: from User (ppp-80-252-245-75.oxygen.mk.ua [80.252.245.75]) by mwinf2e11.orange.fr (SMTP Server) with ESMTP id 56C39800009F; Tue, 12 May 2009 07:26:11 +0200 (CEST) X-ME-UUID: 20090512052611355.56C39800009F@mwinf2e11.orange.fr Reply-To: From: "Dr. Mansur Muhtar" Subject: [SPAM] FEDERAL MINISTRY OF FINANCE./ARE YOU DEAD OR ALIVE? Date: Tue, 12 May 2009 06:26:43 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090512052611.56C39800009F@mwinf2e11.orange.fr> To: undisclosed-recipients:; X-Greylist: Delayed for 02:11:52 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 12 May 2009 01:12:39 -0700 (PDT) X-Spam-Prev-Subject: FEDERAL MINISTRY OF FINANCE./ARE YOU DEAD OR ALIVE? Status: R X-Status: X-Keywords: X-UID: 333 Content-Length: 3516 FEDERAL MINISTRY OF FINANCE. P.M.B. 14, Garki, Abuja. Tel: +234-7041743824 Official E-mail: drmansurmuhtarfmf@yahoo.cn APPROVED BY THE NIGERIAN GOVERNMENT OFFICIAL WEBSITE: http://www.fmf.gov.ng/FMF_HMF_Profile.aspx Attn:- Unpaid Beneficiary, Dated This Day: 15/04/2009 CLAIM'S OF YOUR FUND VALUED US$38.7 MILLION BY SOME RE-PRESENTATIVES. Good Day to you and your family as i bring to you greetings in the name of the LORD. I do like to let you know that a power of attorney was forwarded to my office this morning by two gentlemen, one of them is an AMERICAN national and he is ENGR . GILBERT M. USON by name while the other person is Mr. JACK MORGAN by name a CANADIAN national. I want you to know that your Registered Previous Personal Banking Details which is now in my Office was forwarded to me by the Central Bank Governor and the Transfer Unit as well. This Gentle Men claimed to be the representative of your Family, and this power of attorney stated that you have died, they brought an account to replace your informations and claimed your fund of $US38.7 Million which is right now lying DORMANT and UNCLAIMED, below is the new account they have submitted: BANK NAME:- STANDARD BANK OF DUBAI NAME OF ACCOUNT: IBRAHIM MAL ALLA HAMMAD BIN HAMMAD AL SABRI ACCOUNT NUMBER: 2984-0008-660. SWIFT CODE: BOPIPHMM. AMOUNT FOR TRANSFER: US$36.6 MILLION. Be further informed that this power of attorney also stated that you suffered and died of a throat cancer. All you just have to do is for you to confirm if you are really alive, because its sound furious that such kind of a thing just happened , I was Instructed to find out if it really happens or not before the fund will be transfered to them. Please these email demands urgent response as whoever do read these if its you or a family Member or Friend who has access to your email address, should respond immediately. You are therefore given 24hrs to confirm the truth in this information if you are still alive by responding back immediately so that these office can know what actions to be taken, because they are just insisting that we carry out the transfer of which we are writting to you now on their absent to confirm if you are still alive. Since no response from you all these while on how you can get your fund released to you, we are now suspecting that it might be true and funny that something strange might have happened and that the story might be true, because the only evidence now is you or your family members contacting these office now and confirming if these people are from you, or else we will transfer the fund to them. Kindly Provide the following details for immediate actions to be carried out: 1: Your full names: 2: Your Complete address: 3: Your age and sex: 4: Your Occupation: 5: Your Tel/fax: 6: Your I.D CARD/INTERNATIONAL PASSPORT. Note: In case of any questions from you or your family members that reads these email, call should be made direclt to my office mobile number: +234-704-174-3824. You or family members should forward to me emails you have been receiveing from those IMPOSTERS for adequate investigations to be carried out. You or your family members that reads these email should respond back as i await immediate response. Best regards, Dr. Mansur Muhtar. Federal Ministry of Finance. Federal Republic of Nigeria. Cc: Senate President. Cc: All Foreign Payment Offices. Cc: Board of Directors [Fpd]. Cc: Accountant General Of The Federation. From mrsgraceboyi56@msn.com Tue May 12 04:07:35 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************** X-Spam-Status: Yes, score=17.8 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE,J_CHICKENPOX_81,MILLIONS_01, MILLION_USD,MISSING_HEADERS,PHISH_05,SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_PASS, YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_81 BODY: 8alpha-pock-1alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from blu0-omc4-s20.blu0.hotmail.com (blu0-omc4-s20.blu0.hotmail.com [65.55.111.159]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4CB7VMo017044 for ; Tue, 12 May 2009 04:07:34 -0700 Received: from BLU133-W20 ([65.55.111.137]) by blu0-omc4-s20.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 12 May 2009 03:51:07 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_7d42bbc2-d36b-4428-bd6f-3a046bafa9be_" X-Originating-IP: [213.137.131.252] Reply-To: From: mrsgrace boyi Subject: [SPAM] My Dear Good Friend, Date: Tue, 12 May 2009 10:51:07 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 12 May 2009 10:51:07.0244 (UTC) FILETIME=[8DA8DAC0:01C9D2EF] X-Greylist: Delayed for 00:16:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 12 May 2009 04:07:34 -0700 (PDT) X-Spam-Prev-Subject: My Dear Good Friend, Status: R X-Status: X-Keywords: X-UID: 334 Content-Length: 7119 --_7d42bbc2-d36b-4428-bd6f-3a046bafa9be_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable My Dear Good Friend=2C I crave your indulgence at this mail coming from somebody like me=2C whom y= ou does not know before. I decided to do this after praying over the situat= ion. You should please consider the transaction on its content and not the = fact that you have not known me before. I need not dwell on how I came by your contact information because there ar= e many such possibilities these days.I would like to introduce myself as MR= S.GRACE BOYI=2C of Republic of Benin=2C a widow to Late MR.DAVID BOYI (for = Consular of the Benin Embassy in Madrid=2C Spain. I have been recently been diagnosed of Cancer of the Pelvics and attending = my medical treatment at St Victoria Private Clininc here in Benin Republic.= I am writing to you now from my sick bed because of how this transfer is u= rgent to me. There is US$18.5 (Eighteen Million Five Hundred Thousand Unite= d State Dollars) my husband has in an account with the AFRICAN DEVELOPMENT = BANK=2C of which I am the next of kin. With my health condition and because my husband and I have no children=2CI = am looking for a credible person that will not betrayed me to whom I will p= ass the right of next of kin. This person will apply to the bank and reques= t for the transfer of the fund to his/her bank account. This is on the cond= ition that you will take only 30% of the fund for yourself=2C10% used for e= xpenses=2C while you will use the remaining 60% for the less previlege peop= le in the society. I will issue you my late husband STANDING ORDER WILL which he wrote and sen= d a copy to the bank before he died which my apointed next of kin have to p= resent a copy to the bank as the real apointed before the bank will release= the fund into his account=2C which i promise to issue you a copy of the OR= DER WILL to proceed for the release of the fund. This is in fulfilment of the last request of my husband: that a substantial= part of the fund be used to carter for the less previleged.If this conditi= on is acceptable to you=2C you should contact my private doctor immediately= with your full names and contact information as indicated below so that my= doctor will inform me on contacting him so that i will use your contact to= write to my bank here to proceed on processing for an immediate release of= the fund into your account. I will also ask our family lawyer to prepare an authorization letter that w= ill give you the right of next of kin to the deposited fund with the bank. = I will also give you a letter of claim which you will fill and send to the = bank for the claim. I cannot predict what will be my fate by the time the fund will be transfer= ed into your account=2C but you should please ensure that the fund is used = as i have described above. Kindly send this required informations immediatly and call my private docto= r Dr.Felix Rechard on his direct telephone number so that he will inform me= for futher process. Note that i had let him know everything about this project as he may assist= you here for the process. His number is +22997 099851 1.Your Full Name/ Full Address 2.Your Age/ Sex 3...Your Marital Status 4.Your Occupation 5.Your Mobile Numbers Thank you and May God bless you. Yours faithfully=2C Mrs.Grace Boyi = --_7d42bbc2-d36b-4428-bd6f-3a046bafa9be_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable My Dear Good Friend=2C

I crave your indulgence at this mail coming f= rom somebody like me=2C whom you does not know before. I decided to do this= after praying over the situation. You should please consider the transacti= on on its content and not the fact that you have not known me before.
I need not dwell on how I came by your contact information because there = are many such possibilities these days.I would like to introduce myself as = MRS.GRACE BOYI=2C of Republic of Benin=2C a widow to Late MR.DAVID BOYI (fo= r Consular of the Benin Embassy in Madrid=2C Spain.

I have been rece= ntly been diagnosed of Cancer of the Pelvics and attending my medical treat= ment at St Victoria Private Clininc here in Benin Republic. I am writing to= you now from my sick bed because of how this transfer is urgent to me. The= re is US$18.5 (Eighteen Million Five Hundred Thousand United State Dollars)= my husband has in an account with the AFRICAN DEVELOPMENT BANK=2C of which= I am the next of kin.

With my health condition and because my husba= nd and I have no children=2CI am looking for a credible person that will no= t betrayed me to whom I will pass the right of next of kin. This person wil= l apply to the bank and request for the transfer of the fund to his/her ban= k account. This is on the condition that you will take only 30% of the fund= for yourself=2C10% used for expenses=2C while you will use the remaining 6= 0% for the less previlege people in the society.

I will issue you my= late husband STANDING ORDER WILL which he wrote and send a copy to the ban= k before he died which my apointed next of kin have to present a copy to th= e bank as the real apointed before the bank will release the fund into his = account=2C which i promise to issue you a copy of the ORDER WILL to proceed= for the release of the fund.

This is in fulfilment of the last requ= est of my husband: that a substantial part of the fund be used to carter fo= r the less previleged.If this condition is acceptable to you=2C you should = contact my private doctor immediately with your full names and contact info= rmation as indicated below so that my doctor will inform me on contacting h= im so that i will use your contact to write to my bank here to proceed on p= rocessing for an immediate release of the fund into your account.

I = will also ask our family lawyer to prepare an authorization letter that wil= l give you the right of next of kin to the deposited fund with the bank. I = will also give you a letter of claim which you will fill and send to the ba= nk for the claim.

I cannot predict what will be my fate by the time = the fund will be transfered into your account=2C but you should please ensu= re that the fund is used as i have described above.

Kindly send this= required informations immediatly and call my private doctor Dr.Felix Recha= rd on his direct telephone number so that he will inform me for futher proc= ess.

Note that i had let him know everything about this project as h= e may assist you here for the process. His number is +22997 099851

1= .Your Full Name/ Full Address
2.Your Age/ Sex
3...Your Marital Status=
4.Your Occupation
5.Your Mobile Numbers

Thank you and May God= bless you.
Yours faithfully=2C
Mrs.Grace Boyi = --_7d42bbc2-d36b-4428-bd6f-3a046bafa9be_-- From dwdrummer@rrohio.com Wed May 13 05:55:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4DCt2Xu025386 for ; Wed, 13 May 2009 05:55:02 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******** X-Spam-Status: Yes, score=8.3 required=5.0 tests=BAYES_99,BAYES_POISON_02, FREEMAIL_FORGED,MSGID_FROM_MTA_HEADER,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9995] * 0.8 BAYES_POISON_02 Appears to have "bayes poison" unpunctuated text * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Wed, 13 May 2009 05:55:02 -0700 (PDT) Received: from hrndva-commlb.mail.rr.com (hrndva-commlb.mail.rr.com [71.74.57.8]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4DCsUOJ027619 for ; Wed, 13 May 2009 05:54:34 -0700 Received: from rrcs-agw-01.hrndva.rr.com ([24.28.200.151]) by hrndva-comm-mta01.mail.rr.com with ESMTP id <20090513123143.RELV11981.hrndva-comm-mta01.mail.rr.com@rrcs-agw-01.hrndva.rr.com> for ; Wed, 13 May 2009 12:31:43 +0000 Message-Id: <7h9gbp$d5f7mt@rrcs-agw-01b.hrndva.rr.com> Received: from unknown (HELO rrcs-out.biz.rr.com) ([172.28.200.142]) by rrcs-agw-01b.hrndva.rr.com with SMTP; 13 May 2009 08:31:43 -0400 X-Mailer: Openwave WebEngine, version 2.8.17 (webedge20-101-1107-20041027) From: ALAN STREET Reply-To: alanstreet71@yahoo.com.hk To: Subject: [SPAM] LETTER Date: Wed, 13 May 2009 7:31:43 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Delayed for 00:22:46 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 13 May 2009 05:54:34 -0700 (PDT) X-Spam-Prev-Subject: LETTER Status: R X-Status: X-Keywords: X-UID: 335 i am alan street i have a business of {$7.8m}.contact me via email:alanstreet71@yahoo.com.hk From jhardin@impsec.org Tue May 12 06:40:30 2009 -0700 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********** X-Spam-Status: Yes, score=10.9 required=5.0 tests=BAYES_95,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_MESSAGE,MISSING_HEADERS,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9711] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.246.177.109 listed in dnsbl.sorbs.net] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] Received: from blu0-omc4-s38.blu0.hotmail.com (blu0-omc4-s38.blu0.hotmail.com [65.55.111.177]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4CDeQ9a021801 for ; Tue, 12 May 2009 06:40:30 -0700 Received: from BLU133-W38 ([65.55.111.135]) by blu0-omc4-s38.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 12 May 2009 06:23:32 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/mixed; boundary="_2d9de055-d57d-44d8-a020-d0f36105737e_" X-Originating-IP: [41.246.177.109] Reply-To: From: "Dr.George Owen" Subject: [SPAM] Please view attachment for transfer of US$35.5m Date: Tue, 12 May 2009 13:23:32 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 12 May 2009 13:23:32.0541 (UTC) FILETIME=[D8AE6ED0:01C9D304] X-Greylist: Delayed for 00:16:53 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 12 May 2009 06:40:30 -0700 (PDT) X-Spam-Prev-Subject: Please view attachment for transfer of US$35.5m Status: R X-Status: X-Keywords: X-UID: 336 Content-Length: 1343 --_2d9de055-d57d-44d8-a020-d0f36105737e_ Content-Type: multipart/alternative; boundary="_364c3b3c-ca34-45f4-a0a2-6604eb3e737a_" --_364c3b3c-ca34-45f4-a0a2-6604eb3e737a_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Business assistant of US$35.5m (Please view attachment) Regards=2C Dr.George Owen. --_364c3b3c-ca34-45f4-a0a2-6604eb3e737a_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Business assistant of US$35.5m (Please view attachment)

Rega= rds=2C

Dr.George Owen.


= --_364c3b3c-ca34-45f4-a0a2-6604eb3e737a_-- --_2d9de055-d57d-44d8-a020-d0f36105737e_ X-Content-Disposition: attachment; filename="FUND TRANSFER..21824DEFANGED-doc" X-Content-Security: [ga.impsec.org] original Content-Type was application/msword Content-Type: Text/Plain; charset=US-ASCII X-Content-Type: APPLICATION/DEFANGED; X-Content-Transfer-Encoding: base64 [ The following attachment was DELETED when this message was saved: ] [ A Application/DEFANGED segment of about 26,800 bytes. ] --_2d9de055-d57d-44d8-a020-d0f36105737e_-- From alanstreet71@yahoo.com.hk Tue May 12 08:36:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.9 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,DATE_IN_PAST_03_06,DEAR_FRIEND,FREEMAIL_FROM,L_SOME_STD_PROBS, MILLIONS_01,NA_DOLLARS,RDNS_NONE,SPAMMY_HEADER_08,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 SPAMMY_HEADER_08 Has headers only spammers use * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.0 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from tanzaniaports.com ([193.220.87.101]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4CFaJRc025049 for ; Tue, 12 May 2009 08:36:25 -0700 Received: from [127.0.0.1] (helo=ThreatWall.tanzaniaports.com) by tanzaniaports.com with esmtp (envelope-from ) id 1M3qjp-00046S-3u ; Tue, 12 May 2009 15:05:37 +0300 Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary X-Mailer: EMUmail 5.1 X-Originating-Ip: 78.138.6.251 X-Webmail-User: dp@tanzaniaports.com To: info@yahoo.com MIME-Version: 1.0 X-Http_host: webmail.tanzaniaports.com:81 From: ALAN STREET Subject: [SPAM] LETTER Date: Tue, 12 May 2009 12:05:37 GMT Reply-To: ALAN STREET X-Envelope-From: alanstreet71@yahoo.com.hk Message-ID: <1M3qjp-00046S-3u@alanstreet71> X-Greylist: Delayed for 03:28:13 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 12 May 2009 08:36:26 -0700 (PDT) X-Spam-Prev-Subject: LETTER Status: R X-Status: X-Keywords: X-UID: 337 Dear Friend, This letter may come to you as a surprise.I am ALAN STREET, The Chief Auditor of a bank here in Spain; Sometime in 2003,We lost one of our valued client in aplane crash his death was a sad loose to most of us here in the bank as he is well known and liked as a result of his successful and consistent banking operations with us. However, since the death of late Mr.Michael Anderson, In 2003 no one has come forward for the claim of his personal lodgment with us which runs into (M$7.4) Seven million four hundred thousand US dollars. At the successful procurement of the funds, You shall remit 60% of the totalsum to me while you will retain the balance of 40% for your assistance.Please, If you areinterested and willing to execute this transaction, You should immediately inform me through my e-mailaddress.:alanstreet71@yahoo.com.hk I remain Yours sincerely. Best Regards. ALAN STREET From profcharlessoludo412@gmail.com Tue May 12 09:17:45 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************************** X-Spam-Status: Yes, score=27.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_FR_2,FILL_THIS_FORM_01,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,MILLIONS_01, MILLION_USD,MSOE_MID_WRONG_CASE,PHISH_05,RDNS_NONE,SPF_NEUTRAL,STOX_30, SUBJ_ALL_CAPS,UPPERCASE_75_100 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 0.2 PHISH_05 BODY: Phishing for account information * 1.5 UPPERCASE_75_100 message body is 75-100% uppercase * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp23.orange.fr ([193.252.22.30]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4CGHfxZ026471 for ; Tue, 12 May 2009 09:17:44 -0700 Received: from smtp23.orange.fr (mwinf2309 [10.232.4.37]) by mwinf2340.orange.fr (SMTP Server) with ESMTP id 696D91C024CA for ; Tue, 12 May 2009 17:27:05 +0200 (CEST) Received: from User (unknown [80.233.202.125]) by mwinf2309.orange.fr (SMTP Server) with ESMTP id F1CB67000097; Tue, 12 May 2009 17:24:45 +0200 (CEST) X-ME-UUID: 20090512152445990.F1CB67000097@mwinf2309.orange.fr Reply-To: From: "PROF CHARLES SOLUDO" Subject: [SPAM] FROM: PROFESSOR CHARLES SOLUDO. Date: Tue, 12 May 2009 08:26:50 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090512152445.F1CB67000097@mwinf2309.orange.fr> To: undisclosed-recipients:; X-Greylist: Delayed for 00:33:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 12 May 2009 09:17:45 -0700 (PDT) X-Spam-Prev-Subject: FROM: PROFESSOR CHARLES SOLUDO. Status: R X-Status: X-Keywords: X-UID: 338 Content-Length: 2671 FROM: PROFESSOR CHARLES SOLUDO EXECUTIVE GOVERNOR, CENTRAL BANK OF NIGERIA TELE: 234-80-67309525 REPLY TO THIS EMAIL:profcharlessoludo413@gmail.com ATTN:BENEFICIARY, THIS IS TO NOTIFY YOU THAT YOUR OVER DUE INHERITANCE FUNDS HAS BEEN GAZETTED TO BE RELEASED, VIA KEY TELEX TRANSFER (KTT) -DIRECT WIRE TRANSFER TO YOU OR THROUGH ANY OF OUR CORRESPONDENT BANK NOMINATED BY THE SENATE COMMITTEE FOR FOREIGN OVER DUE FUND TRANSFER. MEANWHILE, A WOMAN CAME TO MY OFFICE FEW DAYS AGO WITH A LETTER, CLAIMING TO BE YOUR TRUE REPRESENTATIVE. HERE ARE HER INFORMATIONS FOR YOU TO CONFIRM TO THIS OFFICE IF THIS WOMAN IS TRULY FROM YOU OR NOT SO THAT THE FEDERAL GOVERNMENT WILL NOT BE HELD RESPONSIBLE FOR PAYING INTO ANY WRONG ACCOUNTS. CLAIMS NAME: JANET WHITE BANK NAME: CITI BANK ARIZONA, USA. ACCOUNT NUMBER: 6503809428. PLEASE, DO RECONFIRM TO THIS OFFICE, AS A MATTER OF URGENCY IF THIS WOMAN IS FROM YOU. YOU ARE REQUESTED TO FILL AND SEND THIS INFORMATIONS FOR VERIFICATIONS PURPOSES SO THAT YOUR FUND VALID US$7.5M (SEVEN MILLION, FIVE HUNDRED THOUSAND UNITED STATE DOLLARS) WILL BE REMITTED INTO YOUR NOMINATED BANK ACCOUNT ANY WHERE. THIS FUND IS AS A RESULT OF INHERITANCE ON YOUR BEHALF. INFORMATION NEEDED FROM YOU FOR VERIFICATION IS AS FOLLOWS: 1.YOUR NAME:.............................. 2. YOUR FULL ADDRESS:................................... 3. YOUR TELEPHONE .................................. 4. FAX................................................... 5. AGE...................................................... 6. SEX:.................................... 7. YOUR OCCUPATION:...................................... 8. YOUR BANKING DETAILS:................................... AS SOON AS WE RECEIVE THIS, WE WILL COMMENCE WITH ALL NECESSARY PROCEDURES IN OTHER TO REMIT THIS MONEY INTO YOUR ACCOUNT. THE CENTRAL BANK GOVERNOR, IN CONJUNCTION WITH THE FEDERAL MINISTRY OF FINANCE (FMF) EXECUTIVE BOARD OF DIRECTORS AND THE SENATE COMMITTEE FOR FOREIGN OVER DUE INHERITANCE FUND HAVE APPROVED AND ACCREDITED THIS REPUTABLE BANK WITH THE OFFICE OF THE DIRECTOR, INTERNATIONAL REMITTANCE/FOREIGN OPERATIONS, TO HANDLE AND TRANSFER ALL FOREIGN INHERITANCE FUNDS THIS QUARTER PAYMENT OF THE YEAR 2009. HOWEVER, WE SHALL PROCEED TO ISSUE ALL PAYMENTS DETAILS TO THE SAID MRS.WHITE, IF WE DO NOT HEAR FROM YOU WITHIN THE NEXT SEVEN WORKING DAYS FROM TODAY. WE ARE SORRY FOR ANY INCONVENIENCE THE DELAY IN TRANSFERRING OF THIS FUND MUST HAVE CAUSED YOU. CONGRATULATIONS. PROFESSOR CHARLES C. SOLUDO, GOVERNOR, CENTRAL BANK OF NIGERIA (CBN). CC: SENATE PRESIDENT CC: BOARD OF DIRECTORS [FPD] CC: ACCOUNTANT GENERAL OF NIGERIA. From dr.Mansurmuhtar@fmf.gov.ng Tue May 12 09:51:17 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************* X-Spam-Status: Yes, score=31.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_FR_2,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED, LOTTO_YOU_WON_03,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SUBJ_ALL_CAPS, THOUS_EMAIL_ADDRS,URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [80.234.123.234 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.5 BL_COUNTRY_FR_2 Mail client in France * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp19.orange.fr (smtp19.orange.fr [80.12.242.17]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4CGpDuI027292 for ; Tue, 12 May 2009 09:51:17 -0700 Received: from smtp19.orange.fr (mwinf1927 [172.22.129.127]) by mwinf1915.orange.fr (SMTP Server) with ESMTP id F1A891C00A87 for ; Tue, 12 May 2009 16:44:18 +0200 (CEST) Received: from User (unknown [80.234.123.234]) by mwinf1927.orange.fr (SMTP Server) with ESMTP id E16DE20000B0; Tue, 12 May 2009 16:43:00 +0200 (CEST) X-ME-UUID: 20090512144300923.E16DE20000B0@mwinf1927.orange.fr Reply-To: From: "Dr. Mansur Muhtar" Subject: [SPAM] FEDERAL MINISTRY OF FINANCE./ARE YOU DEAD OR ALIVE? Date: Tue, 12 May 2009 15:44:01 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090512144300.E16DE20000B0@mwinf1927.orange.fr> To: undisclosed-recipients:; X-Greylist: Delayed for 01:22:54 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 12 May 2009 09:51:17 -0700 (PDT) X-Spam-Prev-Subject: FEDERAL MINISTRY OF FINANCE./ARE YOU DEAD OR ALIVE? Status: R X-Status: X-Keywords: X-UID: 339 Content-Length: 3516 FEDERAL MINISTRY OF FINANCE. P.M.B. 14, Garki, Abuja. Tel: +234-7041743824 Official E-mail: drmansurmuhtarfmf@yahoo.cn APPROVED BY THE NIGERIAN GOVERNMENT OFFICIAL WEBSITE: http://www.fmf.gov.ng/FMF_HMF_Profile.aspx Attn:- Unpaid Beneficiary, Dated This Day: 15/04/2009 CLAIM'S OF YOUR FUND VALUED US$38.7 MILLION BY SOME RE-PRESENTATIVES. Good Day to you and your family as i bring to you greetings in the name of the LORD. I do like to let you know that a power of attorney was forwarded to my office this morning by two gentlemen, one of them is an AMERICAN national and he is ENGR . GILBERT M. USON by name while the other person is Mr. JACK MORGAN by name a CANADIAN national. I want you to know that your Registered Previous Personal Banking Details which is now in my Office was forwarded to me by the Central Bank Governor and the Transfer Unit as well. This Gentle Men claimed to be the representative of your Family, and this power of attorney stated that you have died, they brought an account to replace your informations and claimed your fund of $US38.7 Million which is right now lying DORMANT and UNCLAIMED, below is the new account they have submitted: BANK NAME:- STANDARD BANK OF DUBAI NAME OF ACCOUNT: IBRAHIM MAL ALLA HAMMAD BIN HAMMAD AL SABRI ACCOUNT NUMBER: 2984-0008-660. SWIFT CODE: BOPIPHMM. AMOUNT FOR TRANSFER: US$36.6 MILLION. Be further informed that this power of attorney also stated that you suffered and died of a throat cancer. All you just have to do is for you to confirm if you are really alive, because its sound furious that such kind of a thing just happened , I was Instructed to find out if it really happens or not before the fund will be transfered to them. Please these email demands urgent response as whoever do read these if its you or a family Member or Friend who has access to your email address, should respond immediately. You are therefore given 24hrs to confirm the truth in this information if you are still alive by responding back immediately so that these office can know what actions to be taken, because they are just insisting that we carry out the transfer of which we are writting to you now on their absent to confirm if you are still alive. Since no response from you all these while on how you can get your fund released to you, we are now suspecting that it might be true and funny that something strange might have happened and that the story might be true, because the only evidence now is you or your family members contacting these office now and confirming if these people are from you, or else we will transfer the fund to them. Kindly Provide the following details for immediate actions to be carried out: 1: Your full names: 2: Your Complete address: 3: Your age and sex: 4: Your Occupation: 5: Your Tel/fax: 6: Your I.D CARD/INTERNATIONAL PASSPORT. Note: In case of any questions from you or your family members that reads these email, call should be made direclt to my office mobile number: +234-704-174-3824. You or family members should forward to me emails you have been receiveing from those IMPOSTERS for adequate investigations to be carried out. You or your family members that reads these email should respond back as i await immediate response. Best regards, Dr. Mansur Muhtar. Federal Ministry of Finance. Federal Republic of Nigeria. Cc: Senate President. Cc: All Foreign Payment Offices. Cc: Board of Directors [Fpd]. Cc: Accountant General Of The Federation. From info@internationalmonetaryfundcommission.com Tue May 12 20:55:29 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ***************************************** X-Spam-Status: Yes, score=41.6 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, DEAR_WINNER,FILL_THIS_FORM_02,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML, HTML_COMMENTS,HTML_MESSAGE,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,KAM_LOTTO1,KAM_LOTTO2,LOTTERY_PH_004470,LOTTO_AGENT, LOTTO_MANY,LOTTO_RANDOM,LOTTO_WIN_01,LOTTO_YOU_WON_02,L_SOME_STD_PROBS, MIME_HTML_ONLY,MISSING_HEADERS,MSOE_MID_WRONG_CASE,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BRBL,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [62.141.56.4 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [62.141.56.4 listed in dnsbl.sorbs.net] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [62.141.56.4 listed in psbl.surriel.com] * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 0.5 LOTTO_RANDOM BODY: Random selection * 3.2 DEAR_WINNER BODY: DEAR_WINNER * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 1.0 LOTTO_WIN_01 BODY: Winning * * 1.0 FILL_THIS_FORM_02 BODY: Fill in your personal info * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.2 HTML_COMMENTS RAW: Has HTML comments * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.0 LOTTERY_PH_004470 LOTTERY_PH_004470 * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.0 LOTTO_MANY LOTTO_MANY * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from km1610.keymachine.de (ns.km1610.keymachine.de [62.141.56.4]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4D3tLRP013023 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 12 May 2009 20:55:29 -0700 Received: from User (host217-34-47-188.in-addr.btopenworld.com [217.34.47.188]) (authenticated bits=0) by km1610.keymachine.de (8.12.11.20060308/8.12.11) with ESMTP id n4BISpqD019200; Mon, 11 May 2009 20:28:54 +0200 Message-Id: <200905111828.n4BISpqD019200@km1610.keymachine.de> Reply-To: From: "GBLC" Subject: [SPAM] (WINNING CONFIRMATION GALAC001QC/MAY/2009) Date: Mon, 11 May 2009 19:19:56 +0100 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 33:30:42 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 12 May 2009 20:55:29 -0700 (PDT) X-Spam-Prev-Subject: (WINNING CONFIRMATION GALAC001QC/MAY/2009) Status: R X-Status: X-Keywords: X-UID: 340 Content-Length: 7686 Gala bingo
(YOUR WINNING CONFIRMATION GALAC001QC/APRIL/2009)
From the Desk of the Head Coordinator
FREE GALA BINGO E-MAIL LOTTERY PROMO
http://lotto.galabingo.co.uk
The Square Redford
Nottingham shire
DN22 6DB United Kingdom.
Tel: +448715039878
International + (44)702-407-8997
Fax No: + (44)702-407-7692
Office Hours Monday To Saturdays:
Ref: GACSL/208/77

Dear Esteem Winner,

Over the years the prestigious GALA BINGO lottery has set out and successfully organized sweepstakes on a daily, weekly, and annual basis. We have equally maintained a standard unrivaled in the industry as it concerns the pay out of winnings to successful participants.

In line with the commemorating event marking our 20th year anniversary we rolled out over £1,800.000.00 (One million, Eight hundred thousands British Pounds) for our 20th year Anniversary Draws.

Participants for the draws were randomly selected and drawn from a wide range of web hosts which enjoy our patronage. The selection was made through a computer draw system attaching personalized email addresses to ticket numbers.

Your email address as indicated was drawn and attached to Ticket Number 2093961 with serial numbers GL193007 and drew the lucky numbers (12)-(52)-(19)-(22)-(30)-(17) with a bonus number (66) which subsequently won you £250,000.00 (Two Hundred and Fifty Thousand Great British Pounds) as one of the 3 jackpot winners in this draw.

You have therefore been approved the entire winning sum of £250,000.00 (Two Hundred and Fifty Thousand Great British Pounds) in cash credited to File Ref GACSL/6488292-2009/09. The draws registered as Draw number one was conducted in Hampshire, United Kingdom on the 11th of May 2009. This lottery Draws is commemorative and as such special.

Please be informed by this Winning Notification to make contact with your designated corresponding claim official uk who shall by duty guide you through the process to facilitate the release of your winnings.

To file for your claim Please Contact your claims agent.

Contact information below:
Clearance Agent: Mr. Jeff Atkinson
Email: winners@lottogallabingo.com
Tel: +(44)702-409-6560
International: + (44)702-409-6560
Fax Num: + (44)702-407-7692

You are advised to contact your claims agent with the following details to avoid unnecessary delays and complications.

Full Names: ............................................................................................ .........
Contact/Mailing Address: ..............................................................................
Direct Telephone Number/ Cell Phone Number: ........................................
Fax Numbers: ............................................................................................ ......
Nationality: ............................................................................................ ...........
Amount won: ............................................................................................ ......
Occupation: ............................................................................................ .........
Age / Sex: ............................................................................................ .............
Ticket Number: ............................................................................................ ....
Serial Number: ............................................................................................ .....
File Ref: ............................................................................................ ................
Lucky Numbers as indicated in this winning Notification: .........................

Thank you for being part of our commemorative 20th Anniversary Draws.

***Due to possible mix up of some numbers and email contacts, we ask that you keep this award strictly from public notice until your claim has been processed and your money remitted. This is part of our security protocol to avoid double claiming or unscrupulous acts by some participants of this program.***

Congratulations once more from all members and staff of this world promotional lottery programs.


Yours Sincerely,
Jeff Atkinson.
***Customer Support***
NB: Any claim not made before (31) working days from date of notification will indicate that the winner has voluntarily forfeited his/her winnings.
From patrick46@cantv.net Thu May 14 00:58:02 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,L_SOME_STD_PROBS, MILLIONS_01,RBL_PSBL_01,RCVD_IN_BRBL,SARE_RMML_Stock19,SPF_SOFTFAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [85.21.179.31 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9995] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [85.21.179.31 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 0.2 SARE_RMML_Stock19 BODY: SARE_RMML_Stock19 * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from teploprom.com (mail.teploprom.com [85.21.179.31]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4E7vsGf027464 for ; Thu, 14 May 2009 00:58:01 -0700 Received: from [41.202.85.100] (account director HELO User) by teploprom.com (CommuniGate Pro SMTP 5.1.15) with ESMTPA id 532750; Tue, 12 May 2009 12:11:14 +0400 Received-SPF: softfail receiver=teploprom.com; client-ip=41.202.85.100; envelope-from=patrick46@cantv.net Reply-To: From: "Patrick Doumbia" To: patrick45@cantv.net Subject: [SPAM] Patrick Doumbia Date: Tue, 12 May 2009 08:45:13 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: X-Greylist: Delayed for 38:24:45 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 14 May 2009 00:58:01 -0700 (PDT) X-Spam-Prev-Subject: Patrick Doumbia Status: R X-Status: X-Keywords: X-UID: 341 Content-Length: 2055 Patrick Doumbia SOCIETE GENERALE DE BANQUES EN -RCI Good day It is true that we do not know each other in person but please bear in mind that this mail and the classified information contained therein that I am about to share with you can either destroy me, ruin my professional career or make me depending on how you receive and take it.Please, I need you to read it attentively to know the reason and purpose why you received this mail from me but before I go further I will like to introduce myself to you. I am Mr. Patrick Doumbia, a Fund Manager with SOCIETE GENERALE DE BANQUES EN -RCI ( www.sgbci.ci ) and I handle all our Investor's capital Project Funds which enabled me to divert 1.2 Percent Investors Excess Return Capital Funds to our Magellan Trust Funds Account whereby anyone like you can be presented to claim the funds. On this note, the total sum of $5.7 Million Dollars (Five million seven hundred thousand united states of America Dollars) has been diverted representing the 1.2 Percent Excess Return Capital Funds from the Investor Capital Project Funds for 2005/2006. I need a reliable and trustworthy person that can work this deal out with me so that we can claim the funds as mentioned above. There is no risk attached and the funds in question can never be detected or traced. Our sharing ratio is 60:40. (60 for me 40 for you) If you are interested, please reply and send your direct telephone numbers to me for a smooth discussion of this transaction in comprehensive details. But if you are not interested or see this mail as a scam or hoax simply delete it and forget I ever contacted you. If after 72 hours I didn't hear from you I will assume you are not interested, and then I will proceed to look for someone else that might be interested to work with me. This is a clean and straight forward bank deal, it is safe and risk-free, as I have taken care of all necessary steps to ensure a hitch-free movement. You can reach me through my private email account: patrick45@cantv.net Sincerely, Patrick Doumbia From davidpeters@eco-bank.com Thu Apr 23 22:59:33 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************************* X-Spam-Status: Yes, score=37.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,BL_COUNTRY_TW_1,BL_COUNTRY_TW_2, DEAR_FRIEND,FORGED_MUA_OUTLOOK,J_CHICKENPOX_52,J_CHICKENPOX_62, L_SOME_STD_PROBS,MISSING_HEADERS,MSOE_MID_WRONG_CASE,PHISH_05, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, RDNS_DYNAMIC,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_LWOILCO,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [59.124.92.238 listed in b.barracudacentral.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_TW_2 Mail client in Taiwan * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.73 listed in zen.spamhaus.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.73 listed in psbl.surriel.com] * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 1.1 SARE_LWOILCO BODY: SARE_LWOILCO * 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha * 0.5 BL_COUNTRY_TW_1 RBL: Mail client in Taiwan * [59.124.92.238 listed in tw.countries.nerd.dk] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 74] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 74] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from linux.jleng.com.tw (59-124-92-238.HINET-IP.hinet.net [59.124.92.238]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3O5xPJY020126 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 23 Apr 2009 22:59:32 -0700 Received: from User ([196.3.183.73]) (authenticated bits=0) by linux.jleng.com.tw (8.14.1/8.13.8) with ESMTP id n3O1X94p001311; Fri, 24 Apr 2009 09:33:27 +0800 Message-Id: <200904240133.n3O1X94p001311@linux.jleng.com.tw> Reply-To: From: "Mr.David Peters." Subject: [SPAM] {Spam?} THANKS AND GOD BLESS. Date: Thu, 23 Apr 2009 18:35:02 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-jleng_com_tw-MailScanner-Information: Please contact the ISP for more information X-jleng_com_tw-MailScanner: Found to be clean X-jleng_com_tw-MailScanner-SpamCheck: spam, SpamAssassin (cached, score=13.823, required 6, ADVANCE_FEE_1 0.00, ADVANCE_FEE_2 1.39, ADVANCE_FEE_3 3.34, ADVANCE_FEE_4 3.73, ALL_TRUSTED -1.80, BAYES_50 0.00, DEAR_FRIEND 1.63, FORGED_MUA_OUTLOOK 4.06, SUBJ_ALL_CAPS 1.00, TO_CC_NONE 0.13, URG_BIZ 0.35) X-jleng_com_tw-MailScanner-SpamScore: sssssssssssss X-jleng_com_tw-MailScanner-From: davidpeters@eco-bank.com X-Greylist: Delayed for 04:18:08 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 23 Apr 2009 22:59:32 -0700 (PDT) X-Spam-Prev-Subject: {Spam?} THANKS AND GOD BLESS. Status: R X-Status: X-Keywords: X-UID: 342 Content-Length: 2734 Dear Friend, It is with pleasure and honour that I am bringing this information to you and I hope you will not misconstrue my position. I would not be surprise if you doubt what I am about to tell you considering the tales emanating from the Internet these days. I will greatly appreciate if you spare two minutes of your time and go through this email carefully. Am Mr.David Peters,in charge of Bills and Foreign Exchange remittance Department of ECO-BANK West African Plc. I am writing you this letter to ask for your assistance and co-operation to carry out this business opportunity in my department. We discovered an unclaimed sum of $15 Million (Fifteen Million Dollars)in an account belonging to one of our foreign customer(Engr.Chung Timothy) who was a contractor with An Oil Company "Shell Development Company" who happens to be deceased during a business trip. He died with his wife (Chung Lynda) on board the Korean Air Flight 801, which crashed in Guam in Wednesday August 6, 1997.For further confirmations view the weblink below: http://www.cnn.com/WORLD/9708/06/guam.passenger.list/ Since we got information about his death we have been expecting his next of kin to come over and claim his money. Unfortunately,neither the family nor the relation has appeared to claim this money.We cannot release this money unless somebody applies as the next of kin or relation to the deceased. Our banking guidelines indicated that if such money remained unclaimed for a period of Twelve (12) years,it would be transferred into the ECO-BANK Treasury's account as unclaimed fund. Another officer and I in the department now decided to transfer this money into your account as the next of kin or relation of the deceased for easy collection since nobody is coming for it and we dont want this money to go back into the bank treasury as an unclaimed debt.Infact it is my friend that advised me to urgently arrange to transfer out this money through another foreign beneficiary outside the country. We have decided to give you 20% of the total sum. So please, as a matter of urgency send to me the below informations: 1.Your Contact address: 2.Contact Telephone & fax Numbers: 3.Age and Occupation: For effective communication. I will do my best to see that we conclude this transaction successfully on time.Please if you are interested send me an immediate mail so that I can explain the details to you to understand everything about this transaction. Waiting for your urgent response. Thanks and God bless. yours Sincerely, Mr.David Peters. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From yonglinyong@gmail.com Sat Apr 25 22:54:52 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, LOTTO_YOU_WON_03,MILLIONS_01,MILLION_USD,PHISH_05,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_HEAD_HDR_XSPAMTST, SPF_NEUTRAL,SUBJ_ALL_CAPS,US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [212.220.127.246 listed in b.barracudacentral.org] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [212.220.127.246 listed in psbl.surriel.com] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [24.132.23.67 listed in dnsbl.sorbs.net] * 1.1 SARE_HEAD_HDR_XSPAMTST Message headers used which identify spam * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from post.permonline.ru (post.permonline.ru [212.220.127.246]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n3Q5sjOl006297; Sat, 25 Apr 2009 22:54:51 -0700 Received: from mailsrv01 (mailsrv01 [127.0.0.1]) by mailsrv01 (Postfix) with ESMTP id 7D016223A35A; Sat, 25 Apr 2009 13:08:28 +0600 (YEKST) Received: from u-start.ru (mailsrv02 [10.62.226.26]) by post.permonline.ru (Postfix) with ESMTP id 7FFB821BBA8C; Sat, 25 Apr 2009 13:05:58 +0600 (YEKST) Received: from [24.132.23.67] (account abf@permonline.ru HELO User) by u-start.ru (CommuniGate Pro SMTP 5.2.8) with ESMTPA id 530570379; Sat, 25 Apr 2009 13:05:58 +0600 Reply-To: From: "YONG LIN" Subject: [SPAM] FOR YOUR PERUSAL Date: Sat, 25 Apr 2009 09:05:49 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: To: undisclosed-recipients:; X-SpamTest-Envelope-From: yonglinyong@gmail.com X-SpamTest-Group-ID: 00000000 X-SpamTest-Info: Profiles 8273 [Apr 25 2009] X-SpamTest-Info: {received from trusted relay: group white list} X-SpamTest-Method: white ip list X-SpamTest-Rate: 0 X-SpamTest-Status: Trusted X-SpamTest-Status-Extended: trusted X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0284], KAS30/Release X-Anti-Virus: Kaspersky Anti-Virus for MailServers 5.5.33/RELEASE, bases: 25042009 #1877779, status: clean X-Greylist: Delayed for 16:00:37 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 25 Apr 2009 22:54:52 -0700 (PDT) X-Spam-Prev-Subject: FOR YOUR PERUSAL Status: R X-Status: X-Keywords: X-UID: 343 Content-Length: 3759 Though seems unsolicited, this email is a business proposal to you. I appreciate the fact that you have every reason to be suspension, please note this proposal is very real. I will employ you to read it with open mind and act in the best way as directed by your mind and instinct. My name is Lin Yong, operations manager of the Bank of China (Hong Kong). It is understandable that you might be a little bit apprehensive because you do not know me but I have a lucrative business proposal of mutual benefits to share with you. In June, 2001, a late client of mine, a Crude oil merchant from your country whom we presumed (rightly or wrongly) to be a relative of yours made a numbered fixed deposit of Twenty-one million Five Hundred Thousand United State Dollars (US$21,500,000.00) only in my branch. Upon maturity several notice was sent to him Five years ago (2003) with out response. We later found out that he and his family had been killed in a plane crash. After further investigation it was also discovered that he did not declare any next of kin in his official papers including the paper work of his bank deposit and he also confided in me the last time he was in my office that no one except me knew of his deposit in my bank. So, Twenty-one million five Hundred Thousand United State Dollars is still lying in my bank and no one will ever come forward to claim it. What bothers me most is that according to the laws of my country at the expiration of seven {7} years the funds will revert to the ownership of the Hong Kong Government if nobody applies to claim the funds. Against this backdrop, my suggestion to you is that I will like you as a foreigner to stand as the next of kin so that you will be able to receive the funds. I want you to know that I have had everything planned out so that we shall come out successful. I have an attorney that will prepare the necessary document that will back you up as the next of kin (AT NO COST OF YOURS), all that is required from you is to provide me with your Full Names and Address so that the attorney can commence his job. After you have been made the next of kin, the attorney will also file in for claims on your behalf and secure the necessary approval and letter of probate in your favor for the movement of the funds to an account that will be provided by you. We are going to adopt a legalized method and the attorney will prepare all the necessary documents in your favor. There is a reward for this project and it is a task worth undertaking. There is no risk involved at all in this transaction, I have evaluated the risks and the only risk I have here is for you refusing to work with me and alerting my bank. I am the only one who knows of this situation, good fortune has blessed you with a name that has planted you into the center of relevance in my life. Please endeavor to observe utmost discretion in all matters concerning this issue. Once the funds have been transferred to your nominated bank account we shall share in the ratio of 50% for me, 10% for legal and other miscellaneous expenses and 40% for you but this can be subjected to further negotiations. I send you this mail not without a measure of fear as to the consequences, but I know within me that nothing ventured is nothing gained and that success and riches never come easy or on a platter of gold. Please observe this instruction religiously. Should you be interested please send me your, 1, Full names, 2, Current contact address, And I will prefer you reach me on my private email address: llinyong@yahoo.cn and finally after that I shall furnish you with more information's about this operation. Your earliest response to this letter will be appreciated. Kind Regards, Lin Yong. llinyong@yahoo.cn From yonglinyong@gmail.com Sat May 2 08:35:56 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************************* X-Spam-Status: Yes, score=43.1 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, LOTTO_YOU_WON_03,MILLIONS_01,MILLION_USD,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BRBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_HEAD_HDR_XSPAMTST,SPF_NEUTRAL, SUBJ_ALL_CAPS,US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [212.220.127.246 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [212.220.127.246 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [24.132.23.67 listed in dnsbl.sorbs.net] * 1.1 SARE_HEAD_HDR_XSPAMTST Message headers used which identify spam * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from post.permonline.ru (post.permonline.ru [212.220.127.246]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n42FZqOf000398 for ; Sat, 2 May 2009 08:35:56 -0700 Received: from mailsrv01 (mailsrv01 [127.0.0.1]) by mailsrv01 (Postfix) with ESMTP id 13371362C7F; Fri, 1 May 2009 05:42:38 +0600 (YEKST) Received: from u-start.ru (mailsrv02 [10.62.226.26]) by post.permonline.ru (Postfix) with ESMTP id 526422538CC3; Fri, 1 May 2009 05:25:49 +0600 (YEKST) Received: from [24.132.23.67] (account abf@permonline.ru HELO User) by u-start.ru (CommuniGate Pro SMTP 5.2.8) with ESMTPA id 531078732; Fri, 01 May 2009 05:25:48 +0600 Reply-To: From: "YONG LIN" Subject: [SPAM] FOR YOUR PERUSAL Date: Fri, 1 May 2009 01:24:59 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: To: undisclosed-recipients:; X-SpamTest-Envelope-From: yonglinyong@gmail.com X-SpamTest-Group-ID: 00000000 X-SpamTest-Info: Profiles 8368 [May 01 2009] X-SpamTest-Info: {received from trusted relay: group white list} X-SpamTest-Method: white ip list X-SpamTest-Rate: 0 X-SpamTest-Status: Trusted X-SpamTest-Status-Extended: trusted X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0284], KAS30/Release X-Anti-Virus: Kaspersky Anti-Virus for MailServers 5.5.33/RELEASE, bases: 30042009 #1914637, status: clean X-Greylist: Delayed for 37:02:07 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 02 May 2009 08:35:56 -0700 (PDT) X-Spam-Prev-Subject: FOR YOUR PERUSAL Status: R X-Status: X-Keywords: X-UID: 344 Content-Length: 3759 Though seems unsolicited, this email is a business proposal to you. I appreciate the fact that you have every reason to be suspension, please note this proposal is very real. I will employ you to read it with open mind and act in the best way as directed by your mind and instinct. My name is Lin Yong, operations manager of the Bank of China (Hong Kong). It is understandable that you might be a little bit apprehensive because you do not know me but I have a lucrative business proposal of mutual benefits to share with you. In June, 2001, a late client of mine, a Crude oil merchant from your country whom we presumed (rightly or wrongly) to be a relative of yours made a numbered fixed deposit of Twenty-one million Five Hundred Thousand United State Dollars (US$21,500,000.00) only in my branch. Upon maturity several notice was sent to him Five years ago (2003) with out response. We later found out that he and his family had been killed in a plane crash. After further investigation it was also discovered that he did not declare any next of kin in his official papers including the paper work of his bank deposit and he also confided in me the last time he was in my office that no one except me knew of his deposit in my bank. So, Twenty-one million five Hundred Thousand United State Dollars is still lying in my bank and no one will ever come forward to claim it. What bothers me most is that according to the laws of my country at the expiration of seven {7} years the funds will revert to the ownership of the Hong Kong Government if nobody applies to claim the funds. Against this backdrop, my suggestion to you is that I will like you as a foreigner to stand as the next of kin so that you will be able to receive the funds. I want you to know that I have had everything planned out so that we shall come out successful. I have an attorney that will prepare the necessary document that will back you up as the next of kin (AT NO COST OF YOURS), all that is required from you is to provide me with your Full Names and Address so that the attorney can commence his job. After you have been made the next of kin, the attorney will also file in for claims on your behalf and secure the necessary approval and letter of probate in your favor for the movement of the funds to an account that will be provided by you. We are going to adopt a legalized method and the attorney will prepare all the necessary documents in your favor. There is a reward for this project and it is a task worth undertaking. There is no risk involved at all in this transaction, I have evaluated the risks and the only risk I have here is for you refusing to work with me and alerting my bank. I am the only one who knows of this situation, good fortune has blessed you with a name that has planted you into the center of relevance in my life. Please endeavor to observe utmost discretion in all matters concerning this issue. Once the funds have been transferred to your nominated bank account we shall share in the ratio of 50% for me, 10% for legal and other miscellaneous expenses and 40% for you but this can be subjected to further negotiations. I send you this mail not without a measure of fear as to the consequences, but I know within me that nothing ventured is nothing gained and that success and riches never come easy or on a platter of gold. Please observe this instruction religiously. Should you be interested please send me your, 1, Full names, 2, Current contact address, And I will prefer you reach me on my private email address: llinyong@yahoo.cn and finally after that I shall furnish you with more information's about this operation. Your earliest response to this letter will be appreciated. Kind Regards, Lin Yong. llinyong@yahoo.cn From jyxczjb@public1.wx.js.cn Sun May 3 19:05:19 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************** X-Spam-Status: Yes, score=26.2 required=5.0 tests=ADVANCE_FEE_2,BAYES_95, BL_COUNTRY_CN_1,BL_COUNTRY_CN_2,BL_COUNTRY_NG_2,DATE_IN_FUTURE_03_06, FH_HAS_XAIMC,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,MILLIONS_01,MISSING_HEADERS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.7 FH_HAS_XAIMC Has X-AIMC-AUTH header * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.3 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date * 1.3 MISSING_HEADERS Missing To: header * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [61.155.13.214 listed in psbl.surriel.com] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [61.155.13.214 listed in cn.countries.nerd.dk] * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9866] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 72] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 72] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from jlonline.com (pip38.ptt.js.cn [61.155.13.214]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n4425DI9025581 for ; Sun, 3 May 2009 19:05:19 -0700 Received: from User([82.128.104.119]) by ptt.js.cn(AIMC 3.2.0.0) with SMTP id jm6649fe95df; Mon, 04 May 2009 07:28:02 +0800 Reply-To: From: "MRS. ELIZABETH BAKER" Subject: [SPAM] Your parcel is With the Courier Service .... Contact Immediately!!!! Date: Mon, 4 May 2009 00:31:24 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-AIMC-AUTH: jyxczjb:wx3 X-AIMC-MAILFROM: jyxczjb@public1.wx.js.cn Message-ID: <4L909495927197.28000@smtp14> X-AIMC-Msg-ID: cMSGlAWB X-Greylist: Delayed for 02:35:43 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 03 May 2009 19:05:19 -0700 (PDT) X-Spam-Prev-Subject: Your parcel is With the Courier Service .... Contact Immediately!!!! Status: R X-Status: X-Keywords: X-UID: 345 Content-Length: 3095 Greetings!!! I have been waiting for you since to contact me for your Confirmable Bank Draft of $500, 000, 00 (FIVE HUNDRED THOUSAND UNITED STATE DOLLARS) but I did not hear from you since for a couple of weeks now. Then I went to the bank to confirm if the draft has expired or getting near to the date of expire and Dr. Wilson the Director Bank of Africa told me that before the draft will get to your hand that it will expire. So I told him to cash the $500,000,00( FIVE HUNDRED THOUSAND (UNITED STATE DOLLARS) to cash payment to avoid losing this funds under expiration as I will be out of the country for a 8 Months Course and I will not come back till Ending of AUGUST 2009. Further more I want you to use this fund for the support of God work and also for you to help the poor once among you, so this is why I have handover this parcel/ you fund to Mr. Collins Douglas and as soon as you contact him you will have to pay the sum of $250 for Security up keeping of your parcel and I want you to know that this fund is from the Catholic Church to support the world. What you have to do now is to contact PARCEL EXPRESS COURIER SERVICES as soon as possible to know when they will deliver your Consignment to you because of the expiring date. For your information, I have paid for the delivering Charge, Insurance premium. The only money you will send to the PARCEL EXPRESS COURIER SERVICES to deliver your Consignment direct to your postal Address in your country is ($250USD) only being Security Keeping Fee of the Courier Company so far. Again, don't be deceived by anybody to pay any other money except $250USD ONLY. I would have paid that but they said no because they don't know when you will contact them and in case of demurrage. You have to contact the PARCEL EXPRESS COURIER SERVICES now for the delivery of your Draft with this information bellow; Directors Name: MR. COLLINS DOUGLAS. Companys Name: PARCEL EXPRESS COURIER SERVICES E-mail: (parcel.collection.point1us@gmail.com) Finally, make sure that you reconfirm your Postal address and Direct telephone number to them again to avoid any mistake on the Delivery and ask them to give you the tracking number to enable you track your package over there, that will be after you paid the Security Keeping Fee and when it will get to your address. Let me repeat again, Try to contact them as soon as you receive this mail and ask them how you will make the security fee of $250USD to them to avoid any further delay and remember to pay them their Security Keeping fee of $250USD for their immediate action. 1, Full Name:........... 2, Address of Residence:.......... 3, country from:.................. 4, Telephone Number:................. 5, Occupation:.................... 6, Age:......................... Note this. The PARCEL EXPRESS COURIER SERVICES don't know the contents of the Box. I registered it as a BOX of Africa cloths. They did not know the content was money? This is to avoid them delaying with the BOX. Dont let them Know that box contents is money okay. Yours Faithfully, MRS. ELIZABETH BAKER. From edmcnenney@optonline.net Thu May 14 22:55:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4F5t2Ud030043 for ; Thu, 14 May 2009 22:55:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******** X-Spam-Status: Yes, score=8.6 required=5.0 tests=BAYES_99,FREEMAIL_FORGED, HTML_MESSAGE,J_CHICKENPOX_41,MISSING_HEADERS,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Thu, 14 May 2009 22:55:03 -0700 (PDT) Received: from wmta3.srv.hcvlny.cv.net (wmta3.srv.hcvlny.cv.net [167.206.10.6]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4F5qhGt010798 for ; Thu, 14 May 2009 22:52:46 -0700 Received: from optonline.net (mstr10a.srv.hcvlny.cv.net [10.240.4.176]) by wmta3.srv.hcvlny.cv.net (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTP id <0KJO0000Z6XP7Q00@wmta3.srv.hcvlny.cv.net> for jhardin@impsec.org; Fri, 15 May 2009 01:22:38 -0400 (EDT) Received: from [10.240.3.196] (Forwarded-For: 222.124.211.181, [10.240.3.196]) by mstr10.srv.hcvlny.cv.net (mshttpd); Fri, 15 May 2009 05:22:37 +0000 (GMT) Date: Fri, 15 May 2009 05:22:37 +0000 (GMT) From: edmcnenney@optonline.net Subject: [SPAM] Re: Reply Please!! Bcc: Reply-to: wngpeter@yahoo.com.hk Message-id: MIME-version: 1.0 X-Mailer: Sun Java(tm) System Messenger Express 6.2-8.04 (built Feb 28 2007) X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-type: multipart/alternative; boundary="Boundary_(ID_tcPAxAScQhqw2d4MYLAxcA)" Content-language: en X-Accept-Language: en Priority: normal X-Greylist: Delayed for 00:30:02 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 14 May 2009 22:52:46 -0700 (PDT) X-Spam-Prev-Subject: Re: Reply Please!! Status: R X-Status: X-Keywords: X-UID: 346 This is a multi-part message in MIME format. --Boundary_(ID_tcPAxAScQhqw2d4MYLAxcA) Content-type: text/plain; charset=us-ascii Content-disposition: inline Content-transfer-encoding: 7BIT Good dayI am Mr.Peter Wong,I have a deceased client funds in my bank i need you to front as beneficiary,If interested contact me via: wngpeter@yahoo.com.hkSincerely,Mr. Peter. --Boundary_(ID_tcPAxAScQhqw2d4MYLAxcA) Content-type: text/html; charset=us-ascii Content-disposition: inline Content-transfer-encoding: 7BIT

Good day

I am Mr.Peter Wong,I have a deceased client funds in my bank i need you to front as beneficiary,If interested contact me via: wngpeter@yahoo.com.hk

Sincerely,

Mr. Peter.

--Boundary_(ID_tcPAxAScQhqw2d4MYLAxcA)-- From raymndlle@yahoo.com.hk Thu May 14 19:37:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, PHISH_05,RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_HEAD_HDR_XSPAMTST,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [212.220.127.246 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [212.220.127.246 listed in psbl.surriel.com] * 1.1 SARE_HEAD_HDR_XSPAMTST Message headers used which identify spam * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.2 PHISH_05 BODY: Phishing for account information * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from post.permonline.ru (post.permonline.ru [212.220.127.246]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4F2bVJF005406 for ; Thu, 14 May 2009 19:37:37 -0700 Received: from mailsrv01 (mailsrv01 [127.0.0.1]) by mailsrv01 (Postfix) with ESMTP id A2AAB2141838; Thu, 14 May 2009 08:51:39 +0600 (YEKST) Received: from u-start.ru (mailsrv02 [10.62.226.26]) by post.permonline.ru (Postfix) with ESMTP id A872DB629F5; Thu, 14 May 2009 06:50:30 +0600 (YEKST) Received: from [87.210.73.218] (account abf@permonline.ru HELO User) by u-start.ru (CommuniGate Pro SMTP 5.2.8) with ESMTPA id 532070797; Thu, 14 May 2009 06:22:27 +0600 Reply-To: From: "Mr. LEE Raymond Wing Hung" Subject: [SPAM] December 2004 Asia Tsunami disaster. Date: Thu, 14 May 2009 08:22:28 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: To: undisclosed-recipients:; X-SpamTest-Envelope-From: raymndlle@yahoo.com.hk X-SpamTest-Group-ID: 00000000 X-SpamTest-Info: Profiles 8441 [May 14 2009] X-SpamTest-Info: {received from trusted relay: group white list} X-SpamTest-Method: white ip list X-SpamTest-Rate: 0 X-SpamTest-Status: Trusted X-SpamTest-Status-Extended: trusted X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0284], KAS30/Release X-Anti-Virus: Kaspersky Anti-Virus for MailServers 5.5.33/RELEASE, bases: 14052009 #1969807, status: clean X-Greylist: Delayed for 16:53:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 14 May 2009 19:37:38 -0700 (PDT) X-Spam-Prev-Subject: December 2004 Asia Tsunami disaster. Status: R X-Status: X-Keywords: X-UID: 347 Content-Length: 3583 Greetings! It is understandable that you might be a little bit apprehensive because you do not know me, Please forgive this unusual manner to contact you, but this particular letter/email is of exceptional and very private nature, as by virtue of my vantage position in Bank of China Hong Kong i have a lucrative business proposal of mutual interest to share with you. There is no way for me to know whether I will be properly understood, but it is my duty to write and reach out to you, TRUSTING that you will give this proposal a positive consideration. I am Mr. LEE Raymond Wing Hung I am 58years old and happily married with grown-up children, and i am a Director of Bank of China Hong Kong in charge of the International Remittance department. I will need you to assist me in executing a business project from our bank worth US$30.5 Million. These funds were deposited with our bank by a customer of our bank who is a national {citizen} of your country, who unfortunately died in the December 2004 Asia Tsunami disaster. For more on this natural disaster click on these links:- http://news.bbc.co.uk/cbbcnews/hi/newsid_4530000/newsid_4537600/4537601.stm http://edition.cnn.com/2005/WORLD/asiapcf/02/19/tsunami.bush.clinton/index.html http://www.smh.com.au/news/Asia-Tsunami/Tsunami-survivors-face-disease-starvation/2004/12/28/1103996558253.html http://www.globalsecurity.org/eye/andaman-us.htm The deceased account has been declared dormant since 2006 and these funds will be confiscated/declared unserviceable and turned over to the Hong Kong government if the deceased business associates or next-of-kin did not claim this money; since all efforts to trace any living relative of the deceased proved abortive, i have decided that i will have you claim this money as the deceased business associate/or next-of-kin, since you are from the same country and perhaps have some similarities in certain areas. Everything concerning this transaction shall be LEGALLY done without hitch, as i was the deceased account Officer and all the relevant documents of this deposit were kept under my care. Please endeavor to observe utmost discretion in all matters concerning this issue, as i hope that you are a sincere, honest and matured person and above all TRUSTWORTHY. Once the funds have been successfully transferred into your account, we shall share it in a ratio of 30% for you, 65% for me and my associates in the bank and the reminder 5% to take care of contingencies. I will prefer you reach me on my private email address below :{ leeraymondwhung@yahoo.com.hk) and finally after that I shall furnish you with more information about this operation. I am counting on your anticipated co-operation for a successful and hitch free business transaction between us, that will be mutually beneficial, for a start oblige me these information:- 1. Your Full name{s}:- 2.Current contact address:- 3. Your present Occupation: - 4.Your age:- 5. Contact phone numbers {Office and Mobile {cell}:- Please if you are not interested delete this email and do not hurt me because I am putting my career and the life of my family at stake with this venture. Although nothing ventured is nothing gained, as it is said, the taste of the pudding is in the eating, do give this proposal SERIOUS AND POSITIVE CONSIDERATION. Your earliest response to this letter will be highly appreciated. Kind regards, Mr. LEE Raymond Wing Hung Bank of China Hong Kong.{ Asia } Email:- leeraymondwhung@yahoo.com.hk PS:-PLEASE SEND YOUR REPLY STRICTLY TO THIS E-MAIL ADDRESS:- leeraymondwhung@yahoo.com.hk From go@go.com Fri May 15 06:27:19 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.8 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_95,DATE_IN_PAST_96_XX,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER, MSOE_MID_WRONG_CASE,PHISH_05,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,URG_BIZ,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [217.67.228.225 listed in b.barracudacentral.org] * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.7 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9736] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from s2.swemedia.nl (hosted.by.dwsmedia.net [217.67.228.225] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4FDRDvJ023849 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 15 May 2009 06:27:18 -0700 Message-Id: <200905151327.n4FDRDvJ023849@ga.impsec.org> Received: from [217.67.228.222] (helo=User) by s2.swemedia.nl with esmtpa (Exim 4.67) (envelope-from ) id 1M4rSk-0005gR-Cw; Fri, 15 May 2009 09:05:20 +0200 Reply-To: From: "Mrs. Rita Shumejda" Subject: [SPAM] Dear Beloved *ii Date: Wed, 15 Apr 2009 08:09:21 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 05:55:05 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 15 May 2009 06:27:19 -0700 (PDT) X-Spam-Prev-Subject: Dear Beloved *ii Status: R X-Status: X-Keywords: X-UID: 348 Content-Length: 3152 From: Mrs. Rita Shumejda Suite 210, Coborn House 3 Coborn Road, Docklands London, E3 2DA, United Kingdom Dear Beloved , Please accept my sincere apologizes if my email does not meet your business or personal ethics. I am Mrs. Rita Shumejda, I am 65 years old, a widow to late Mr. John Shumejda who was the President of Agricultural Equipment Giant AGCO Corp, who perished on the 4th of January 2002 in a Plane Crash in Birmingham. See the website below:- http://edition.cnn.com/2002/WORLD/europe/01/04/england.plane/ After going through some files of my late husband, I discovered a Deposit Certificate of US$9,000,000.00 with a Bank in London. But due to my sickness, I have not been able to claim this fund from the Bank, as I have been in the hospital in Liverpool and my sickness continue getting worst. I am suffering from a Protracted Cancer of the Lungs which has affected my Brain.From all indication my condition is really deteriorating, and my doctors have courageously advised me that I may not live beyond the next Six to eight months, this is because the cancer stage has reached a critical stage. Prime Minister Gordon Brown said that some of the money held in Dormant Accounts would be used to fund youth and community projects for your confirmation please visit : http://news.bbc.co.uk/2/hi/business/4017381.stm I am contacting you based on trust to present you to the Bank as the Next of Kin and bonafide inheritor to my late husband's fund, since I cannot claim this fund myself now and I may not live beyong next six-eight months according to my doctors, but I have the faith in God that I will live more than the months my Doctors said by God's grace. Presently, I'm with my laptop in the hospital where I have been undergoing treatment in London. Please! Please!! Your help is needed to avoid this money been diverted to the Government of UK as unclaimed fund/dormant account. Imagine somebody who have no child, I have nobody taking care of me here in the hospital, and the money I have now is limited. Of which, that US$9,000,000.00 is my only hope to continue my treatment here in the Hospital, and hopefully by God grace I will survive. If you will be so kind to be of help, I will be very glad and only God will reward you for that. Upon the successful claim/transfer of the fund in your account as the next of Kin, 40% of the total fund will be taking as your own share, 10% goes to the Orphanage Homes, while the remaining 50% will be transfer to my account here in Liverpool for my treatment. Please in your response, send me the following information to enable me validate you as the legal beneficiary of this funds: 1. Your full names 2. Your home or office address 3. Telephone 4. Your Mobile Phone number 5. Your Age 6. Marital Status 4. Your Occupation These whole information is what I need from you so that I can present a Letter of Authorisation to the Bank where the money is deposited to contact you as the Next of Kin for this funds transfer. Please Send your urgent response and your assistance will be highly appreciated. Best regards and God bless. Mrs. Rita Shumejda From audit.dept@standardchartered.com Sun May 17 10:53:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,L_SOME_STD_PROBS, MILLIONS_01,MISSING_HEADERS,MSOE_MID_WRONG_CASE,PHISH_05,RBL_PSBL_01, RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [62.141.56.4 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.3 MISSING_HEADERS Missing To: header * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [62.141.56.4 listed in psbl.surriel.com] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from km1610.keymachine.de (ns.km1610.keymachine.de [62.141.56.4]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4HHqptU015611 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 17 May 2009 10:53:16 -0700 Received: from User (host217-34-47-188.in-addr.btopenworld.com [217.34.47.188]) (authenticated bits=0) by km1610.keymachine.de (8.12.11.20060308/8.12.11) with ESMTP id n4HHlVOR017428; Sun, 17 May 2009 19:47:32 +0200 Message-Id: <200905171747.n4HHlVOR017428@km1610.keymachine.de> Reply-To: From: "James Dale Jr." Subject: [SPAM] Inheritance Funds / Call Me Immediately Date: Sun, 17 May 2009 18:39:17 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 17:36:14 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 17 May 2009 10:53:16 -0700 (PDT) X-Spam-Prev-Subject: Inheritance Funds / Call Me Immediately Status: R X-Status: X-Keywords: X-UID: 349 Content-Length: 2451 From: James Dale Jr. Private Email: jjjr.dale@gmail.com Tel: +44 702 408 7515 Subject: Inheritance Funds / Call Me Immediately Date: MAY. 17TH, 2009. Hello, I apologize if the contents hereunder are contrary to your moral ethics, but please treat it with absolute secrecy and personal courtesy. I am James Dale Jr. an Auditor in a commercial Bank here in London UK, in the process of auditing our bank accounts for the first quarter of the year, I recently discovered that there was a dormant account valued at the sum 7,394,890.00 (Seven Million, three hundred and ninety four thousand, eight hundred and ninety British Pounds Sterling) and after due verification of this account I discovered that the account owner is late. That is why the account has been dormant and as such the funds are lying unclaimed in the bank. The idea of presenting a foreigner to act as his next of kin came into my mind so as to have the total sum of 7,394,890.00 being transferred and willed to you and we can both disburse the fund according to the percentage we will agree upon. In view of this, I am seeking for your co-operation and understanding to stand as the next of kin to our deceased customer, to enable us claim the fund from my bank. Hence, if this proposal is OK by you and you do not wish to take undue advantage of my trust. Please kindly get back to me immediately, strictly via my private email address only: jjjr.dale@gmail.com to enable me enlighten you on how we are to proceed. I will appreciate if the details below are confirmed back to me in your next email in order for me to prepare the MOU, MEMORANDUM OF UNDERSTANDING that both of us will endorse in other for both parties to be protected. FULL NAME: CONTACT ADDRESS: PHONE NUMBER (S): SEX/AGE: NATIONALITY: OCCUPATION/PROFESSION: On getting your response with the above details, we shall agree on the percentage ratio on how the funds shall be splitted between ourselves, as I intend to invest part of our own share in real estate or any lucrative business in your country, and I would appreciate if you can put me in the right part where I can invest my own share. Be rest assured that this business is 100% risk free. I await for your prompt response. Best Regards, James Dale Jr. Tel: +44 702 408 7515 NB: PLEASE NOTE THAT IT DOES NOT MATTER IF YOU ARE NOT RELATED TO MY LATE CLIENT OR NOT; THE FUND WILL STILL BE PAID TO YOU, SINCE I AM PRESENTING YOU AS HIS NEXT OF KIN. From jhardin@impsec.org Mon May 18 18:35:04 2009 -0700 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4J1Z3tc007010 for ; Mon, 18 May 2009 18:35:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******* X-Spam-Status: Yes, score=7.7 required=5.0 tests=BAYES_50,BAYES_POISON_02, FREEMAIL_FROM,HTML_MESSAGE,L_SOME_STD_PROBS,MISSING_HEADERS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SPF_PASS, SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.3 MISSING_HEADERS Missing To: header * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.4948] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 BAYES_POISON_02 Appears to have "bayes poison" unpunctuated text * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Mon, 18 May 2009 18:35:03 -0700 (PDT) Received: from mail-fx0-f162.google.com (mail-fx0-f162.google.com [209.85.220.162]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4J1Uak1001309 for ; Mon, 18 May 2009 18:30:40 -0700 Received: by fxm6 with SMTP id 6so4114238fxm.13 for ; Mon, 18 May 2009 18:30:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:content-type; bh=D6Diu+XRk+EtwyP8DgEjmyyDNpAVh+rUuql/IlpTabY=; b=KxsSz8xw/98432oh4FnWP5ki3stAo1qQdjKeg8F7eF3xFtQTHkIFOmuCdwDAhjpleh bu7Nii5kHpsgrJFoJUbRYcEGsaRVJv0YX6gByfWB0sQksL1aLwlgtKHHMhHA+t1V+r8T 8U38SMlLTWxqR0HAtRCP6y+WfG7/8eM9IKw1w= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:content-type; b=Xqe09qrdWBfdsPIOKg6Mnav0eTbeQLpUTj+Jf8o54GPuAwQ0U6uCSYgVN8+uCoOBcJ PN0PiMnxZUAgSNUu8WYEDwKkchtSg14mN0BRT5Qmjm6lZOtrXEkiFNV5x82v/qFXg5hk kPNXRU7ettyf9Qv7nLuhGzE74G+IvhW1f6iRA= MIME-Version: 1.0 Received: by 10.204.55.200 with SMTP id v8mt9917658bkg.54.1242694809493; Mon, 18 May 2009 18:00:09 -0700 (PDT) Date: Tue, 19 May 2009 02:00:09 +0100 Message-ID: <71607e810905181800u1adebf37wcd9be79d552d61a2@mail.gmail.com> Subject: [SPAM] LETTER OF DR.EDWARD From: Hargley Chris X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/mixed; boundary=001636c5a92b7fd4ee046a39db69 X-Greylist: Delayed for 00:29:28 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 18 May 2009 18:30:41 -0700 (PDT) X-Spam-Prev-Subject: LETTER OF DR.EDWARD Status: R X-Status: X-Keywords: X-UID: 350 --001636c5a92b7fd4ee046a39db69 Content-Type: multipart/alternative; boundary=001636c5a92b7fd4e7046a39db67 --001636c5a92b7fd4e7046a39db67 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit PLEASE VIEW ATTACHED LETTER REGARDING LATE DR.EDWARD ESTATE --001636c5a92b7fd4e7046a39db67 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit PLEASE VIEW ATTACHED LETTER REGARDING LATE DR.EDWARD ESTATE --001636c5a92b7fd4e7046a39db67-- --001636c5a92b7fd4ee046a39db69 Content-Type: Text/Plain; charset=US-ASCII X-Content-Type: application/pdf; name="LETTER OF LATE DR.EDWARD.pdf" X-Content-Disposition: attachment; filename="LETTER OF LATE DR.EDWARD.pdf" X-Attachment-Id: f_fuvw9d7t0 X-Content-Transfer-Encoding: base64 [ The following attachment was DELETED when this message was saved: ] [ A Application/PDF (Name="LETTER OF LATE DR.EDWARD.pdf") segment of a ] --001636c5a92b7fd4ee046a39db69-- From leeroy112@msn.com Tue May 19 15:45:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4JMj3tv025348 for ; Tue, 19 May 2009 15:45:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********* X-Spam-Status: Yes, score=9.6 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, FREEMAIL_FROM,FREEMAIL_REPLYTO,HTML_MESSAGE,MISSING_HEADERS,RAZOR2_CHECK, SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9933] * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Tue, 19 May 2009 15:45:03 -0700 (PDT) Received: from blu0-omc2-s25.blu0.hotmail.com (blu0-omc2-s25.blu0.hotmail.com [65.55.111.100]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4JMfYd3004142 for ; Tue, 19 May 2009 15:41:37 -0700 Received: from BLU121-W25 ([65.55.111.72]) by blu0-omc2-s25.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 19 May 2009 15:25:12 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_b1e7163f-aa30-464d-ac11-5f6360142e97_" X-Originating-IP: [77.220.25.8] Reply-To: From: leeroy pryor Subject: [SPAM] Investment Date: Tue, 19 May 2009 22:25:12 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 19 May 2009 22:25:12.0445 (UTC) FILETIME=[AD067AD0:01C9D8D0] X-Greylist: Delayed for 00:16:21 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 19 May 2009 15:41:38 -0700 (PDT) X-Spam-Prev-Subject: Investment Status: R X-Status: X-Keywords: X-UID: 351 Content-Length: 1495 --_b1e7163f-aa30-464d-ac11-5f6360142e97_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Goodday!=2C I am interested to invest my money ($107=2CMillion) in your company or in a= ny profitable business venture in your country=2C because my Illness is at = its terminal stage and I must invest for my little children and you will be= compensated with 30% of the money. Please respond via this my private email address leeroypryor56@gmail.com as= soon as possible so that we can discuss more about this project. Best Regards and God Bless. leeroy pryor. --_b1e7163f-aa30-464d-ac11-5f6360142e97_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Goodday!=2C
I am interested to invest my money ($107=2CMillion) in your company or in a= ny profitable business venture in your country=2C because my Illness is at = its terminal stage and I must invest for my little children and you will be= compensated with 30% of the money.
Please respond via this my private email address leeroypryor56@gmail.com as soon as possible so that we= can discuss more about this project.
Best Regards and God Bless.
leeroy pryor.
= --_b1e7163f-aa30-464d-ac11-5f6360142e97_-- From raymndlle@yahoo.com.hk Thu May 14 19:37:38 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, PHISH_05,RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_HEAD_HDR_XSPAMTST,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [212.220.127.246 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [212.220.127.246 listed in psbl.surriel.com] * 1.1 SARE_HEAD_HDR_XSPAMTST Message headers used which identify spam * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 0.2 PHISH_05 BODY: Phishing for account information * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from post.permonline.ru (post.permonline.ru [212.220.127.246]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4F2bVJF005406 for ; Thu, 14 May 2009 19:37:37 -0700 Received: from mailsrv01 (mailsrv01 [127.0.0.1]) by mailsrv01 (Postfix) with ESMTP id A2AAB2141838; Thu, 14 May 2009 08:51:39 +0600 (YEKST) Received: from u-start.ru (mailsrv02 [10.62.226.26]) by post.permonline.ru (Postfix) with ESMTP id A872DB629F5; Thu, 14 May 2009 06:50:30 +0600 (YEKST) Received: from [87.210.73.218] (account abf@permonline.ru HELO User) by u-start.ru (CommuniGate Pro SMTP 5.2.8) with ESMTPA id 532070797; Thu, 14 May 2009 06:22:27 +0600 Reply-To: From: "Mr. LEE Raymond Wing Hung" Subject: [SPAM] December 2004 Asia Tsunami disaster. Date: Thu, 14 May 2009 08:22:28 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: To: undisclosed-recipients:; X-SpamTest-Envelope-From: raymndlle@yahoo.com.hk X-SpamTest-Group-ID: 00000000 X-SpamTest-Info: Profiles 8441 [May 14 2009] X-SpamTest-Info: {received from trusted relay: group white list} X-SpamTest-Method: white ip list X-SpamTest-Rate: 0 X-SpamTest-Status: Trusted X-SpamTest-Status-Extended: trusted X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0284], KAS30/Release X-Anti-Virus: Kaspersky Anti-Virus for MailServers 5.5.33/RELEASE, bases: 14052009 #1969807, status: clean X-Greylist: Delayed for 16:53:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 14 May 2009 19:37:38 -0700 (PDT) X-Spam-Prev-Subject: December 2004 Asia Tsunami disaster. Status: R X-Status: X-Keywords: X-UID: 352 Content-Length: 3583 Greetings! It is understandable that you might be a little bit apprehensive because you do not know me, Please forgive this unusual manner to contact you, but this particular letter/email is of exceptional and very private nature, as by virtue of my vantage position in Bank of China Hong Kong i have a lucrative business proposal of mutual interest to share with you. There is no way for me to know whether I will be properly understood, but it is my duty to write and reach out to you, TRUSTING that you will give this proposal a positive consideration. I am Mr. LEE Raymond Wing Hung I am 58years old and happily married with grown-up children, and i am a Director of Bank of China Hong Kong in charge of the International Remittance department. I will need you to assist me in executing a business project from our bank worth US$30.5 Million. These funds were deposited with our bank by a customer of our bank who is a national {citizen} of your country, who unfortunately died in the December 2004 Asia Tsunami disaster. For more on this natural disaster click on these links:- http://news.bbc.co.uk/cbbcnews/hi/newsid_4530000/newsid_4537600/4537601.stm http://edition.cnn.com/2005/WORLD/asiapcf/02/19/tsunami.bush.clinton/index.html http://www.smh.com.au/news/Asia-Tsunami/Tsunami-survivors-face-disease-starvation/2004/12/28/1103996558253.html http://www.globalsecurity.org/eye/andaman-us.htm The deceased account has been declared dormant since 2006 and these funds will be confiscated/declared unserviceable and turned over to the Hong Kong government if the deceased business associates or next-of-kin did not claim this money; since all efforts to trace any living relative of the deceased proved abortive, i have decided that i will have you claim this money as the deceased business associate/or next-of-kin, since you are from the same country and perhaps have some similarities in certain areas. Everything concerning this transaction shall be LEGALLY done without hitch, as i was the deceased account Officer and all the relevant documents of this deposit were kept under my care. Please endeavor to observe utmost discretion in all matters concerning this issue, as i hope that you are a sincere, honest and matured person and above all TRUSTWORTHY. Once the funds have been successfully transferred into your account, we shall share it in a ratio of 30% for you, 65% for me and my associates in the bank and the reminder 5% to take care of contingencies. I will prefer you reach me on my private email address below :{ leeraymondwhung@yahoo.com.hk) and finally after that I shall furnish you with more information about this operation. I am counting on your anticipated co-operation for a successful and hitch free business transaction between us, that will be mutually beneficial, for a start oblige me these information:- 1. Your Full name{s}:- 2.Current contact address:- 3. Your present Occupation: - 4.Your age:- 5. Contact phone numbers {Office and Mobile {cell}:- Please if you are not interested delete this email and do not hurt me because I am putting my career and the life of my family at stake with this venture. Although nothing ventured is nothing gained, as it is said, the taste of the pudding is in the eating, do give this proposal SERIOUS AND POSITIVE CONSIDERATION. Your earliest response to this letter will be highly appreciated. Kind regards, Mr. LEE Raymond Wing Hung Bank of China Hong Kong.{ Asia } Email:- leeraymondwhung@yahoo.com.hk PS:-PLEASE SEND YOUR REPLY STRICTLY TO THIS E-MAIL ADDRESS:- leeraymondwhung@yahoo.com.hk From go@go.com Fri May 15 06:27:19 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.8 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_95,DATE_IN_PAST_96_XX,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER, MSOE_MID_WRONG_CASE,PHISH_05,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,URG_BIZ,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [217.67.228.225 listed in b.barracudacentral.org] * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.7 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9736] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from s2.swemedia.nl (hosted.by.dwsmedia.net [217.67.228.225] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4FDRDvJ023849 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 15 May 2009 06:27:18 -0700 Message-Id: <200905151327.n4FDRDvJ023849@ga.impsec.org> Received: from [217.67.228.222] (helo=User) by s2.swemedia.nl with esmtpa (Exim 4.67) (envelope-from ) id 1M4rSk-0005gR-Cw; Fri, 15 May 2009 09:05:20 +0200 Reply-To: From: "Mrs. Rita Shumejda" Subject: [SPAM] Dear Beloved *ii Date: Wed, 15 Apr 2009 08:09:21 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 05:55:05 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 15 May 2009 06:27:19 -0700 (PDT) X-Spam-Prev-Subject: Dear Beloved *ii Status: R X-Status: X-Keywords: X-UID: 353 Content-Length: 3152 From: Mrs. Rita Shumejda Suite 210, Coborn House 3 Coborn Road, Docklands London, E3 2DA, United Kingdom Dear Beloved , Please accept my sincere apologizes if my email does not meet your business or personal ethics. I am Mrs. Rita Shumejda, I am 65 years old, a widow to late Mr. John Shumejda who was the President of Agricultural Equipment Giant AGCO Corp, who perished on the 4th of January 2002 in a Plane Crash in Birmingham. See the website below:- http://edition.cnn.com/2002/WORLD/europe/01/04/england.plane/ After going through some files of my late husband, I discovered a Deposit Certificate of US$9,000,000.00 with a Bank in London. But due to my sickness, I have not been able to claim this fund from the Bank, as I have been in the hospital in Liverpool and my sickness continue getting worst. I am suffering from a Protracted Cancer of the Lungs which has affected my Brain.From all indication my condition is really deteriorating, and my doctors have courageously advised me that I may not live beyond the next Six to eight months, this is because the cancer stage has reached a critical stage. Prime Minister Gordon Brown said that some of the money held in Dormant Accounts would be used to fund youth and community projects for your confirmation please visit : http://news.bbc.co.uk/2/hi/business/4017381.stm I am contacting you based on trust to present you to the Bank as the Next of Kin and bonafide inheritor to my late husband's fund, since I cannot claim this fund myself now and I may not live beyong next six-eight months according to my doctors, but I have the faith in God that I will live more than the months my Doctors said by God's grace. Presently, I'm with my laptop in the hospital where I have been undergoing treatment in London. Please! Please!! Your help is needed to avoid this money been diverted to the Government of UK as unclaimed fund/dormant account. Imagine somebody who have no child, I have nobody taking care of me here in the hospital, and the money I have now is limited. Of which, that US$9,000,000.00 is my only hope to continue my treatment here in the Hospital, and hopefully by God grace I will survive. If you will be so kind to be of help, I will be very glad and only God will reward you for that. Upon the successful claim/transfer of the fund in your account as the next of Kin, 40% of the total fund will be taking as your own share, 10% goes to the Orphanage Homes, while the remaining 50% will be transfer to my account here in Liverpool for my treatment. Please in your response, send me the following information to enable me validate you as the legal beneficiary of this funds: 1. Your full names 2. Your home or office address 3. Telephone 4. Your Mobile Phone number 5. Your Age 6. Marital Status 4. Your Occupation These whole information is what I need from you so that I can present a Letter of Authorisation to the Bank where the money is deposited to contact you as the Next of Kin for this funds transfer. Please Send your urgent response and your assistance will be highly appreciated. Best regards and God bless. Mrs. Rita Shumejda From go@go.com Fri May 15 06:50:15 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_95,DATE_IN_PAST_96_XX,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MISSING_HEADERS,MSGID_FROM_MTA_HEADER, MSOE_MID_WRONG_CASE,PHISH_05,RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,URG_BIZ, US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [217.67.228.225 listed in b.barracudacentral.org] * 0.1 FREEMAIL_FROM From-address is freemail domain * 1.7 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9736] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from s2.swemedia.nl (hosted.by.dwsmedia.net [217.67.228.225] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4FDoADL024208 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 15 May 2009 06:50:15 -0700 Message-Id: <200905151350.n4FDoADL024208@ga.impsec.org> Received: from [217.67.228.222] (helo=User) by s2.swemedia.nl with esmtpa (Exim 4.67) (envelope-from ) id 1M4xhX-0002tg-96; Fri, 15 May 2009 15:43:53 +0200 Reply-To: From: "Mrs. Rita Shumejda" Subject: [SPAM] Dear Beloved *ii Date: Wed, 15 Apr 2009 14:49:03 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Prev-Subject: Dear Beloved *ii Status: R X-Status: X-Keywords: X-UID: 354 Content-Length: 3152 From: Mrs. Rita Shumejda Suite 210, Coborn House 3 Coborn Road, Docklands London, E3 2DA, United Kingdom Dear Beloved , Please accept my sincere apologizes if my email does not meet your business or personal ethics. I am Mrs. Rita Shumejda, I am 65 years old, a widow to late Mr. John Shumejda who was the President of Agricultural Equipment Giant AGCO Corp, who perished on the 4th of January 2002 in a Plane Crash in Birmingham. See the website below:- http://edition.cnn.com/2002/WORLD/europe/01/04/england.plane/ After going through some files of my late husband, I discovered a Deposit Certificate of US$9,000,000.00 with a Bank in London. But due to my sickness, I have not been able to claim this fund from the Bank, as I have been in the hospital in Liverpool and my sickness continue getting worst. I am suffering from a Protracted Cancer of the Lungs which has affected my Brain.From all indication my condition is really deteriorating, and my doctors have courageously advised me that I may not live beyond the next Six to eight months, this is because the cancer stage has reached a critical stage. Prime Minister Gordon Brown said that some of the money held in Dormant Accounts would be used to fund youth and community projects for your confirmation please visit : http://news.bbc.co.uk/2/hi/business/4017381.stm I am contacting you based on trust to present you to the Bank as the Next of Kin and bonafide inheritor to my late husband's fund, since I cannot claim this fund myself now and I may not live beyong next six-eight months according to my doctors, but I have the faith in God that I will live more than the months my Doctors said by God's grace. Presently, I'm with my laptop in the hospital where I have been undergoing treatment in London. Please! Please!! Your help is needed to avoid this money been diverted to the Government of UK as unclaimed fund/dormant account. Imagine somebody who have no child, I have nobody taking care of me here in the hospital, and the money I have now is limited. Of which, that US$9,000,000.00 is my only hope to continue my treatment here in the Hospital, and hopefully by God grace I will survive. If you will be so kind to be of help, I will be very glad and only God will reward you for that. Upon the successful claim/transfer of the fund in your account as the next of Kin, 40% of the total fund will be taking as your own share, 10% goes to the Orphanage Homes, while the remaining 50% will be transfer to my account here in Liverpool for my treatment. Please in your response, send me the following information to enable me validate you as the legal beneficiary of this funds: 1. Your full names 2. Your home or office address 3. Telephone 4. Your Mobile Phone number 5. Your Age 6. Marital Status 4. Your Occupation These whole information is what I need from you so that I can present a Letter of Authorisation to the Bank where the money is deposited to contact you as the Next of Kin for this funds transfer. Please Send your urgent response and your assistance will be highly appreciated. Best regards and God bless. Mrs. Rita Shumejda From audit.dept@standardchartered.com Sun May 17 10:53:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FORGED,L_SOME_STD_PROBS, MILLIONS_01,MISSING_HEADERS,MSOE_MID_WRONG_CASE,PHISH_05,RBL_PSBL_01, RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [62.141.56.4 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.3 MISSING_HEADERS Missing To: header * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [62.141.56.4 listed in psbl.surriel.com] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from km1610.keymachine.de (ns.km1610.keymachine.de [62.141.56.4]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4HHqptU015611 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 17 May 2009 10:53:16 -0700 Received: from User (host217-34-47-188.in-addr.btopenworld.com [217.34.47.188]) (authenticated bits=0) by km1610.keymachine.de (8.12.11.20060308/8.12.11) with ESMTP id n4HHlVOR017428; Sun, 17 May 2009 19:47:32 +0200 Message-Id: <200905171747.n4HHlVOR017428@km1610.keymachine.de> Reply-To: From: "James Dale Jr." Subject: [SPAM] Inheritance Funds / Call Me Immediately Date: Sun, 17 May 2009 18:39:17 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 17:36:14 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 17 May 2009 10:53:16 -0700 (PDT) X-Spam-Prev-Subject: Inheritance Funds / Call Me Immediately Status: R X-Status: X-Keywords: X-UID: 355 Content-Length: 2451 From: James Dale Jr. Private Email: jjjr.dale@gmail.com Tel: +44 702 408 7515 Subject: Inheritance Funds / Call Me Immediately Date: MAY. 17TH, 2009. Hello, I apologize if the contents hereunder are contrary to your moral ethics, but please treat it with absolute secrecy and personal courtesy. I am James Dale Jr. an Auditor in a commercial Bank here in London UK, in the process of auditing our bank accounts for the first quarter of the year, I recently discovered that there was a dormant account valued at the sum 7,394,890.00 (Seven Million, three hundred and ninety four thousand, eight hundred and ninety British Pounds Sterling) and after due verification of this account I discovered that the account owner is late. That is why the account has been dormant and as such the funds are lying unclaimed in the bank. The idea of presenting a foreigner to act as his next of kin came into my mind so as to have the total sum of 7,394,890.00 being transferred and willed to you and we can both disburse the fund according to the percentage we will agree upon. In view of this, I am seeking for your co-operation and understanding to stand as the next of kin to our deceased customer, to enable us claim the fund from my bank. Hence, if this proposal is OK by you and you do not wish to take undue advantage of my trust. Please kindly get back to me immediately, strictly via my private email address only: jjjr.dale@gmail.com to enable me enlighten you on how we are to proceed. I will appreciate if the details below are confirmed back to me in your next email in order for me to prepare the MOU, MEMORANDUM OF UNDERSTANDING that both of us will endorse in other for both parties to be protected. FULL NAME: CONTACT ADDRESS: PHONE NUMBER (S): SEX/AGE: NATIONALITY: OCCUPATION/PROFESSION: On getting your response with the above details, we shall agree on the percentage ratio on how the funds shall be splitted between ourselves, as I intend to invest part of our own share in real estate or any lucrative business in your country, and I would appreciate if you can put me in the right part where I can invest my own share. Be rest assured that this business is 100% risk free. I await for your prompt response. Best Regards, James Dale Jr. Tel: +44 702 408 7515 NB: PLEASE NOTE THAT IT DOES NOT MATTER IF YOU ARE NOT RELATED TO MY LATE CLIENT OR NOT; THE FUND WILL STILL BE PAID TO YOU, SINCE I AM PRESENTING YOU AS HIS NEXT OF KIN. From portsmouthlotto03@yahoo.co.jp Mon May 18 03:01:41 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************************** X-Spam-Status: Yes, score=44.4 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,LOTTO_FROM,LOTTO_WIN_01, LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01,MISSING_HEADERS, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, RDNS_DYNAMIC,SARE_FRAUD_X3,SARE_LOTTO_SPAM,SARE_LOTTO_SPAM2,SPF_SOFTFAIL, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS,US_DOLLARS_3,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [24.120.57.40 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 2.0 LOTTO_FROM Admits to being a lottery * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 1.0 LOTTO_WIN_01 BODY: Winning * * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 2.4 SARE_LOTTO_SPAM Lottery Spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.breslinbuilders.com (wsip-24-120-57-40.lv.lv.cox.net [24.120.57.40]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4IA1XTG007735 for ; Mon, 18 May 2009 03:01:40 -0700 Received: from User ([208.93.145.87]) by mail.breslinbuilders.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 18 May 2009 02:35:51 -0700 Reply-To: From: "PORTSMOUTH LOTTERY" Subject: [SPAM] AWARD NOTIFICATION. Date: Mon, 18 May 2009 02:39:02 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 18 May 2009 09:35:51.0687 (UTC) FILETIME=[08A80970:01C9D79C] X-Greylist: Delayed for 00:22:32 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 18 May 2009 03:01:41 -0700 (PDT) X-Spam-Prev-Subject: AWARD NOTIFICATION. Status: R X-Status: X-Keywords: X-UID: 356 Content-Length: 1640 PORTSMOUTH LOTTERY (Registration E1623591B). REF NO: 825/212/663 BATCH NO: 741352894-PP45 We are pleased to inform you of the result of the PORTSMOUTH LOTTERY INTERNET PROMOTION PROGRAM. The online draws was conducted from an exclusive list of 3,000,000 e-mail addresses of individuals and corporate institutions, picked by an advanced automated random computer search from the internet. No tickets were sold. As a result of the automated computer ballot system, your e-mail address emerged as a winner in the 3rd category with the following numbers attached Reference Number: 825/212/663, Batch Number: 741352894-PP45 and Ticket Number: 02 07 13 24 12 14 29 with serial number 1472-892 drew the lucky numbers 06-09-10-11-BE-ZX. You have therefore been approved for the payment of the sum of $5,500,000.00 (Five million Five Hundred Thousand Dollars only) as your winning prize. CONGRATULATIONS! Please be informed that your winnings of the sum of $5,500,000.00 has been zoned to the European Processing Office. Send an email with your Reference Number 825/212/663 and Batch number 741352894-PP45. TO:EUROPEAN CONTACT AGENCY: MR. JAMES CAREY. EMAIL: jamescarey010@yahoo.co.jp Yours faithfully, Ann Wall. (Online Promotion Co-ordinator). NOTE: To avoid disqualification or double claiming, we advice that your winnings should be kept very confidential until your cash prize has been remitted to you. This is in accordance with section 13(1) (n) of the National Gambling Act as adopted in 1993 and amended on 3rd July 1996 by the constitutional assembly. ============================================================ From mrniraw12334@eircom.net Mon May 18 09:41:10 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BAYES_POISON_01,BL_COUNTRY_RU_1,FREEMAIL_FORGED, MILLIONS_01,MSGID_FROM_MTA_HEADER,PHISH_05,SARE_FRAUD_X3,SPAMMY_WEBMAIL, URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9993] * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 1.6 URG_BIZ BODY: Contains urgent matter * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 BAYES_POISON_01 RAW: Appears to have "bayes poison" random text * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from mail25.svc.cra.dublin.eircom.net (mail25.svc.cra.dublin.eircom.net [159.134.118.54]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n4IGf6H1019069 for ; Mon, 18 May 2009 09:41:10 -0700 Message-Id: <200905181641.n4IGf6H1019069@ga.impsec.org> Received: (qmail 70143 messnum 16508591 invoked from network[86.43.60.102/webmail02.webmail.cra.eircom.net]); 18 May 2009 16:20:18 -0000 Received: from webmail02.webmail.cra.eircom.net (HELO webmailclassic.eircom.net) (86.43.60.102) by mail25.svc.cra.dublin.eircom.net (qp 70143) with SMTP; 18 May 2009 16:20:18 -0000 From: "Alhaji Atiko Mohammed" Reply-To: To: ...@ga.impsec.org Subject: [SPAM] I need your urgent respond. Date: Mon, 18 May 2009 17:20:11 +0100 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit X-Originating-IP: 89.222.170.56 X-Mailer: Eircom Net CRC Webmail (http://www.eircom.net/) Organization: Eircom Net (http://www.eircom.net/) X-Greylist: Delayed for 00:20:47 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 18 May 2009 09:41:10 -0700 (PDT) X-Spam-Prev-Subject: I need your urgent respond. Status: R X-Status: X-Keywords: X-UID: 357 Content-Length: 3796 I need your urgent respond. Dear Friend, I have been searching for your contact since you left our country some years ago .I do not know whether this is your correct email address or not because I only used your name initials to search for your contact in the internet . In case you are not the person I am supposed to contact , please see this as a confidential message and do not reveal it to another person but if you are not the intended receiver, do let me know whether you can be of assistance regarding my proposal below because it is top secret. I am still working with (Banque Commerciale du Burkina) where we met during your official visit to my country. I am about to retire from active Bank service to start a new life but I am sceptical to reveal this particular secret to a stranger. You must assure me that everything will be handled confidentially because we are not going to suffer again in life. It has been 10 years now that most of the greedy African Politicians used our bank to launder money overseas through the help of their Political advisers. Most of the funds which they transferred out of the shores of Africa were gold and oil money that was supposed to have been used to develop the continent. Their Political advisers always inflated the amounts before transfer to foreign accounts so I also used the opportunity to divert part of the funds hence I am aware that there is no official trace of how much was transferred as all the accounts used for such transfers were being closed after transfer. I acted as the Bank Officer to most of the politicians and when I discovered that they were using me to succeed in their greedy act; I also cleaned some of their banking records from the Bank files and no one cared to ask me because the money was too much for them to control. They laundered over $2bn during the process .As I am sending this message to you; I was able to divert more than One Hundred and Fifty Million Dollars ($150m) to an escrow account belonging to no one in the bank. The bank is anxious now to know who the beneficiary to the funds is because they have made a lot of profits with the funds. It is more than Five years now and most of the politicians are no longer using our bank to transfer funds overseas. The $150M has been laying waste but I don't want to retire from the bank without transferring the funds to a foreign account to enable me share the proceeds with the receiver. The money will be shared 60% for me and 40% for you. There is no one coming to ask you about the funds because I secured everything. I only want you to assist me by providing a bank account where the funds can be transferred. You are not to face any difficulties or legal implications as I am going to handle the transfer personally. If you are capable of receiving the funds, do let me know immediately to enable me give you a detailed information on what to do. For me, I have not stolen the money from anyone because the other people that took the whole money did not face any problems. This is my chance also to grab my own but you must keep the details of the funds secret to avoid leakages as no one in the bank knows about the funds. Please supply me the following: Your current contact address and Telephone Numbers. Whether you will be able to come down again to my country to meet me before the commencement of the transfer. I shall intimate you on what to do when I get your confirmation and acceptance. If you are capable of being my trusted associate, do declare your consent to me. Waiting for your urgent response. Alhaji Atiko Mohammed, ----------------------------------------------------------------- Find the home of your dreams with eircom net property Sign up for email alerts now http://www.eircom.net/propertyalerts From foka7@msn.com Mon May 18 15:03:40 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.9 required=5.0 tests=BAYES_99,BL_COUNTRY_NG_2, DEAR_FRIEND,FREEMAIL_FROM,HTML_MESSAGE,MILLIONS_01,MISSING_HEADERS, RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL, RCVD_IN_SORBS_WEB,SARE_RMML_Stock19,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.72 listed in psbl.surriel.com] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 1.3 MISSING_HEADERS Missing To: header * 0.2 SARE_RMML_Stock19 BODY: SARE_RMML_Stock19 * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.72 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.72 listed in zen.spamhaus.org] * 0.0 HTML_MESSAGE BODY: HTML included in message Received: from blu0-omc4-s37.blu0.hotmail.com (blu0-omc4-s37.blu0.hotmail.com [65.55.111.176]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4IM3bQw027723 for ; Mon, 18 May 2009 15:03:40 -0700 Received: from BLU131-W20 ([65.55.111.137]) by blu0-omc4-s37.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 18 May 2009 14:47:10 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_e5c5c69b-032a-471d-bac4-a2742530713a_" X-Originating-IP: [196.3.183.72] Reply-To: From: John Maxwell Subject: [SPAM] Investment Date: Mon, 18 May 2009 21:47:10 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 18 May 2009 21:47:10.0464 (UTC) FILETIME=[32721000:01C9D802] X-Greylist: Delayed for 00:16:24 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 18 May 2009 15:03:40 -0700 (PDT) X-Spam-Prev-Subject: Investment Status: R X-Status: X-Keywords: X-UID: 358 Content-Length: 1465 --_e5c5c69b-032a-471d-bac4-a2742530713a_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Dear Friend=2C My name is John Maxwell=2C I am retired pilot=2C I have some millions of do= llars that I have saved for years=2C Presently I am seriously seeking for an inve= stor who will help me investment the said money=2C l need your advice on what se= ctor to invest in that will yield good profit. I will appreciate it if you can furnish me with your full Name and your contact Telephone Number. Waiting to hear from you. Regards John Maxwell. --_e5c5c69b-032a-471d-bac4-a2742530713a_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Dear Friend=2C

My name is John Maxwell=2C I am retired pilot=2C I ha= ve some millions of dollars
that I have saved for years=2C Presently I a= m seriously seeking for an investor
who will help me investment the said= money=2C l need your advice on what sector
to invest in that will yield= good profit.

I will appreciate it if you can furnish me with your f= ull Name and your
contact Telephone Number.

Waiting to hear from = you.

Regards

John Maxwell.
 = --_e5c5c69b-032a-471d-bac4-a2742530713a_-- From martindavis72@gmail.com Tue May 19 00:44:00 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********************** X-Spam-Status: Yes, score=23.1 required=5.0 tests=BAYES_99,BL_COUNTRY_BR_1, FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3, L_SOME_STD_PROBS,MILLIONS_01,MSOE_MID_WRONG_CASE,PHISH_05,RBL_POXLAY_01, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,SARE_SUB_GOOD_DAY, SPF_HELO_PASS,SPF_NEUTRAL autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9999] * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.7 SARE_SUB_GOOD_DAY Contains spammer phrasing * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [41.208.48.180 listed in psbl.surriel.com] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [200.180.24.96 listed in psbl.surriel.com] [41.208.48.180 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from pod1.com.br (firewall.pod1.com.br [200.180.24.96]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4J7htMQ010945 for ; Tue, 19 May 2009 00:43:59 -0700 Received: by pod1.com.br (Postfix, from userid 1072) id 8F0AA1BA0EC; Mon, 18 May 2009 22:16:24 -0300 (BRT) Received: from User (41-208-48-180.mtn.co.za [41.208.48.180]) by pod1.com.br (Postfix) with ESMTP id 054341B9CB0; Mon, 18 May 2009 22:15:01 -0300 (BRT) Reply-To: From: "Martin Davis" Subject: [SPAM] Good Day! Date: Tue, 19 May 2009 03:14:22 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090519011502.054341B9CB0@pod1.com.br> To: undisclosed-recipients:; X-Greylist: Delayed for 04:14:42 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 19 May 2009 00:44:00 -0700 (PDT) X-Spam-Prev-Subject: Good Day! Status: R X-Status: X-Keywords: X-UID: 359 Content-Length: 3140 Good Day, I have pick-up the trust and courage to write you this mail with divine confidence that you will be a reliable and honest person whom I could trust in this important transaction that I want to open to you. There is an account opened in my bank in 1997. Since 2002 nobody has operated on this account again. After going through some old files, I discovered that if I did not do something very fast about it that it would be forfeited to this bank, Bank of Scotland United Kingdom as the regulation guiding the Bank on non-operational/long dormant account. The owner of this account was a foreign citizen, by name George Brumley; He was a Physician/geologist by profession and also worked with Mining Company. Information's reaching my desk is confirming that the man died on Monday July 21st 2003.For you to confirm. Please visit, (http://www.cnn.com/2003/WORLD/africa/07/20/kenya.crash/index.html) No one knows about this account or anything concerning it. The account has his wife as the only next of kin during the time it was opened. I learnt that she died also thereby leaving no other person to inherit his estate. The amount involved is (?5,200,000.00) Five Million Two Hundred Thousand British Pounds Sterling Only. We have similar cases like this here in the bank but this is the very one I am hundred percent sure of. I just concluded with my colleague right now that's why I'm writing you this mail. I will appreciate it most if, you will pledge your unreserved commitment, in all areas, towards assisting me in this transaction. My primary objective, after you indicate your interest, will be to completely change all existing documents in your name and attach same to the account as the next of kin. You will be present as the on Surviving relation of the late owner of the account. This arrangement will automatically make you the bona-fide next of kin to the deceased. I have perfected all the internal bank arrangement as regards this transaction with a colleague of mine, I assure you that there will be no single risk while the transaction goes on or after the transaction. Please note that this deal can only take place on the following conditions: 1} Absolute confidentiality and sincerity will be required and guaranteed, considering our position in the bank. 2}. Assurance that our own share will be released to us in good faith when this money finally gets into your account and not to take advantage of us. Finally note that you will be receiving at the end of this transaction, 30% of the total amount of the total amount finally received in your bank account for your involvement and participation while 70% will be ours. Do indicate your interest by contacting me immediately please. You will never regret it in any way, trust me. Please do contact me immediately on my email: (martindavis72@consultant.com) or Direct Number: + 44 703 184 3334. Note: that this is my personal email address and my direct phone number so please the only thing I want you to say after reading is I'm interest or I'm not interested then I will tell you the next step to take. All the best. Regards Martin Davis From savimbipartzento007@msn.com Tue May 19 15:42:58 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************ X-Spam-Status: Yes, score=12.5 required=5.0 tests=BAYES_95,FREEMAIL_FROM, FREEMAIL_REPLYTO,HTML_MESSAGE,JM_SOUGHT_FRAUD_3,MISSING_HEADERS,RAZOR2_CHECK, RCVD_IN_BL_SPAMCOP_NET,SPF_PASS,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9824] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns Received: from blu0-omc3-s16.blu0.hotmail.com (blu0-omc3-s16.blu0.hotmail.com [65.55.116.91]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4JMgtGE004163 for ; Tue, 19 May 2009 15:42:58 -0700 Received: from BLU118-W16 ([65.55.116.72]) by blu0-omc3-s16.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 19 May 2009 15:25:51 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_4b153c2c-28fd-474b-8ce8-a361ab5317bb_" X-Originating-IP: [41.191.85.9] Reply-To: From: savimbi partzento Subject: [SPAM] Payment Instruction Contact Rev.Dr MARK BEN. Date: Tue, 19 May 2009 22:25:51 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 19 May 2009 22:25:51.0161 (UTC) FILETIME=[C41A1290:01C9D8D0] X-Greylist: Delayed for 00:17:03 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 19 May 2009 15:42:58 -0700 (PDT) X-Spam-Prev-Subject: Payment Instruction Contact Rev.Dr MARK BEN. Status: R X-Status: X-Keywords: X-UID: 360 Content-Length: 2293 --_4b153c2c-28fd-474b-8ce8-a361ab5317bb_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 Atten: Please=2C =20 I am happy to inform you about my success in getting those funds transferre= d under the cooperation of a new partner from Japan. Presently my movement = and that of my family members has been highly restricted in Angola=2C while= my new partner is investment the total amount in his country. Meanwhile=2C= I didn't forget your past efforts and attempts to assist me in transferrin= g those funds despite that it failed us somehow. =20 Now contact the Man of God who assisted me and stands by his word=2C his na= me is Rev.Dr MARK BEN. Email: markben010@gmail.com ask him to send you the = total sum of US$1=2C000.000.00 (draft) which I kept for your compensation. =20 get in touch with the man of God Rev.Dr MARK BEN.For the delivery of the dr= aft to you. =20 Thanks. Best regards=2C Mrs. Partzento J. Savimbi --_4b153c2c-28fd-474b-8ce8-a361ab5317bb_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable  =3B
Atten: Please=2C
 =3B
I am happy to inform you about my success i= n getting those funds transferred under the cooperation of a new partner fr= om Japan. Presently my movement and that of my family members has been high= ly restricted in Angola=2C while my new partner is investment the total amo= unt in his country. Meanwhile=2C I didn't forget your past efforts and atte= mpts to assist me in transferring those funds despite that it failed us som= ehow.
 =3B
Now contact the Man of God who assisted me and stands = by his word=2C his name is Rev.Dr MARK BEN. Email: markben010@gmail.com ask him to send you the total sum = of US$1=2C000.000.00 (draft) which I kept for your compensation.
 = =3B
get in touch with the man of God Rev.Dr MARK BEN.For the delivery of= the draft to you.
 =3B
Thanks.
Best regards=2C
Mrs. Partze= nto J. Savimbi

= --_4b153c2c-28fd-474b-8ce8-a361ab5317bb_-- From info@lile.com Wed May 20 20:10:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4L3A3Vf018324 for ; Wed, 20 May 2009 20:10:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******** X-Spam-Status: Yes, score=8.4 required=5.0 tests=BAYES_99,BAYES_POISON_02, DATE_IN_PAST_03_06,FREEMAIL_FORGED,MISSING_HEADERS,RCVD_IN_BRBL,SARE_SXLIFE autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [203.199.213.50 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Wed, 20 May 2009 20:10:03 -0700 (PDT) * 0.0 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 1.3 MISSING_HEADERS Missing To: header * 1.1 SARE_SXLIFE BODY: Talks about your sex life * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 0.8 BAYES_POISON_02 Appears to have "bayes poison" unpunctuated text Received: from www.biotech.iitm.ac.in (www.biotech.iitm.ac.in [203.199.213.50]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4L37BRk019593 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 20 May 2009 20:07:31 -0700 Received: from www.biotech.iitm.ac.in (localhost.localdomain [127.0.0.1]) by www.biotech.iitm.ac.in (8.13.1/8.13.1) with ESMTP id n4KLwQIQ016804; Thu, 21 May 2009 03:28:26 +0530 From: "mr.songlile" Reply-To: mr.songlile111@tsamail.co.za Subject: [SPAM] Hello Date: Wed, 20 May 2009 09:58:26 -1200 Message-Id: <20090520220039.M30021@lile.com> X-Mailer: Open WebMail 2.51 20050228 X-OriginatingIP: 41.220.75.3 (sanjib) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 X-Greylist: Delayed for 04:24:15 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 20 May 2009 20:07:32 -0700 (PDT) X-Spam-Prev-Subject: Hello Status: R X-Status: X-Keywords: X-UID: 361 I am asking for your partnership in re-profiling funds worth $19.5million dollars contact mr.songlile111@tsamail.co.za From pfoy72@yahoo.com.hk Wed May 20 15:30:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************************************** X-Spam-Status: Yes, score=42.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,DEAR_FRIEND,FORGED_MUA_OUTLOOK, FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS,MILLIONS_01, MILLION_USD,MISSING_HEADERS,NA_DOLLARS,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_PSBL_01,RCVD_IN_BRBL,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6,SUBJ_ALL_CAPS,US_DOLLARS_3, YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [203.122.59.16 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [203.122.59.16 listed in psbl.surriel.com] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.mzi.net (mzishiv.mzi.net [203.122.59.16] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4KMU63L011931 for ; Wed, 20 May 2009 15:30:24 -0700 Received: from User ([82.128.71.247]) by mail.mzi.net with Microsoft SMTPSVC(6.0.3790.3959); Thu, 21 May 2009 03:29:11 +0530 Reply-To: From: "PAUL FOY" Subject: [SPAM] DEAR FRIEND; I NEED YOUR CONFIDENCE AND TRUST. Date: Wed, 20 May 2009 15:03:28 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 20 May 2009 21:59:17.0531 (UTC) FILETIME=[38A32EB0:01C9D996] X-Greylist: Delayed for 00:17:42 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 20 May 2009 15:30:38 -0700 (PDT) X-Spam-Prev-Subject: DEAR FRIEND; I NEED YOUR CONFIDENCE AND TRUST. Status: R X-Status: X-Keywords: X-UID: 362 Content-Length: 2676 ACCOUNTS DEPARTMENT HALIFAX BANK OF LONDON 62/64 CORNHILL CITY LONDON EC3V3PL Tel: 44 702 408 0620 Dear Friend, Re: Transfer of ($15,500.000.00). Fifteen Million Five Hundred Thousand U.S. Dollars We want to transfer to overseas ($15,500.000.00). Fifteen Million Five Hundred Thousand United States Dollars from Halifax Bank I would like, if you will be capable and fit to provide either an existing Bank account or to set up a new bank account immediately to receive this money, even an empty account can serve to receive this money, as long as you will remain honest to me till the end of this important business transaction. I want to believe that you will never let me down either now or in future. I am Mr. Paul Foy. Director of Accounts Department of Halifax Bank . During the course of our auditing I discovered a floating fund in an account opened with our Bank in 2006 and since then nobody has operated on this account again, after going through some old files in the records I discovered that the owner of the account died without a heir along Ratcliff Way in a ghastly auto crash hence the money is floating and if I do not remit this money out urgently it will be forfeited for nothing. The owner of this account was Engr. Steve Moore, a national of your country, and an Industrialist, he died since January 2006 and no other person knows about this account or anything concerning it, the account has no beneficiary and my investigation proved to me as well that Engr. Steve Moore until his death was a consultant with an oil firm in London. I am contacting you as a foreigner because this Money can only be approved to a foreigner with a foreign account as the money is in U.S Dollars and the former owner of the account Engr. Steve Moore a foreigner too. I am revealing all this to you with the belief that you will never let me down in this business, you are the first and the only person I am contacting for the business so please reply urgently for me to tell you the next Step to take. You should forward your Telephone/Fax Numbers and your Residential Address, which is also needed. You will have to give me the assurance that when we meet the money will be intact pending our physical arrival in your country for sharing and disbursement of the fund which will be 35% for your assistance, 60% will be for us while 5% will be set aside to take care of all the expenses that will be incurred by both parties during the course of the transfer. I look forward to your earliest response; know that you can only reply through my private telephone line + 447024080620 for security reasons. Thank You. Yours Faithfully, Mr. Paul Foy. From smredimix@townsqr.com Wed May 20 17:20:59 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.5 required=5.0 tests=BAYES_99,FREEMAIL_FORGED, LOTTERY_PH_004470,LOTTO_ADMITS,LOTTO_FROM,LOTTO_YOU_WON_01,LOTTO_YOU_WON_02, L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,SPF_PASS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 LOTTO_FROM Admits to being a lottery * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 LOTTO_YOU_WON_01 BODY: You won! * 1.0 LOTTO_ADMITS BODY: Admits to being a lottery * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 2.0 LOTTERY_PH_004470 LOTTERY_PH_004470 * 0.2 FREEMAIL_FORGED Freemail reply address but not sender - forged * sender? * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from MAIL.ozarktelecom.com (mail2.jaggartech.com [208.90.68.4]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4L0KsxU015213 for ; Wed, 20 May 2009 17:20:58 -0700 Received: from townsqr.com (unverified [127.0.0.1]) by MAIL.ozarktelecom.com (Vircom SMTPRS 4.6.741.11) with ESMTP id (AUTH = smredimix@townsqr.com); Wed, 20 May 2009 17:33:27 -0500 X-Modus-BlackList: 127.0.0.1=OK;smredimix@townsqr.com=OK X-Modus-Trusted: 127.0.0.1=YES X-Modus-Audit: FALSE;0;0;0 Message-ID: <348b36802b004dc0b3c4d826a0a08ef9.smredimix@townsqr.com> X-EM-APIVersion: 2, 0, 2, 6 X-Priority: 3 (Normal) Reply-To: "" From: "National Lottery " To: info@live.com.uk Subject: [SPAM] Winning Alert...Contact Williams Brown(williamsbrown.uknl1958@live.com) Date: Wed, 20 May 2009 17:33:27 -0500 MIME-Version: 1.0 Content-type: text/plain; charset=utf-8 X-Greylist: Delayed for 01:28:35 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 20 May 2009 17:20:58 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n4L0KsxU015213 X-Spam-Prev-Subject: Winning Alert...Contact Williams Brown(williamsbrown.uknl1958@live.com) Status: R X-Status: X-Keywords: X-UID: 363 National Lottery Your email ID have won you the sum of 590,983 Pounds Contact Mr Williams Brown with the following details: or call Tel; +44-703-597-7317. Name;................. Age;.................. Address;.............. Occupation; ........... Telephone;............. via Email; williamsbrown.uknl1958@live.com **Note: All replies and queries or questions concerning your claims should be sent to Mr. Williams Brown. From saclaimsagent35@gmail.com Thu May 21 08:46:41 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************************************** X-Spam-Status: Yes, score=39.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_2,KAM_LOTTO1,LOTTO_AGENT,LOTTO_AGENT_FM,LOTTO_AGENT_RPLY, LOTTO_MANY,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, MISSING_HEADERS,NA_DOLLARS,RBL_POXLAY_01,RDNS_NONE,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_LOTTO_SPAM2,SPF_NEUTRAL,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [165.146.30.75 listed in dnsbl.sorbs.net] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 1.0 LOTTO_AGENT_FM Claims Agent * 1.0 LOTTO_AGENT_RPLY Claims Agent * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.0 LOTTO_MANY LOTTO_MANY * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.fourwindscm.com ([38.97.96.90]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4LFkafd008464 for ; Thu, 21 May 2009 08:46:40 -0700 Received: from User ([165.146.30.75]) by mail.fourwindscm.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 21 May 2009 11:24:15 -0400 Reply-To: From: "YOU HAVE WON ON" Subject: [SPAM] YOU HAVE WON THE SUM OF US$ 3 million us dollars Date: Thu, 21 May 2009 17:24:12 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 21 May 2009 15:24:15.0646 (UTC) FILETIME=[33A04BE0:01C9DA28] X-Greylist: Delayed for 00:22:14 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 21 May 2009 08:46:40 -0700 (PDT) X-Spam-Prev-Subject: YOU HAVE WON THE SUM OF US$ 3 million us dollars Status: R X-Status: X-Keywords: X-UID: 364 Content-Length: 1242 YOU HAVE WON ON THE COMPUTER BALLOT, THE SUM OF US$ 3 million us dollars Contact Mr Clyde Sobers YOUR CLAIMS AGENT. FOR YOUR IMMEDIATE FUND RELEASE Call him on: +27-78-0899-251 SOUTH AFRICA 2010 WORLD CUP BID LOTTERY AWARD. PRIZE AWARD NOTIFICATION Today your e-mail id was selected through the computer ballot system, as a winner of SOUTH AFRICAN 2010 WORLD CUP LOTTERY sponsored by Telkom the Official partner of Fifa World Cup Award. You have to contact your claim agent for your payment process and include your personal information for smooth transaction. Claim Agent: Contact Mr Clyde Sobers Email: saclaimsagent14@gmail.com Call: +27-78-0899-251 For verification purpose, forward to him your claim details below; (1) Your Tel( Mobile ): (2) Your Nationality/Country: {3} Your Full Names: {4} Your Occupation {5} Your Age. Ref No.06 08 010 19 30 42 Batch number: 13/26/DC36. Security code: 676 Amount Won: US $3,000,000.00 (Three million United States Dollars) You have to contact him not later than three working days. Congratulations once again. Regards, Mr, Danny Jordan From ajamesnana22@comcast.net Thu May 21 11:12:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.7 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,PDLOANTXT_05,PHISH_05,SARE_FRAUD_X3, SARE_SUB_NEED_REPLY,SPF_NEUTRAL,SUBJ_ALL_CAPS,TVD_PH_SUBJ_URGENT,URG_BIZ, US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.8 TVD_PH_SUBJ_URGENT TVD_PH_SUBJ_URGENT * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.2 PDLOANTXT_05 BODY: Loan * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from telkomsa.net (desdemona.telkomsa.net [196.25.211.7]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4LICYM4013048 for ; Thu, 21 May 2009 11:12:38 -0700 Message-Id: <200905211812.n4LICYM4013048@ga.impsec.org> Received: (qmail 11084 invoked from network); 21 May 2009 17:45:51 -0000 Received: from unknown (HELO User) (online1130466@telkomsa.net@[195.8.24.147]) (envelope-sender ) by O (qmail-ldap-1.03) with SMTP for ; 21 May 2009 17:45:45 -0000 Reply-To: From: "MR. JAMES NANA" Subject: [SPAM] URGENT REPLY NEEDED Date: Thu, 21 May 2009 18:45:44 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:26:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 21 May 2009 11:12:39 -0700 (PDT) X-Spam-Prev-Subject: URGENT REPLY NEEDED Status: R X-Status: X-Keywords: X-UID: 365 Content-Length: 1625 Dear Friend, I wish to contact you on a good business which I want you to assist me and receive this money into your bank account in your country from the good report received about you and believing that this will really work out between both of us. I am the manager of Barclays Bank of Ghana Ltd in Tema branch, a family man and a man of peace. I discovered this money five million five hundred and forty united state dollars (USD$5.540.000.00) On the course of the last year 2008 business financial report and I have packaged a transaction that will be of mutual benefit to us. As the regional manager of Barclays Bank of Ghana Tema branch, it is my duty to send in a financial report to my head office in the capital city Accra at the end of each business year and I have placed this funds on what we call Escrow Call Account with no beneficiary. As an officer of this bank I cannot be directly connected to this fund, so my aim of contacting you is to assist me receive this money in your bank account and get 35% of the total funds as commission.Please there is no risk involved, if you can work with my instructions and this business will be a bank-to-bank transfer. All I need from you is to stand claim as the original depositor of these funds who made the deposit with my branch so that my head office will order the transfer to your designated bank account. If you accept to work with me on trust I will appreciate it very much.Please, email me with the above email address so that we can go over the details.Thanks for your attention and I wait to hear from you soon. Thank you. Yours truly, Mr. James Nana. From songlile_1111@yahoo.com.hk Thu May 21 22:50:52 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************** X-Spam-Status: Yes, score=20.1 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, BL_COUNTRY_BR_1,FREEMAIL_FROM,FREEMAIL_REPLYTO,JM_SOUGHT_FRAUD_2, JM_SOUGHT_FRAUD_3,MISSING_HEADERS,RAZOR2_CHECK,SPAMMY_WEBMAIL,SPF_HELO_PASS, YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_BR_1 Mail client in Brazil * 0.1 FREEMAIL_FROM From-address is freemail domain * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from mail.bwnet.com.br (mail.bwnet.com.br [200.138.84.13]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4M5ojCV000506 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Thu, 21 May 2009 22:50:51 -0700 Received: (qmail 13732 invoked by uid 1007); 22 May 2009 00:06:21 -0300 Received: from mail.bwnet.com.br (claudiac@200.138.84.13) by mail.bwnet.com.br with SMTP; 22 May 2009 00:06:21 -0300 Received: from mail.bwnet.com.br ([127.0.0.1] helo=mail.bwnet.com.br) by LogyMail; 22 May 2009 00:06:21 -0300 Received: from 196.3.181.162 (SquirrelMail authenticated user claudiac); by mail.bwnet.com.br with HTTP; Fri, 22 May 2009 00:06:21 -0300 (BRT) Message-ID: <56880.196.3.181.162.1242961581.squirrel@196.3.181.162> Date: Fri, 22 May 2009 00:06:21 -0300 (BRT) Subject: [SPAM] Please Read From: "Mr. Song Li Le" Reply-To: snglile_04@yahoo.com.hk User-Agent: SquirrelMail/1.5.0 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Greylist: Delayed for 01:27:50 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 21 May 2009 22:50:52 -0700 (PDT) X-Spam-Prev-Subject: Please Read Status: R X-Status: X-Keywords: X-UID: 366 Good Day, Please Read. My name is Mr. Song Li le, I am the credit officer in Hang Seng Bank Hong Kong. I have a business proposal in the tune of $19.5m, after the successful transfer, we shall share in ratio of 30% for you and 70% for me. Should you be interested, please contact me through my private email ( snglile_04@yahoo.com.hk ) so we can commence all arrangements and i will give you more information on how we would handle this project. Please treat this business with utmost confidentiality and send me the following: (1)Full names (2)private phone number (3)current residential address (4)Occupation (5)Age and Sex. Kind Regards, Mr. Song Li le. From mr.roberrtts_wiliams67@msn.com Fri May 22 01:02:17 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************************** X-Spam-Status: Yes, score=30.1 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FREEMAIL_FROM,FREEMAIL_REPLYTO, HTML_MESSAGE,HTML_STOOPID_02,LOTTO_YOU_WON_03,MILLIONS_01,MILLION_USD, MISSING_HEADERS,NA_DOLLARS,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL, SARE_FRAUD_X3,SARE_FRAUD_X4,SPF_PASS,STOX_30,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [41.220.75.3 listed in zen.spamhaus.org] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.1 FREEMAIL_FROM From-address is freemail domain * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 STOX_30 BODY: Stock market stuff - symbol * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 LOTTO_YOU_WON_03 BODY: You won! * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 HTML_STOOPID_02 RAW: stupid HTML: empty STRONG tag * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 56] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 56] * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from blu0-omc3-s25.blu0.hotmail.com (blu0-omc3-s25.blu0.hotmail.com [65.55.116.100]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4M82Bao004163 for ; Fri, 22 May 2009 01:02:16 -0700 Received: from BLU127-W8 ([65.55.116.74]) by blu0-omc3-s25.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 22 May 2009 00:45:45 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_d5a4686e-5a03-47cd-a229-a57d79637978_" X-Originating-IP: [41.220.75.3] Reply-To: From: FIRST DIRECT BANK Subject: [SPAM] REF:- INSTRUCTION TO CREDIT YOUR ACCOUNT WITH THE SUM OF (US$22MILLION) Date: Fri, 22 May 2009 07:45:45 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 22 May 2009 07:45:45.0896 (UTC) FILETIME=[50F35280:01C9DAB1] X-Greylist: Delayed for 00:16:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 22 May 2009 01:02:16 -0700 (PDT) X-Spam-Prev-Subject: REF:- INSTRUCTION TO CREDIT YOUR ACCOUNT WITH THE SUM OF Status: R X-Status: X-Keywords: X-UID: 367 Content-Length: 4603 --_d5a4686e-5a03-47cd-a229-a57d79637978_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable REF:- INSTRUCTION TO CREDIT YOUR ACCOUNT WITH THE SUM OF (US$22MILLION) =20 My name is Robert Williams and I am the Assistance Secretary with the First= Direct Bank of Nigeria=2C (FDBN). After due vetting and evaluation of your= file=2C that was sent to us by the Nigeria Government in conjunction with = the Ministry of Finance and Central Bank of the Federal Republic of Nigeria= . =20 This bank has an instruction to see to the immediate release of the sum of = TWENTY-TWO MILLION UNITED STATE DOLLARS=20 (US$22Million) of your claim that has been holding since is transferred int= o your bank Account from their Domiciliary Account with this Bank.=20 =20 We were meant to understand from our findings that you have been going thro= ugh hard ways by paying a considerable=20 sum to see to the release of your TWENTY-TWO MILLION UNITED STATE DOLLARS (= US$22Million)=2C which has been the handwork of some miscreant elements fro= m that Country. =20 We advice that you stop further communication with any correspondence from = anywhere concerning your funds=2C because=20 you don't have to pass through anymore difficult to receive your fund=2C as= you have meet up with the whole requirements. =20 We know your representatives in Nigeria or anywhere will advice you to stil= l go ahead with them=2C which will be on=20 your own risk=2C if you proceed with them. =20 Your TWENTY-TWO MILLION UNITED STATE DOLLARS (US$22Million) will reflect in= your designated Bank account within=20 three Bank working days. =20 Finally=2C you are advice to re-confirm these to us =20 Your Full Name: Your Address: Ocupation: Phone:=20 =20 You are advice not to go through any other person or institution other than= this Bank=2C if you really want your=20 fund.=20 =20 Yours sincerely=2C =20 Mr. Robert Williams=2C=20 Assistance Secretary=2C=20 First Direct Bank. --_d5a4686e-5a03-47cd-a229-a57d79637978_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable REF:- INSTRUCTION TO CREDIT YOUR ACCOUNT WITH THE SUM OF (US$22MILL= ION)
 =3B
My name is Robert Williams and I am the Assistance Secr= etary with the First Direct Bank of Nigeria=2C (FDBN). After due vetting an= d evaluation of your file=2C that was sent to us by the Nigeria Government = in conjunction with the Ministry of Finance and Central Bank of the Federal= Republic of Nigeria.
 =3B
This bank has an instruction to see to the immediate release of the= sum of TWENTY-TWO MILLION UNITED STATE DOLLARS
(US$22Million) of your = claim that has been holding since is transferred into your bank Account fro= m their Domiciliary Account with this Bank.
 =3B
We were meant to understand from our findings that you have been go= ing through hard ways by paying a considerable
sum to see to the releas= e of your TWENTY-TWO MILLION UNITED STATE DOLLARS (US$22Million)=2C which h= as been the handwork of some miscreant elements from that Country.=
 =3B
We advice that you stop further communication with any corresponden= ce from anywhere concerning your funds=2C because
you don't have to pas= s through anymore difficult to receive your fund=2C as you have meet up wit= h the whole requirements.
 =3B
We know your representatives in Nigeria or anywhere will advice you= to still go ahead with them=2C which will be on
your own risk=2C if yo= u proceed with them.
 =3B
Your TWENTY-TWO MILLION UNITED STATE DO= LLARS (US$22Million) will reflect in your designated Bank account within three Bank working days.
 =3B
Finally=2C you are advice to re-confirm these to us
 =3B
= Your Full Name:
Your Address:
Ocupation:
Phone:
 =3B
You are advice not to go through any other person or institution ot= her than this Bank=2C if you really want your
fund.
 =3B
You= rs sincerely=2C
 =3B
Mr. Robert Williams=2C
Assistance Secret= ary=2C
First Direct Bank.
= --_d5a4686e-5a03-47cd-a229-a57d79637978_-- From saclaimsagent35@gmail.com Fri May 22 08:05:17 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************************************** X-Spam-Status: Yes, score=39.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_2,KAM_LOTTO1,LOTTO_AGENT,LOTTO_AGENT_FM,LOTTO_AGENT_RPLY, LOTTO_MANY,LOTTO_YOU_WON_02,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, MISSING_HEADERS,NA_DOLLARS,RBL_POXLAY_01,RDNS_NONE,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_LOTTO_SPAM2,SPF_NEUTRAL,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [165.146.30.29 listed in dnsbl.sorbs.net] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9993] * 1.0 LOTTO_AGENT_FM Claims Agent * 1.0 LOTTO_AGENT_RPLY Claims Agent * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.2 LOTTO_YOU_WON_02 BODY: You won! * 0.5 LOTTO_AGENT BODY: Claims Agent * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 2.4 SARE_LOTTO_SPAM2 Lottery Spam * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.0 LOTTO_MANY LOTTO_MANY * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.fourwindscm.com ([38.97.96.90]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4MF5BMJ017180 for ; Fri, 22 May 2009 08:05:16 -0700 Received: from User ([165.146.30.29]) by mail.fourwindscm.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 22 May 2009 11:05:08 -0400 Reply-To: From: "YOU HAVE WON ON" Subject: [SPAM] YOU HAVE WON THE SUM OF US$ 3 million us dollars Date: Fri, 22 May 2009 17:05:02 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 22 May 2009 15:05:08.0888 (UTC) FILETIME=[B284A980:01C9DAEE] X-Spam-Prev-Subject: YOU HAVE WON THE SUM OF US$ 3 million us dollars Status: R X-Status: X-Keywords: X-UID: 368 Content-Length: 1244 YOU HAVE WON ON THE COMPUTER BALLOT, THE SUM OF US$ 3 million us dollars Contact Mr Clyde Sobers YOUR CLAIMS AGENT. FOR YOUR IMMEDIATE FUND RELEASE Call him on: +27-781-062-923. SOUTH AFRICA 2010 WORLD CUP BID LOTTERY AWARD. PRIZE AWARD NOTIFICATION Today your e-mail id was selected through the computer ballot system, as a winner of SOUTH AFRICAN 2010 WORLD CUP LOTTERY sponsored by Telkom the Official partner of Fifa World Cup Award. You have to contact your claim agent for your payment process and include your personal information for smooth transaction. Claim Agent: Contact Mr Clyde Sobers Email: saclaimsagent15@gmail.com Call: +27-781-062-923. For verification purpose, forward to him your claim details below; (1) Your Tel( Mobile ): (2) Your Nationality/Country: {3} Your Full Names: {4} Your Occupation {5} Your Age. Ref No.06 08 010 19 30 42 Batch number: 13/26/DC36. Security code: 676 Amount Won: US $3,000,000.00 (Three million United States Dollars) You have to contact him not later than three working days. Congratulations once again. Regards, Mr, Danny Jordan From rubyvinsonpartners@rubyvinsonpartners.home.pl Fri May 22 19:42:28 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *************** X-Spam-Status: Yes, score=15.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_80,BL_COUNTRY_JP_1,FORGED_MUA_OUTLOOK,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL, SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [210.251.119.244 listed in b.barracudacentral.org] * 0.5 BL_COUNTRY_JP_1 Mail client in Japan * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8342] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from ns.sincol-kys.co.jp (ns.sincol-kys.co.jp [210.251.119.244]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4N2gNwq005708 for ; Fri, 22 May 2009 19:42:27 -0700 Received: from User (unknown [41.222.192.87]) by ns.sincol-kys.co.jp (Postfix) with ESMTP id 6A02DADEA0; Sat, 23 May 2009 05:31:27 +0900 (JST) Reply-To: From: "RUBY VINSON PARTNERS" Subject: [SPAM] VIABLE INVESTMENT ASSISTANCE Date: Fri, 22 May 2009 21:38:39 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090522203127.6A02DADEA0@ns.sincol-kys.co.jp> To: undisclosed-recipients:; X-Greylist: Delayed for 06:02:44 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 22 May 2009 19:42:27 -0700 (PDT) X-Spam-Prev-Subject: VIABLE INVESTMENT ASSISTANCE Status: R X-Status: X-Keywords: X-UID: 369 I am a financial advisor/Broker. I have a Client that has Interest in Investing in your Country in area Of Real Estates, Assets and other viable ventures you may consider better. Can you be of Assistance? I shall give you more details when I receive your positive reply and full contact details. Kindly send your reply to info@rubyvinsonpartners.tk and call me on +229 984 926 16 Yours faithfully, Mrs. Ruby Vinson From bello.associates36@gmail.com Fri May 22 22:19:39 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.7 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_45,J_CHICKENPOX_57,L_SOME_STD_PROBS,MISSING_HEADERS, MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB,SPF_NEUTRAL autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [202.72.242.134 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.73 listed in zen.spamhaus.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [202.72.242.134 listed in psbl.surriel.com] * 1.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_57 BODY: 5alpha-pock-7alpha * 0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from prime.pmis.gov.mn (mail.pmis.gov.mn [202.72.242.134]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n4N5JXMg010553 for ; Fri, 22 May 2009 22:19:38 -0700 Message-Id: <200905230519.n4N5JXMg010553@ga.impsec.org> Received: (qmail 8533 invoked by uid 1009); 22 May 2009 02:38:37 -0000 Received: from unknown (HELO User) (test@196.3.183.73) by prime.pmis.gov.mn with SMTP; 22 May 2009 02:38:37 -0000 Reply-To: From: "FEDERAL BUREAU OF INVESTIGATION" Subject: [SPAM] FBI Director Robert S.Mueller III. Date: Fri, 22 May 2009 03:45:09 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 17:05:38 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 22 May 2009 22:19:39 -0700 (PDT) X-Spam-Prev-Subject: FBI Director Robert S.Mueller III. Status: R X-Status: X-Keywords: X-UID: 370 Content-Length: 3282 FEDERAL BUREAU OF INVESTIGATION FBI Headquarters in Washington, D.C. Federal Bureau of Investigation J. Edgar Hoover Building 935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001 Attn: Beneficiary, This is to Officially inform you that it has come to our notice and we have thoroughly Investigated with the help of our Intelligence Monitoring Network System that you are having an illegal Transaction with Impostors claiming to be Prof. Charles C. Soludo of the Central Bank Of Nigeria, Mr. Patrick Aziza, Mr Frank Nweke, none officials of Oceanic Bank, Zenith Banks, Mr. Michell Brown From union bank kelvin Young of HSBC, Ben of Fedex,Ibrahim Sule,Larry Christopher, Puppy Scammers are impostors claiming to be the Federal Bureau Of Investigation. During our Investigation, we noticed that the reason why you have not received your payment is because you have not fulfilled your Financial Obligation given to you in respect of your Contract/Inheritance Payment. Therefore, we have contacted the Federal Ministry Of Finance on your behalf and they have brought a solution to your problem by cordinating your payment in total USD$10.5million in an ATM CARD which you can use to withdraw money from any ATM MACHINE CENTER anywhere in the world with a maximum of $10,000 United States Dollars daily or any other means you want your payment. You now have the lawful right to claim your fund. Since the Federal Bureau of Investigation is involved in this transaction, you have to be rest assured for this is 100% risk free it is our duty to protect You. All I want you to do is to contact the ATM CARD CENTER via email for their requirements to proceed and procure your Approval Slip on your behalf which will cost you $570 only and note that your Approval Slip which contains details of the agent who will process your transaction. CONTACT INFORMATION NAME: Dr.Henry Charles EMAIL: dr.henrycharles@yahoo.com Do contact Dr.Henry Charles of the ATM CARD CENTRE with your details: EMAIL ADDRESS: dr.henrycharles@yahoo.com FULL NAME: HOME ADDRESS: TELL: CELL: CURRENT OCCUPATION: BANK NAME: So your files would be updated after which he will send the payment informations which you'll use in making payment of $570 via Western Union Money Transfer or Money Gram Transfer for the procurement of your Approval Slip after which the delivery of your ATM CARD will be effected to your designated home address without any further delay. Please if you know you cannot be able to afford the $570 for the delivery of your ATM card via FedEx then do not bother to contact Dr.Henry Charles as we are in the begining of new year and he should be busy with some other things. We order you to get back to Dr.Henry Charles Only right away. FBI Director Robert S.Mueller III. Note: Do disregard any email you get from any impostors or offices claiming to be in possesion of your ATM CARD, you are hereby adviced only to be in contact with Dr.Henry Charles of the ATM CARD CENTRE who is the rightful person to deal with in regards to your ATM CARD PAYMENT and forward any emails you get from impostors to Dr.Henry Charles so we could act upon and commence investigation. THIS IS FBI SECURITY ALERT EMAIL DO NOT REPLY TO THIS EMAIL FOR SECURITY REASON. GET BACK TO DR.HENRY CHARLES ONLY. From michaelbriest@googlemail.com Sat May 23 00:45:34 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******************* X-Spam-Status: Yes, score=19.6 required=5.0 tests=BAYES_99,EMAILBL_TEST_LEM, FORGED_MUA_OUTLOOK,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,SPF_NEUTRAL autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [81.91.228.131 listed in zen.spamhaus.org] * 2.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [91.198.106.9 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (michaelbriest[at]googlemail.com) * 1.3 MISSING_HEADERS Missing To: header * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from s7.wlserver.nl (s7.wlserver.nl [91.198.106.9]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4N7jQv4014388 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 23 May 2009 00:45:32 -0700 Message-Id: <200905230745.n4N7jQv4014388@ga.impsec.org> Received: from [81.91.228.131] (helo=User) by s7.wlserver.nl with esmtpa (Exim 4.69) (envelope-from ) id 1M7luM-0001VB-Ls; Sat, 23 May 2009 09:44:42 +0200 Reply-To: From: "Michael Briest" Subject: [SPAM] Business Suggestion Date: Sat, 23 May 2009 00:44:43 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 090522-0, 05/22/2009), Outbound message X-Antivirus-Status: Clean X-Greylist: Delayed for 08:52:41 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 23 May 2009 00:45:32 -0700 (PDT) X-Spam-Prev-Subject: Business Suggestion Status: R X-Status: X-Keywords: X-UID: 371 I crave your indulgence for using this means to contact you for a sensitive deal of this nature. My decision is spurred by the need for secure and faster means of communication. Having carefully thought of a confidant that will assist me in the transaction, I have deemed it pertinent to contact you directly for a prospective business deal in the tune of GBP 34.3 million. I am a Portfolio Manager with UBS financial services Inc. and I am ready and willing to work this deal out with your sincere assistance and cooperation. It will be unwise to jeopardize the success of this transaction at this point by releasing the details as I cannot confirm your exact stand till I receive your response to this email. I will give you the full details of the transaction and how to go about it as soon as I confirm your positive response. Honesty, confidentiality and effective communication is highly needed to ensure prompt conclusion of this deal as this is risk-free and profitable. Yours truly, Michael Briest From sgtbrown@sify.com Sun May 24 15:56:28 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.3 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_NG_2,FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_41, J_CHICKENPOX_56,J_CHICKENPOX_61,J_CHICKENPOX_71,L_SOME_STD_PROBS,MILLIONS_01, MILLION_USD,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, NA_DOLLARS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL, SARE_FREE_WEBM_ZCom01,SARE_SUB_NEED_REPLY,SUBJ_ALL_CAPS,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.65.42.64 listed in b.barracudacentral.org] * 2.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.46.245.21 listed in psbl.surriel.com] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.46.245.21 listed in zen.spamhaus.org] * 0.6 SARE_FREE_WEBM_ZCom01 Sender used free email account - may be * spammer * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha * 0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 1.3 NA_DOLLARS BODY: Talks about a million North American dollars * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from IPDMEG0381MIA.pubip.peer1.net (websites.tridas.net [64.65.42.64]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4OMuLg1017158 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sun, 24 May 2009 15:56:28 -0700 Message-Id: <200905242256.n4OMuLg1017158@ga.impsec.org> Received: (qmail 30392 invoked from network); 15 May 2009 23:28:47 -0400 Received: from unknown (HELO User) (196.46.245.21) by websites.tridas.net with SMTP; 15 May 2009 23:28:45 -0400 Reply-To: From: "SGT.IRVIN BROWN" Subject: [SPAM] READ CAREFULLY AND REPLY URGENTLY Date: Sat, 16 May 2009 04:28:39 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 090515-0, 05/15/2009), Outbound message X-Antivirus-Status: Clean X-Greylist: Delayed for 67:50:08 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 24 May 2009 15:56:28 -0700 (PDT) X-Spam-Prev-Subject: READ CAREFULLY AND REPLY URGENTLY Status: R X-Status: X-Keywords: X-UID: 372 Content-Length: 2558 Attention:Sir/Madam My name is Sgt Irvin Brown, I am an American soldier with Swiss background, serving in the military with the army?s 3rd infantry division. With a very desperate need for assistance, I have summed up courage to contact you. I found your contact particulars in an address journal. I am seeking your kind assistance to move the sum of ( $8 million U.S Dollars ) Eight million united states dollars to you, as far as I can be assured that my share will be safe in your care until I complete my service here, this is no stolen money, and there are no danger involved. Source of money: Some money in various currencies was discovered in barrels at a farmhouse near one of Saddam?s old palaces in Tikrit-Iraq during a rescue operation, and it was agreed by staff Sgt Kenneth buff and I that some part of this money be shared among both of us before informing anybody about it since both of us saw the money first. This was quite an illegal thing to do, but I tell you what? No compensation can make up for the risk we have taken with our lives in this hell hole. Of which my brother in-law was killed by a road side bomb last week. You will find the story of this money on the web address below; The above figure was given to me as my share, and to conceal this kind of money became a problem for me, so with the help of a British contact working here and his office enjoy some immunity, I was able to get the package out to a safe location entirely out of trouble spot. he does not know the real contents of the package, and believes that it belongs to a british/american medical doctor who died in a raid. I have now found a much secured way of getting the package out of Iraq to your country for you to pick up, and I will discuss this with you when I am sure that you are willing to assist me. I want you to tell me how much you will take from this money for the assistance you will give to me. One passionate appeal I will make to you is not to discuss this matter with anybody, should you have reasons to reject this offer,please and please destroy this message as any leakage of this information will be too bad for us soldier?s here in Iraq. I do not know how long we will remain here, and i have been shot, wounded and survived two suicide bomb attacks by the special grace of God, this and other reasons i will mention later has prompted me to reach out for help, i honestly want this matter to be resolved immediately, please contact me as soon as possible my only way of communication email. God Bless Sgt Irvin Brown From audit.dept@standardchartered.com Sun May 24 16:56:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************* X-Spam-Status: Yes, score=25.4 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,EMAILBL_TEST_LEM,FORGED_MUA_OUTLOOK,L_SOME_STD_PROBS, MILLIONS_01,MISSING_HEADERS,MSGID_FROM_MTA_HEADER,MSOE_MID_WRONG_CASE, PHISH_05,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK, RCVD_IN_BRBL,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [64.207.134.38 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (jjjr.dalejr[at]gmail.com) * 1.3 MISSING_HEADERS Missing To: header * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from as.transit-mag.com (transit-mag.com [64.207.134.38]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4ONuAiA018740 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sun, 24 May 2009 16:56:16 -0700 Message-Id: <200905242356.n4ONuAiA018740@ga.impsec.org> Received: (qmail 22465 invoked from network); 23 May 2009 02:18:13 -0700 Received: from host-64-47-42-169.masergy.com (HELO User) (64.47.42.169) by transit-mag.com with SMTP; 23 May 2009 02:18:13 -0700 Reply-To: From: "James Dale Jr." Subject: [SPAM] Mutual Business Transaction Date: Sat, 23 May 2009 02:23:56 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 20:46:25 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 24 May 2009 16:56:16 -0700 (PDT) X-Spam-Prev-Subject: Mutual Business Transaction Status: R X-Status: X-Keywords: X-UID: 373 Content-Length: 2455 From: James Dale Jr. Private Email: jjjr.dalejr@gmail.com Tel: +44 702 408 7515 Subject: Inheritance Funds / Call Me Immediately Date: MAY. 23RD, 2009. Hello, I apologize if the contents hereunder are contrary to your moral ethics, but please treat it with absolute secrecy and personal courtesy. I am James Dale Jr. an Auditor in a commercial Bank here in London UK, in the process of auditing our bank accounts for the first quarter of the year, I recently discovered that there was a dormant account valued at the sum 7,394,890.00 (Seven Million, three hundred and ninety four thousand, eight hundred and ninety British Pounds Sterling) and after due verification of this account I discovered that the account owner is late. That is why the account has been dormant and as such the funds are lying unclaimed in the bank. The idea of presenting a foreigner to act as his next of kin came into my mind so as to have the total sum of 7,394,890.00 being transferred and willed to you and we can both disburse the fund according to the percentage we will agree upon. In view of this, I am seeking for your co-operation and understanding to stand as the next of kin to our deceased customer, to enable us claim the fund from my bank. Hence, if this proposal is OK by you and you do not wish to take undue advantage of my trust. Please kindly get back to me immediately, strictly via my private email address only: jjjr.dalejr@gmail.com to enable me enlighten you on how we are to proceed. I will appreciate if the details below are confirmed back to me in your next email in order for me to prepare the MOU, MEMORANDUM OF UNDERSTANDING that both of us will endorse in other for both parties to be protected. FULL NAME: CONTACT ADDRESS: PHONE NUMBER (S): SEX/AGE: NATIONALITY: OCCUPATION/PROFESSION: On getting your response with the above details, we shall agree on the percentage ratio on how the funds shall be splitted between ourselves, as I intend to invest part of our own share in real estate or any lucrative business in your country, and I would appreciate if you can put me in the right part where I can invest my own share. Be rest assured that this business is 100% risk free. I await for your prompt response. Best Regards, James Dale Jr. Tel: +44 702 408 7515 NB: PLEASE NOTE THAT IT DOES NOT MATTER IF YOU ARE NOT RELATED TO MY LATE CLIENT OR NOT; THE FUND WILL STILL BE PAID TO YOU, SINCE I AM PRESENTING YOU AS HIS NEXT OF KIN. From no.reply@azet.sk Sun May 24 18:54:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************** X-Spam-Status: Yes, score=18.7 required=5.0 tests=ADVANCE_FEE_2,BAYES_95, DEAR_SOMETHING,EMAILBL_TEST_LEM,FORGED_MUA_OUTLOOK,L_SOME_STD_PROBS, MSOE_MID_WRONG_CASE,PHISH_05,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_DUL,RCVD_IN_SORBS_WEB,RDNS_DYNAMIC, SPF_FAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [217.98.30.2 listed in psbl.surriel.com] * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (salvet.mariket[at]gmail.com) * 0.7 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=no.reply%40azet.sk&ip=217.98.30.2&receiver=ga.impsec.org] * 1.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [213.233.64.133 listed in psbl.surriel.com] [213.233.64.133 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address * [217.98.30.2 listed in dnsbl.sorbs.net] * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.2 PHISH_05 BODY: Phishing for account information * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9520] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from geos.biz.pl (217.98.30.2.meganet.net.pl [217.98.30.2] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4P1s7dM021784 for ; Sun, 24 May 2009 18:54:11 -0700 Received: from User (unknown [213.233.64.133]) by geos.biz.pl (Postfix) with ESMTP id 392D86036; Mon, 25 May 2009 03:21:25 +0200 (CEST) From: "Frank Andrew" Subject: [SPAM] Reference Nr:5687SPL876 Date: Mon, 25 May 2009 04:28:45 +0300 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090525012125.392D86036@geos.biz.pl> To: undisclosed-recipients:; X-Greylist: Delayed for 00:24:50 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 24 May 2009 18:54:11 -0700 (PDT) X-Spam-Prev-Subject: Reference Nr:5687SPL876 Status: R X-Status: X-Keywords: X-UID: 374 Dear Sir/ Madam, Greetings! Dulwich gallery with head office in South Korea wishes to seek your services as a consultant in receiving funds on its behalf. We offer 10% for every monies paid by our bidders in USA to you, and you remit the companys money to the United Kingdom. We shall provide you grants for a bank account opening if you dont have any, as well as take off grants. Your remuneration is tax free, and there are no hidden or upfront fees to be borne by you. This is real and legal! If interested, please provide your full names, mailing and contact details for immediate registration. For more details contact me. Street Address: 1st floor Shinho Villart, 452-3 Sungnae-Dong City: Gangdong-Gu Country: South Korea Telephone: 82-70-78914220 salvet.mariket@gmail.com Sincerely, Frank Andrew From H_Sanjay@un.org Mon May 25 16:03:15 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.6 required=5.0 tests=BAYES_99,BL_COUNTRY_FR_2, FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,J_CHICKENPOX_21, L_SOME_STD_PROBS,MSOE_MID_WRONG_CASE,PHISH_05,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_FRAUD_X3,SPF_FAIL,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 0.7 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=h_sanjay%40un.org&ip=80.12.242.30&receiver=ga.impsec.org] * 1.6 URG_BIZ BODY: Contains urgent matter * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp-out.orange.net (smtp59.orange.fr [80.12.242.30]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4PN3BlP024251 for ; Mon, 25 May 2009 16:03:15 -0700 Received: from smtp-out.orange.net (mwinf5904 [10.232.8.26]) by mwinf5905.orange.net (SMTP Server) with ESMTP id 825E71C03FE7 for ; Tue, 26 May 2009 00:42:03 +0200 (CEST) Received: from User (unknown [10.163.121.146]) by mwinf5904.orange.net (SMTP Server) with ESMTP id 2E5642800093; Tue, 26 May 2009 00:41:52 +0200 (CEST) X-ME-UUID: 20090525224152189.2E5642800093@mwinf5904.orange.net Reply-To: <"harrysanjay@un-sc.org, hsanjay77"@gmail.com> From: "H. Sanjay" Subject: [SPAM] From Harry & Partners Date: Tue, 26 May 2009 00:41:36 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090525224152.2E5642800093@mwinf5904.orange.net> To: undisclosed-recipients: ; X-Greylist: Delayed for 00:21:12 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 25 May 2009 16:03:15 -0700 (PDT) X-Spam-Prev-Subject: From Harry & Partners Status: R X-Status: X-Keywords: X-UID: 375 Content-Length: 1277 From: Harry Sanjay 58 Whitehall Court, London, SW1A 2EL London My name is Harry Sanjay, UN humanitarian abuse reporter here in UN Independent Station United Kingdom. I got your contact through cross border business information centre situated here in London as an online investor. On behalf of my partners, I seek your assistance to accommodate and invest for us the sum of USD22.6M. The money in question is sourced to us by a particular head of states as a gesture for appreciation of a good work rendered to their country, but in line with the moral principal of our services, we are not required to accept gift of any kind nor own more than 10,000 USD in our respective bank account, hence our plea to be represented by a trust worthy person to accommodate and invest the sum for us. Please note that this request is not a hoax. We count on your ability to accommodate and invest the funds for us until we are able to process our resignation successfully in the near future. If you are interested please provide me with the following in return email: YOUR NAME IN FULL YOUR OFFICE OR RESIDENTIAL ADDRESS TEL AND FAX NUMBER As soon as I hear from you, further details regarding the transaction will be unveiled to you. I look forward for your urgent response. From mrmalusi.sobili1@googlemail.com Thu May 14 21:48:11 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************************** X-Spam-Status: Yes, score=28.9 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FROM, FREEMAIL_REPLYTO,MILLIONS_01,MILLION_USD,MISSING_HEADERS,MSOE_MID_WRONG_CASE, PHISH_05,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SPF_NEUTRAL,URG_BIZ,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [82.151.104.66 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.3 MISSING_HEADERS Missing To: header * 1.6 URG_BIZ BODY: Contains urgent matter * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [41.208.48.176 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [41.208.48.176 listed in psbl.surriel.com] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from mail.belnet.ru (mail.belnet.ru [82.151.104.66]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4F4m6YI009005 for ; Thu, 14 May 2009 21:48:11 -0700 Received: from User [41.208.48.176] by mail.belnet.ru with ESMTP (SMTPD-10.02) id A9E53634; Fri, 15 May 2009 04:40:05 +0400 Reply-To: From: "Mr. Malusi Sobili" Subject: [SPAM] Vital Information Date: Fri, 15 May 2009 02:40:36 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <200905150440468.SM03692@User> X-IMAIL-SPAM-BULK: (b9e001c80000509d) X-CTCH-RefID: str=0001.0A0B0204.4A0CCCE8.011F,ss=3,sh,fgs=0 X-Greylist: Delayed for 02:05:19 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 14 May 2009 21:48:11 -0700 (PDT) X-Spam-Prev-Subject: Vital Information Status: R X-Status: X-Keywords: X-UID: 376 Content-Length: 3391 Department of Finance and Economic Affairs Johannesburg, South Africa Fax: +27 86 604 6727 Tel: +27 83 206 9842 Email: mr.ma.sobili@googlemail.com Dear Partner, URGENT BUSINESS PROPOSAL My name is Mr. Malusi Sobili a high placed official working with Department of (Finance & Economic Affairs) in Johannesburg South Africa. I decided to reach you directly to solicit for your assistance and guidelines in making a business investment and transfer of US$30,500,000.00(Thirty Million Five Hundred Thousand United States Dollars) to your country. Please I must plead for your confidence in this transaction. I am currently in need of a silent foreign partner whose identity we can use to transfer this sum of money. But at this moment, I am constrained to issue more details about this profitable business venture until I get your response by email, please if you can take out a moment of your very busy schedule today to respond back to my private email below for more details and include your private telephone number for easier and faster communication with you. This fund accrued legitimately to me as commission from foreign contracts, through our private connections. The fund is presently waiting to be remitted from the bank here into any overseas beneficiary confirmed by me as associate/receiver. By virtue of my position as a civil servant in my country, I cannot acquire this money in my name. Because as a high placed civil servant, I am not allowed by the civil service code of conduct to own or operate bank accounts outside of our shores. On the other hand, it is not safe for me to keep the money here due to unstable political environment. My proposal to you is that after you receive the funds, it would be shared as follows: (1) 20% to you as commission for your co-operation and assistance in facilitating the transfer, while the remaining 80% belongs to me, and you and I will be responsible for all legal fees to ensure that the said fund leaves the shores of South Africa to your designated bank account in your country. You will be free to take out your commission immediately after the money hits your account in your country. Since my objective is to invest the money in a foreign country, it would be appreciated if you could also help me with advices and direction on investing into profitable ventures in your country. However, this is optional, and if it is not convenient for you to further assist me with investing the money, we can end our cooperation after you make available to me, my own part of the money. The transaction, although discreet, is legitimate and the money will be transferred successfully with all necessary back-up official documents showing the legitimate source/origin of fund. The transfer will be concluded within 14 days official working period as soon as we reach on an agreement and you furnish me with a suitable response indicating your interest for processing the transfer. I plead with you on one issue, whether you are interested or not, kindly do not expose this information to anyone else. I confirm that the transaction is legitimate and without any risks either to yourself or myself. Please, give me your response immediately by returning this mail through my alternative email address above. Yours Faithfully, Mr. Malusi Sobili From susanfoundation@gmail.com Mon May 18 16:19:56 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****************************************** X-Spam-Status: Yes, score=42.5 required=5.0 tests=ADVANCE_FEE_2,BAYES_99, BL_COUNTRY_RU_1,FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,L_SOME_STD_PROBS, MILLIONS_01,MILLION_USD,MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL,RCVD_IN_SBL,RCVD_IN_SORBS_WEB, SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SPF_NEUTRAL,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [83.167.4.66 listed in b.barracudacentral.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [83.167.4.66 listed in psbl.surriel.com] * 2.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [62.140.137.157 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [62.140.137.157 listed in psbl.surriel.com] [62.140.137.157 listed in zen.spamhaus.org] * 0.5 BL_COUNTRY_RU_1 Mail client in Russia * 0.1 FREEMAIL_FROM From-address is freemail domain * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 3.0 JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 1.0 L_SOME_STD_PROBS At least two standards-compliance problems Received: from smtp.benet.ru (ns2.benet.ru [83.167.4.66]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4INJqlw030188 for ; Mon, 18 May 2009 16:19:56 -0700 Received: by smtp.benet.ru (Postfix, from userid 426) id CF08B4B61F3; Tue, 19 May 2009 05:00:29 +0600 (YEKST) Received: from User (unknown [62.140.137.157]) by smtp.benet.ru (Postfix) with ESMTP id 6163D4B61D4; Tue, 19 May 2009 05:00:16 +0600 (YEKST) Reply-To: From: "SUSAN FERNANDO" Subject: [SPAM] ENDEAVOUR TO USED IT FOR THE CHILDREN OF GOD >>... Date: Tue, 19 May 2009 01:00:28 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090518230016.6163D4B61D4@smtp.benet.ru> To: undisclosed-recipients:; X-Greylist: Delayed for 00:19:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Mon, 18 May 2009 16:19:56 -0700 (PDT) X-Spam-Prev-Subject: ENDEAVOUR TO USED IT FOR THE CHILDREN OF GOD >>... Status: R X-Status: X-Keywords: X-UID: 377 Content-Length: 2955 ENDEAVOUR TO USED IT FOR THE CHILDREN OF GOD Mrs Susan fernando. I am the above named person from Kuwait. I am married to Dr SAZON FERNANDO who worked with Kuwait embassy in Ivory Coast for nine years before he died in the year 2005.We were married for eleven years without a child. He died after a brief illness that lasted for only four days. Before his death we were both born again Christians.Since his death I decided not to re-marry or get a child outside my matrimonial home which the Bible is against.When my late husband was alive he deposited the sum of 18Million Dollars (eighteen Million United State Dollars) with one finance/security company in Amsterderm-Netherlands. Presently This money is still with the Security Company. Recently my Doctor told me that I would not last for the next three months due to cancer problem. Though what disturbs me most is my stroke sickness. Having known my condition I decided to donate this Fund to church or better still a christian individual that will utilize this money the way I am going to instruct here in. I want a church that will use this funds to fund churches orphanages and widows propagating the word of God and to ensure that the house of God is maintained. The Bible made us to understand that Blessed is the hand that giveth. I took this decision because I don't have any child that will inherit this money and my husband relatives are not Christians and I don't want my husband's hard earned money to be misused by unbelievers. I don't want a situation where this money will be used in an ungodly manner. Hence the reason for taking this bold decision. I am not afraid of death hence I know where I am going. I know that I am going to be in the bosom of the Lord. Exodus 14 VS 14 says that the lord will fight my case and I shall hold my peace. I don't need any telephone communication in this regard because of my health and because of the presence of my husband's relatives around me always. I don't want them to know about this development. With God all things are possible. As soon as I receive your reply I shall give you the contact of the Finance/Security Company in Amsterderm-Netherlands. I will also issue you a letter of authority that will prove you as the original- beneficiary of this Funds. I want you and the church to always pray for me because the lord is my shephard. My happiness is that I lived a life of a worthy Christian. Whoever that wants to serve the Lord must serve him in spirit and truth. Please always be prayerful all through your life. Any delay in your reply will give me room in sourcing for a church or christian individual for this same purpose. Please assure me that you will act accordingly as I stated herein. Hoping to hearing from you. I have set aside 20% for you and for your time and 10% for any enpense if there is any . Remain blessed in the name of the Lord. Yours in Christ Mrs. susan fernando Note: reply email to mrssusan2008@aim.com From cwraines@mvsu.edu Tue May 26 06:20:06 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4QDK4ws023202 for ; Tue, 26 May 2009 06:20:06 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ******* X-Spam-Status: Yes, score=7.3 required=5.0 tests=BAYES_95,EMAILBL_TEST_LEM, L_SOME_STD_PROBS,MISSING_HEADERS,RBL_PSBL_01 autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [213.255.201.26 listed in psbl.surriel.com] * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (p.ww1[at]hotmail.com) * 1.3 MISSING_HEADERS Missing To: header * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9628] * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Tue, 26 May 2009 06:20:06 -0700 (PDT) Received: from mailhost.mvsu.edu (smtp.mvsu.edu [209.147.224.4]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4QDIQ6H015548 for ; Tue, 26 May 2009 06:18:31 -0700 MIME-version: 1.0 Content-disposition: inline Content-type: text/plain; charset=iso-8859-1 Received: from mvsu.edu (localhost [127.0.0.1]) by mailhost.mvsu.edu (Sun Java(tm) System Messaging Server 6.3-6.03 (built Mar 14 2008; 32bit)) with ESMTP id <0KK900DTJ3355290@mailhost.mvsu.edu> for jhardin@impsec.org; Tue, 26 May 2009 07:09:05 -0500 (CDT) Received: from [213.255.201.26] by mailhost.mvsu.edu (mshttpd); Tue, 26 May 2009 13:09:05 +0100 From: Charles Raines Bcc: Reply-to: p.ww1@hotmail.com Message-id: Date: Tue, 26 May 2009 13:09:05 +0100 X-Mailer: Sun Java(tm) System Messenger Express 6.3-6.03 (built Mar 14 2008; 32bit) Content-language: en Subject: [SPAM] Important Business Proposal Asap. X-Accept-Language: en Priority: normal X-Greylist: Delayed for 01:00:06 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 26 May 2009 06:18:31 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ga.impsec.org id n4QDIQ6H015548 X-Spam-Prev-Subject: Important Business Proposal Asap. Status: R X-Status: X-Keywords: X-UID: 378 Good Day, I am Mr. Paul Wolfenden, Manager of ABN AMRO BANK 250 Bishopsgate, London EC2M 4AA . I have a business proposal valued at GBP21,000,000.00 (Twenty-One Million Pounds) from my Branch. Get back to me to enable me furnish you with full information concerning this letter via by email. Email:p.ww1@hotmail.com. Sincerely, Paul Wolfenden From dispatch@tnt.com Tue May 26 07:50:04 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4QEo4DQ024514 for ; Tue, 26 May 2009 07:50:04 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********* X-Spam-Status: Yes, score=9.3 required=5.0 tests=BAYES_99,DATE_IN_PAST_12_24, MISSING_HEADERS,RAZOR2_CHECK,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Tue, 26 May 2009 07:50:04 -0700 (PDT) * 1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date * 1.3 MISSING_HEADERS Missing To: header * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 2.0 YAHOO_SPAM YAHOO_SPAM Received: from mail.arquinex.es (mail.arquinex.es [83.175.220.235]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4QEkTvX017647 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 26 May 2009 07:46:37 -0700 Received: from arquinex.es (localhost [127.0.0.1] (may be forged)) by mail.arquinex.es (8.13.1/8.13.1) with ESMTP id n4PFjUMo001801; Mon, 25 May 2009 17:45:30 +0200 From: "TNT Express" Reply-To: tntexpress75@yahoo.com.hk Subject: [SPAM] Estimado beneficiario, Date: Mon, 25 May 2009 17:45:30 +0200 Message-Id: <20090525154620.M49594@tnt.com> X-Mailer: OpenWebMail 2.52 20040816 X-OriginatingIP: 213.185.118.212 (bibliotecacoacmab) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 X-Greylist: Delayed for 22:51:07 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 26 May 2009 07:46:39 -0700 (PDT) X-Spam-Prev-Subject: Estimado beneficiario, Status: R X-Status: X-Keywords: X-UID: 379 Content-Length: 2006 Estimado beneficiario, Su paquete que vale la suma de $ 400,000 USD (cuatrocientos mil Unidos Dlares) Estado en un banco de proyecto certificada se encuentra en nuestra oficina listo para la entrega, fue dada a nosotros por la Srta. Marissa Tonsk (Consultor Jefe) de Microsoft Corporacin Reino Unido diciendo que fue ganado por su direccin de correo electrnico en su curso en lnea de Microsoft en el sorteo de 2009 en conjuncin con Petrleo y Gas Nigeria Ltd. Es aqu, en Nigeria por un perodo de tres (3) meses Inspeccin de Proyecto, ya que trabaja con una empresa consultora en el frica occidental. Estamos enviando este correo electrnico debido a que su paquete ha sido registrada en un especial Orden. Lo que tienes que hacer ahora es ponerse en contacto con nuestro Departamento de Entrega el inmediato envo de su paquete a usted a su direccin de residencia. Tenga en cuenta que tan pronto como nuestro equipo de entrega confirma su informacin, que tendr slo (2) dos das hbiles (48 horas) para llegar a tu paquete es designado destino. Que se pongan en contacto con nuestro Jefe de Despacho Oficial Mr.Famous Clark para su entrega de paquetes a casa con usted a su direccin. Por favor, que le proporcione su datos personales que figuran a continuacin: Nombre completo :....................... House Direccin :....................... Telfono :....................... Profesin :....................... Sexo :....................... Edad :........................ Pas :........................ Tenga en cuenta que, usted ser responsable de pagar por su paquete de mantenimiento de la seguridad honorarios de 120 dlares porque usdollars Srta. Marissa Tonsk slo ha pagado por su entrega de paquetes tasas. ********************************************* TntExpress Empresa Correo-frica Occidental Mr.Famous Clark Despacho Oficial Jefe () E-mail: tntexpress75@yahoo.com.hk Telfono: +234 8082820425 ********************************************* From wasantha@colbd.net Tue May 26 14:05:05 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4QL53bP030769 for ; Tue, 26 May 2009 14:05:05 -0700 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *** X-Spam-Status: No, score=3.8 required=5.0 tests=BAYES_80,EMAILBL_TEST_LEM, MISSING_HEADERS autolearn=disabled version=3.2.5 Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Tue, 26 May 2009 14:05:05 -0700 (PDT) Received: from mta.colbd.net (mta.colbd.net [202.65.168.39]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4QL22SZ028491 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 26 May 2009 14:02:10 -0700 Received: from colbd.net (mail.colbd.net [202.65.168.35]) by col-srv-05.colbd.net (8.14.2/8.14.2) with ESMTP id n4QKx5KY032721; Wed, 27 May 2009 02:59:05 +0600 From: "wasantha" Reply-To: sarathomas.faraj66@gmail.com Subject: Mrs.Sara Faraj- (In Trust & Good Fiath)? Date: Wed, 27 May 2009 02:59:05 +0600 Message-Id: <20090526200936.M95635@colbd.net> X-Mailer: OpenWebMail 2.53 X-OriginatingIP: 62.56.132.7 (wasantha) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 X-Scanned-By: MIMEDefang 2.65 on 202.65.168.39 X-Greylist: Delayed for 00:17:09 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 26 May 2009 14:02:11 -0700 (PDT) Status: R X-Status: X-Keywords: X-UID: 380 Content-Length: 1975 My beloved, I am Mrs. Sara Faraj, I am 58 years old from Kuwait, I am suffering from a long time cancer of the Lungs which also affected my hearing ability and my brain, from all indication my conditions is really deteriorating and it is quite obvious that, according to my doctors they have advised me that I may not live too long, this is because the cancer has gotten to a very bad stage. I was brought up from a motherless babies home, was married to my late husband for twenty years without a child. My husband died in a fatal motor accident. Since his death I decided not to re-marry, I sold all my inherited belongings and deposited all the sum of £23 million pounds and Two Trunk Box (Family valuables/Personal Jewelries) with a Private Bank & Securities. Presently, this money is still with them Presently, I'm with my laptop in a hospital where I have been under going treatment for cancer of the lungs. I have since lost my ability to talk and my doctors have told me that I have months or year to live, but all depend on my ability to respond to the new treatment that will be prescribed. My wish is for the money to be distributed each year among the charity organization and the motherless babies home where I come from I want a God fearing person, to also use this money to fund foundation for children suffering from cancer, orphanages. I took this decision, before I rest in peace because my time will soon be up. I will require some of your details like your full Name/address, age, personal email, occupation i no i cannot speak with you on phone but i will keep it and introduce you to the Bank were i kept the funds, i will give you all the documents, deposit secret Question/answer and my pictures as soon as you agree to help me fulfil my wish and take care of those children with illness and orphans.I await your speedy reply. sarathomas.faraj66@gmail.com , sarathomas_al9@hotmail.com Kind regards, Mrs. Sara Faraj- A Thomas From wasantha@colbd.net Tue May 26 14:20:04 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4QLK3ED030952 for ; Tue, 26 May 2009 14:20:04 -0700 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *** X-Spam-Status: No, score=3.8 required=5.0 tests=BAYES_80,EMAILBL_TEST_LEM, MISSING_HEADERS autolearn=disabled version=3.2.5 Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Tue, 26 May 2009 14:20:04 -0700 (PDT) Received: from mta.colbd.net (mta.colbd.net [202.65.168.39]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4QLJU0B029461 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 26 May 2009 14:19:37 -0700 Received: from colbd.net (pop.colbd.net [202.65.168.35]) by col-srv-05.colbd.net (8.14.2/8.14.2) with ESMTP id n4QLGV6g000545; Wed, 27 May 2009 03:16:31 +0600 From: "wasantha" Reply-To: sarathomas.faraj66@gmail.com Subject: Mrs.Sara Faraj- (In Trust & Good Fiath)? Date: Wed, 27 May 2009 03:16:31 +0600 Message-Id: <20090526200936.M95635@colbd.net> X-Mailer: OpenWebMail 2.53 X-OriginatingIP: 62.56.132.7 (wasantha) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 X-Scanned-By: MIMEDefang 2.65 on 202.65.168.39 Status: R X-Status: X-Keywords: X-UID: 381 Content-Length: 1975 My beloved, I am Mrs. Sara Faraj, I am 58 years old from Kuwait, I am suffering from a long time cancer of the Lungs which also affected my hearing ability and my brain, from all indication my conditions is really deteriorating and it is quite obvious that, according to my doctors they have advised me that I may not live too long, this is because the cancer has gotten to a very bad stage. I was brought up from a motherless babies home, was married to my late husband for twenty years without a child. My husband died in a fatal motor accident. Since his death I decided not to re-marry, I sold all my inherited belongings and deposited all the sum of £23 million pounds and Two Trunk Box (Family valuables/Personal Jewelries) with a Private Bank & Securities. Presently, this money is still with them Presently, I'm with my laptop in a hospital where I have been under going treatment for cancer of the lungs. I have since lost my ability to talk and my doctors have told me that I have months or year to live, but all depend on my ability to respond to the new treatment that will be prescribed. My wish is for the money to be distributed each year among the charity organization and the motherless babies home where I come from I want a God fearing person, to also use this money to fund foundation for children suffering from cancer, orphanages. I took this decision, before I rest in peace because my time will soon be up. I will require some of your details like your full Name/address, age, personal email, occupation i no i cannot speak with you on phone but i will keep it and introduce you to the Bank were i kept the funds, i will give you all the documents, deposit secret Question/answer and my pictures as soon as you agree to help me fulfil my wish and take care of those children with illness and orphans.I await your speedy reply. sarathomas.faraj66@gmail.com , sarathomas_al9@hotmail.com Kind regards, Mrs. Sara Faraj- A Thomas From markwood0000@aol.com Wed May 27 12:35:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4RJZ2Ca018091 for ; Wed, 27 May 2009 12:35:02 -0700 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **** X-Spam-Status: No, score=4.3 required=5.0 tests=BAYES_50,BL_COUNTRY_NG_2, HTML_MESSAGE,LOTTO_FROM,LOTTO_YOU_WON_02,SPF_PASS autolearn=disabled version=3.2.5 Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Wed, 27 May 2009 12:35:02 -0700 (PDT) Received: from omr-m33.mx.aol.com (omr-m33.mx.aol.com [64.12.143.145]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4RJULQ9003595 for ; Wed, 27 May 2009 12:30:25 -0700 Received: from imo-ma04.mx.aol.com (imo-ma04.mx.aol.com [64.12.78.139]) by omr-m33.mx.aol.com (8.14.1/8.14.1) with ESMTP id n4RJ05AX023097; Wed, 27 May 2009 15:00:05 -0400 Received: from markwood0000@aol.com by imo-ma04.mx.aol.com (mail_out_v40_r1.5.) id t.c82.451481e8 (37038); Wed, 27 May 2009 14:59:52 -0400 (EDT) Received: from smtprly-mb02.mx.aol.com (smtprly-mb02.mx.aol.com [64.12.207.149]) by cia-db02.mx.aol.com (v123.4) with ESMTP id MAILCIADB028-5c6a4a1d8d991d; Wed, 27 May 2009 14:59:52 -0400 Received: from WEBMAIL-DF20 (webmail-df20.webmail.aol.com [205.188.104.84]) by smtprly-mb02.mx.aol.com (v123.4) with ESMTP id MAILSMTPRLYMB028-5c6a4a1d8d991d; Wed, 27 May 2009 14:59:40 -0400 X-MB-Message-Source: WebUI Subject: =?utf-8?Q?(Kanadsk=C3=BD_Lottery_Programu_You_Have_Won)?= Date: Wed, 27 May 2009 14:59:38 -0400 X-AOL-IP: 196.220.14.222 X-MB-Message-Type: User MIME-Version: 1.0 From: "=?utf-8?Q?Kanadsk=C3=BD_Lottery_programu.?=" X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="--------MB_8CBAD146B1D3095_1594_26A9_WEBMAIL-DF20.sysops.aol.com" X-Mailer: AOL Webmail 42951-STANDARD Received: from 196.220.14.222 by WEBMAIL-DF20.sysops.aol.com (205.188.104.84) with HTTP (WebMailUI); Wed, 27 May 2009 14:59:38 -0400 Message-Id: <8CBAD146B1ACE37-1594-1259@WEBMAIL-DF20.sysops.aol.com> To: undisclosed-recipients:; X-Greylist: Delayed for 00:21:57 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 27 May 2009 12:30:25 -0700 (PDT) Status: R X-Status: X-Keywords: X-UID: 382 Content-Length: 5950 ----------MB_8CBAD146B1D3095_1594_26A9_WEBMAIL-DF20.sysops.aol.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Kanadsk=C3=BD Lottery (Lotto u=C4=8Den=C3=AD) Centr=C3=A1la: 1a, Bevon soudu Carlton Nottingham NG4 1SQ hrabstv=C3=AD Essex Velk=C3=A1 Brit=C3=A1nie. V=C3=A1=C5=BEen=C3=AD v=C3=ADt=C4=9Bz, P=C5=99ejeme si gratulujeme v=C3=A1m p=C5=99es va=C5=A1i emailovou =C3= =BAsp=C4=9Bchu v na=C5=A1em po=C4=8D=C3=ADta=C4=8Di Balloting. To je Millennium V=C4=9Bdeck=C3=A9 po=C4=8D=C3=ADta=C4=8Dov=C3=A9 hry,= v nich=C5=BE byly e-mailov=C3=A9 adresy vyb=C3=ADraj=C3=AD n=C3=A1hodn=C4=9B, v=C5=A1ichni =C3=BA=C4=8Dastn=C3= =ADci byli vybr=C3=A1ni prost=C5=99ednictv=C3=ADm po=C4=8D=C3=ADta=C4=8Dov= =C3=A9ho hlasov=C3=A1n=C3=AD Syst=C3=A9m vych=C3=A1zej=C3=ADc=C3=AD z v=C3=ADce ne=C5=BE 100.000 fire= mn=C3=ADch a individu=C3=A1ln=C3=ADch 50000000 e-mailov=C3=BDch adres z ce= l=C3=A9ho sv=C4=9Bta. Jedn=C3=A1 se o reklamn=C3=AD program zam=C4=9B=C5= =99en=C3=BD na podporu u=C5=BEivatel=C5=AF internetu, proto nemus=C3=ADte= kupovat vstupenky na vstup pro n=C4=9Bj a on, =C5=BEe jde o kanadsk=C3=A9= Lottery rady r=C3=A1d V=C3=A1m ozn=C3=A1mit, =C5=BEe va=C5=A1e e-mailov= =C3=A1 adresa z=C3=ADskaly sou=C4=8Dtem $ 850,000.00 USD (osm set pades=C3= =A1t tis=C3=ADc dolar=C5=AF) v hotovosti p=C5=99ips=C3=A1na na soubor: REFEREN=C4=8CN=C3=8D =C4=8C=C3=8DSLO EAAL/9080118308/09. V=C3=BDhern=C3=AD =C4=8D=C3=ADslo: 2 6 20 23 38 45 Bonus 24 =C4=8C=C3=8DSLO =C5=A0AR=C5=BDE: B7898 8798 2456 190 Uplatnit n=C3=A1rok na va=C5=A1i v=C3=ADt=C4=9Bznou cenu budete kontakto= vat jmenovan=C3=A9 tvrd=C3=AD age nt pod co nejd=C5=99=C3=ADve k okam=C5=BEit=C3=A9mu propu=C5=A1t=C4=9Bn=C3= =AD va=C5=A1e v=C3=BDhra s va=C5=A1=C3=AD =C3=BApln=C3=A9 podrobnosti n=C3= =AD=C5=BEe. Rev. DEREK MILTON (pohled=C3=A1vk=C3=A1ch Agent) Email: awilliams3483@yahoo.com 1) Va=C5=A1e cel=C3=A9 jm=C3=A9no: 2) Kontaktn=C3=AD adresa: 3) Tel / mobiln=C3=AD =C4=8D=C3=ADslo: 4) Povol=C3=A1n=C3=AD: 5) Pohlav=C3=AD: 6) V=C4=9Bk: 7) St=C3=A1tn=C3=AD p=C5=99=C3=ADslu=C5=A1nost Pozn=C3=A1mka: Ve=C5=A1ker=C3=A9 ceny netvrdil, nebo do 15 dn=C5=AF ode= dne, kdy se bude =C4=8Derpat m=C3=ADt sv=C3=A9 m=C3=ADsto propad=C3=A1 a zastavuje. Ujist=C4=9Bte= se, pros=C3=ADm v=C3=A1s poslat v=C5=A1echny sv=C3=A9 v=C3=ADt=C4=9Bzn=C3= =A9 informace: awilliams3483@yahoo.com dne obdr=C5=BEen=C3=AD tohoto e-mai= lu. Gratulujeme op=C4=9Bt ze v=C5=A1ech na=C5=A1ich zam=C4=9Bstnanc=C5=AF .. Pan=C3=AD Anna Edward Gener=C3=A1ln=C3=AD tajemn=C3=ADk, Kanadsk=C3=BD Lottery programu. ----------MB_8CBAD146B1D3095_1594_26A9_WEBMAIL-DF20.sysops.aol.com Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable


Kanadsk=C3=BD Lottery (Lotto u=C4=8Den=C3=AD)<= br> Centr=C3=A1la: 1a, Bevon soudu Carlton
Nottingham NG4 1SQ hrabstv=C3=AD Essex
Velk=C3=A1 Brit=C3=A1nie.

V=C3=A1=C5=BEen=C3=AD v=C3=ADt=C4=9Bz,
P=C5=99ejeme si gratulujeme v=C3=A1m p=C5=99es va=C5=A1i emailovou =C3= =BAsp=C4=9Bchu v na=C5=A1em po=C4=8D=C3=ADta=C4=8Di Balloting.
To je Millennium V=C4=9Bdeck=C3=A9 po=C4=8D=C3=ADta=C4=8Dov=C3=A9 hry,= v nich=C5=BE byly e-mailov=C3=A9 adresy
vyb=C3=ADraj=C3=AD n=C3=A1hodn=C4=9B, v=C5=A1ichni =C3=BA=C4=8Dastn=C3= =ADci byli vybr=C3=A1ni prost=C5=99ednictv=C3=ADm po=C4=8D=C3=ADta=C4=8Dov= =C3=A9ho hlasov=C3=A1n=C3=AD
Syst=C3=A9m vych=C3=A1zej=C3=ADc=C3=AD z v=C3=ADce ne=C5=BE 100.000 fire= mn=C3=ADch a individu=C3=A1ln=C3=ADch 50000000 e-mailov=C3=BDch adres z ce= l=C3=A9ho sv=C4=9Bta. Jedn=C3=A1 se o reklamn=C3=AD program zam=C4=9B=C5= =99en=C3=BD na podporu u=C5=BEivatel=C5=AF internetu, proto nemus=C3=ADte= kupovat vstupenky na vstup pro n=C4=9Bj a on, =C5=BEe jde o kanadsk=C3=A9= Lottery rady r=C3=A1d V=C3=A1m ozn=C3=A1mit, =C5=BEe va=C5=A1e e-mailov= =C3=A1 adresa z=C3=ADskaly sou=C4=8Dtem $ 850,000.00 USD (osm set pades=C3= =A1t tis=C3=ADc dolar=C5=AF) v hotovosti p=C5=99ips=C3=A1na na soubor:
REFEREN=C4=8CN=C3=8D =C4=8C=C3=8DSLO EAAL/9080118308/09.
V=C3=BDhern=C3=AD =C4=8D=C3=ADslo: 2 6 20 23 38 45 Bonus 24
=C4=8C=C3=8DSLO =C5=A0AR=C5=BDE: B7898 8798 2456 190
Uplatnit n=C3=A1rok na va=C5=A1i v=C3=ADt=C4=9Bznou cenu budete kontakto= vat jmenovanC3 tvrd=C3=AD agent pod co nejd=C5=99=C3=ADve k okam=C5=BEit= =C3=A9mu propu=C5=A1t=C4=9Bn=C3=AD va=C5=A1e v=C3=BDhra s va=C5=A1=C3=AD= =C3=BApln=C3=A9 podrobnosti n=C3=AD=C5=BEe.
Rev. DEREK MILTON (pohled=C3=A1vk=C3=A1ch Agent)
Email: awilliams3483@yahoo.com
1) Va=C5=A1e cel=C3=A9 jm=C3=A9no:
2) Kontaktn=C3=AD adresa:
3) Tel / mobiln=C3=AD =C4=8D=C3=ADslo:
4) Povol=C3=A1n=C3=AD:
5) Pohlav=C3=AD:
6) V=C4=9Bk:
7) St=C3=A1tn=C3=AD p=C5=99=C3=ADslu=C5=A1nost
Pozn=C3=A1mka: Ve=C5=A1ker=C3=A9 ceny netvrdil, nebo do 15 dn=C5=AF ode= dne, kdy se bude =C4=8Derpat
m=C3=ADt sv=C3=A9 m=C3=ADsto propad=C3=A1 a zastavuje. Ujist=C4=9Bte= se, pros=C3=ADm v=C3=A1s poslat v=C5=A1echny sv=C3=A9 v=C3=ADt=C4=9Bzn=C3= =A9 informace: awilliams3483@yahoo.com dne obdr=C5=BEen=C3=AD tohoto e-mai= lu.
Gratulujeme op=C4=9Bt ze v=C5=A1ech na=C5=A1ich zam=C4=9Bstnanc=C5=AF ..=
Pan=C3=AD Anna Edward
Gener=C3=A1ln=C3=AD tajemn=C3=ADk,
Kanadsk=C3=BD Lottery programu.

Wanna slim down for summer? Go to Ameri= ca Takes it Off to learn how.
----------MB_8CBAD146B1D3095_1594_26A9_WEBMAIL-DF20.sysops.aol.com-- From jhardin@impsec.org Tue May 26 16:07:59 2009 -0700 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************** X-Spam-Status: Yes, score=16.7 required=5.0 tests=BAYES_99,EMAILBL_TEST_LEM, FORGED_HOTMAIL_RCVD2,FORGED_MUA_OUTLOOK,MISSING_HEADERS,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SPF_SOFTFAIL, YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (jianguo.zhang64[at]yahoo.com.hk) * 1.5 FORGED_HOTMAIL_RCVD2 hotmail.com 'From' address, but no 'Received:' * 1.3 MISSING_HEADERS Missing To: header * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 2.0 YAHOO_SPAM YAHOO_SPAM * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from proxy2.bredband.net (proxy2.bredband.net [195.54.101.72]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4QN7tVC032335 for ; Tue, 26 May 2009 16:07:58 -0700 Received: from ironport2.bredband.com (195.54.101.122) by proxy2.bredband.net (7.3.140.3) id 49F59CBD00B716FA for jhardin@impsec.org; Wed, 27 May 2009 00:47:19 +0200 Message-Id: <70dn20$el7mp9@ironport2.bredband.com> X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AuL/ALsOHEpX0l3jPGdsb2JhbACBKBSIBIFQglaCOYV2XXIBAQEBHyEvpTAIlQAlBYY1 X-IronPort-AV: E=Sophos;i="4.41,254,1241388000"; d="doc'32?scan'32,208,32";a="492034857" Received: from ip227-93-210-87.adsl2.static.versatel.nl (HELO User) ([87.210.93.227]) by ironport2.bredband.com with ESMTP; 27 May 2009 00:47:00 +0200 Reply-To: From: "Jianguo" Subject: [SPAM] Attn: My friend; Date: Wed, 27 May 2009 00:47:20 +0200 MIME-Version: 1.0 X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0104_01C2A9A6.712B66EC" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 00:20:33 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 26 May 2009 16:07:59 -0700 (PDT) X-Spam-Prev-Subject: Attn: My friend; Status: R X-Status: X-Keywords: X-UID: 383 ------=_NextPart_000_0104_01C2A9A6.712B66EC Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit Attn: Friend, I have a lucrative business proposal to discuss with you if you don't mind, kindly view the attached file. Regards. Zhang Jianguo ------=_NextPart_000_0104_01C2A9A6.712B66EC X-Content-Security: [ga.impsec.org] original Content-Type was application/msword; Content-Type: Text/Plain; charset=US-ASCII X-Content-Type: APPLICATION/DEFANGED; name="BUSINESS PROPOSAL.32366DEFANGED-doc" X-Content-Disposition: attachment; filename="BUSINESS PROPOSAL.32366DEFANGED-doc" X-Content-Transfer-Encoding: base64 [ The following attachment was DELETED when this message was saved: ] [ A Application/DEFANGED (Name="BUSINESS PROPOSAL.32366DEFANGED-doc") ] ------=_NextPart_000_0104_01C2A9A6.712B66EC-- From www-data@hydra.udag.de Tue May 26 23:02:04 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************** X-Spam-Status: Yes, score=14.2 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD,SARE_FRAUD_X3, SARE_SXLIFE,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.1 SARE_SXLIFE BODY: Talks about your sex life * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from hydra.udag.de (hydra.udag.de [89.31.140.33]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4R61wGa011493 for ; Tue, 26 May 2009 23:02:04 -0700 Received: by hydra.udag.de (Postfix, from userid 33) id 8420045E0FA; Wed, 27 May 2009 07:40:52 +0200 (CEST) To: jhardin@impsec.org Subject: [SPAM] Let see what we can do on it. From: "Barr.Eustace O.Annan" Reply-To: eustaceannan@live.com MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit Message-Id: <20090527054052.8420045E0FA@hydra.udag.de> Date: Wed, 27 May 2009 07:40:52 +0200 (CEST) X-Greylist: Delayed for 00:21:06 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Tue, 26 May 2009 23:02:04 -0700 (PDT) X-Spam-Prev-Subject: Let see what we can do on it. Status: R X-Status: X-Keywords: X-UID: 384 Good Day, I apologize as we do not know before ,but let me start by introducing myself.My name is Barrister Eustace O.Annan ,a resident bank attorney in Ghana west Africa. I am contacting you seeking your partnership in this important project which involves Twelve Million United States Dollars($12,000,000) .I need your quick reply so that I will give you more details . You can call me or reply to my private Email box hereunder: Best regards, Honorable Barr.Eustace O.Annan Email:eustaceannan@live.com +233241438589 From karisbenjamin@yhcargo.com Wed May 27 17:27:36 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************** X-Spam-Status: Yes, score=34.4 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_CN_1,BL_COUNTRY_CN_2,DATE_IN_PAST_06_12, DEAR_SOMETHING,HTML_MESSAGE,L_SOME_STD_PROBS,MILLIONS_01,MILLION_USD, MIME_BASE64_TEXT,MISSING_HEADERS,RCVD_IN_BRBL,RDNS_NONE,SARE_FRAUD_X3, SARE_FRAUD_X4,SARE_FRAUD_X5,SPAMMY_WEBMAIL,SUBJ_ALL_CAPS,TVD_PH_SUBJ_URGENT, URG_BIZ,YAHOO_SPAM autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [60.191.61.114 listed in b.barracudacentral.org] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [60.191.61.114 listed in cn.countries.nerd.dk] * 0.5 BL_COUNTRY_CN_2 Mail client in China * 2.8 TVD_PH_SUBJ_URGENT TVD_PH_SUBJ_URGENT * 1.1 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 1.3 MISSING_HEADERS Missing To: header * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 1.6 URG_BIZ BODY: Contains urgent matter * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding * 2.0 SPAMMY_WEBMAIL SPAMMY_WEBMAIL * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 2.0 YAHOO_SPAM YAHOO_SPAM * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from yhcargo.com ([60.191.61.114]) by ga.impsec.org (8.13.7/8.13.7) with SMTP id n4S0RSC9012193 for ; Wed, 27 May 2009 17:27:34 -0700 Received: from WebMail ([127.0.0.1]) (envelope-sender ) by 127.0.0.1 with ESMTP for ; Wed, 27 May 2009 23:30:14 +0800 Date: Wed, 27 May 2009 23:30:14 +0800 From: "karisbenjamin" Reply-To: "karisbenjamin" Subject: [SPAM] URGENT BUSINESS PROPOSAL X-Priority: 3 X-Mailer: WebMail Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="--=__b_000_5226d586e6b892748d099e1abbe7a96e" MIME-Version: 1.0 X-Greylist: Delayed for 07:57:49 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 27 May 2009 17:27:36 -0700 (PDT) X-Spam-Prev-Subject: URGENT BUSINESS PROPOSAL Status: R X-Status: X-Keywords: X-UID: 385 Content-Length: 9762 This is a multi-part message in MIME format. ----=__b_000_5226d586e6b892748d099e1abbe7a96e Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 DQpEZWFyIFNpciwgSSBhbSBNci4gS2FyaXMgQmVuamFtaW4sIHRoZSBBdWRpdG9yIGdlbmVyYWwg b2YgdGhlIFNvdXRoIEFmcmljYSAyMDEwIFdvcmxkIEN1cCBDb250cmFjdCBBd2FyZGluZyBDb21t aXR0ZWUuIFdlIGF3YXJkZWQgdGhlIGNvbnRyYWN0IGZvciB0aGUgRmlyc3QgTmF0aW9uYWwgQmFu ayBTdGFkaXVtIHRvIGEgZm9yZWlnbiBjb250cmFjdGluZyBmaXJtIGF0IHRoZSB0dW5lIG9mIFVT JDczIE1pbGxpb24gW3NldmVudHkgdGhyZWUgbWlsbGlvbiBVbml0ZWQgU3RhdGVzIGRvbGxhcnNd DQombmJzcDsNCldlIHRoZSBhd2FyZGluZyBjb21taXR0ZWUgZGVsaWJlcmF0ZWx5IG92ZXIgaW52 b2ljZSB0aGUgY29udHJhY3QgYnkgZXhjZXNzIG9mICQxMi5NaWxsaW9uIGRvbGxhcnMsIHRoZSBj b250cmFjdCBoYXMgYmVlbiBmdWxseSBleGVjdXRlZCBhbmQgdGhlIG9yaWdpbmFsIGNvbnRyYWN0 b3IgaGFzIGJlZW4gZHVsbHkgcGFpZCB0aGUgYWdyZWVkIHN1bSBvZiBVUyQ2MSBNaWxsaW9uIFtT aXh0eSBPbmUgTWlsbGlvbiBEb2xsYXJzXSANCkhhdmluZyBwYWlkIHRoZSBvcmlnaW5hbCBjb250 cmFjdG9yLCBJIHdhcyBtYW5kYXRlZCBieSBteSBjb2xsZWFndWVzIHRvIHNvdXJjZSBvdXQgYSBy ZWxpYWJsZSBhbmQgdHJ1c3R3b3J0aHkgZm9yZWlnbiBwYXJ0bmVyIHdob20gd2Ugc2hhbGwgdHJh bnNmZXIgdGhlIG92ZXIgaW52b2ljZSBmdW5kIGZvciBkaXNidXJzZW1lbnQgYW5kIGludmVzdG1l bnQuIFBsZWFzZSB0YWtlIG5vdGUgdGhlIHNhaWQgZnVuZCBpcyBsZWdpdGltYXRlLCB0aGUgdHJh bnNhY3Rpb24gaXMgMTAwJSByaXNrIGZyZWUgYW5kIGFsbCB0aGUgbW9kYWxpdGllcyBmb3IgdGhl IHN1Y2Nlc3NmdWwgdHJhbnNmZXIgb2YgdGhlIGZ1bmQgaGF2ZSBiZWVuIHB1dCBpbiBwbGFjZS4g DQombmJzcDsNCkl0knMgd29ydGggYnJpbmdpbmcgdG8geW91ciBub3RpY2UgdGhhdCB0aGUgb2Zm aWNpYWxzIGludm9sdmVkIG9uIHRoaXMgdHJhbnNhY3Rpb24gYXJlIHJlcHV0YWJsZSBjaXZpbCBz ZXJ2YW50cyB3aG8gaGFzIHB1dCBpbiB5ZWFycyBvZiBtZXRpY3Vsb3VzIHNlcnZpY2UgaW4gdGhl IEdvdmVybm1lbnQgYW5kIHdvdWxkIG5vdCBsaWtlIGFueXRoaW5nIHRoYXQgd2lsbCBqZW9wYXJk aXplIHRoZWlyIGltYWdlLiAmbmJzcDtXaGF0IHdlIG5lZWQgaXMgYSBjb3B5IG9mIHlvdXIgaWRl bnRpZmljYXRpb24gYW5kIHlvdXIgZGVzaWduYXRlZCBiYW5rIGNvb3JkaW5hdGVzIHdoZXJlIHlv dSB3aXNoIHRoZSBmdW5kIHRvIGJlIHRyYW5zZmVycmVkLiANCiZuYnNwOw0KVGhlIGFjY291bnQg c2hvdWxkIGJlIHN1Y2ggdGhhdCB0aGUgaXNzdWUgb24gdGF4YXRpb24gdG9sbHMgd2lsbCBub3Qg YmUgbXVjaCBvbiB0aGUgZnVuZCB3aGVuIHRyYW5zZmVycmVkLiBXZSBhcmUgd2lsbGluZyB0byBv ZmZlciB5b3UgMTUlIG9mIHRoZSB0b3RhbCBzdW0sIHdoaWxlIHdlIHRoZSBvZmZpY2lhbHMgd2ls bCBzaGFyZSB0aGUgcmVtYWluaW5nIDg1JSBQbGVhc2UgZmVlbCBmcmVlIHRvIGNvbnRhY3QgbWUg Zm9yIGZ1cnRoZXIgY2xlYXJhbmNlIGFuZCBpZiB5b3UgaGF2ZSBhbnkgcXVlc3Rpb24gYWxzbyBm ZWVsIGZyZWUgdG8gZ2V0IGluIHRvdWNoIHdpdGggbWUuIA0KVGhhbmtpbmcgeW91IGFuZCBsb29r aW5nIGZvcndhcmQgdG8geW91ciBmYXZvcmFibGUgcmVzcG9uc2UuIFlvdSBjYW4gY2FsbCBtZSBv biBteSBwcml2YXRlIHRlbCBudW1iZXIgKzI3LTczLTI3Ny0yMDY1IG9yIG9uIG15IGZheCBudW1i ZXIgKzI3IDg2LTU0MC00ODM5LllvdXJzIFNpbmNlcmVseSwgDQpLYXJpcyBCZW5qYW1pbiBbQXVk aXRvciBHZW5lcmFsLCAyMDEwIFdvcmxkIEN1cF0NCg0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCk1lc3NhZ2Ugc2VudCB1c2luZyBX aW5tYWlsIE1haWwgU2VydmVyDQoNCg== ----=__b_000_5226d586e6b892748d099e1abbe7a96e Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: base64 PEhUTUw+PEhFQUQ+PE1FVEEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9aXNvLTg4NTktMSI+PC9IRUFEPjxCT0RZPjxESVY+DQo8UCBjbGFzcz1N c29Ob3JtYWwgc3R5bGU9Ik1BUkdJTjogMGluIDBpbiAwcHQiPjxTUEFOIHN0eWxlPSJDT0xPUjog YmxhY2s7IEZPTlQtRkFNSUxZOiAnQ291cmllciBOZXcnIj48Rk9OVCBzaXplPTM+RGVhciA8QiBz dHlsZT0ibXNvLWJpZGktZm9udC13ZWlnaHQ6IG5vcm1hbCI+U2lyPC9CPiwgPEJSPjxCUj5JIGFt IDxCIHN0eWxlPSJtc28tYmlkaS1mb250LXdlaWdodDogbm9ybWFsIj5Nci4gS2FyaXMgQmVuamFt aW48L0I+LCB0aGUgQXVkaXRvciBnZW5lcmFsIG9mIHRoZSA8U1BBTiBjbGFzcz15c2hvcnRjdXRz PlNvdXRoIEFmcmljYSAyMDEwIFdvcmxkIEN1cDwvU1BBTj4gQ29udHJhY3QgQXdhcmRpbmcgQ29t bWl0dGVlLiBXZSBhd2FyZGVkIHRoZSBjb250cmFjdCBmb3IgdGhlIDxTUEFOIGNsYXNzPXlzaG9y dGN1dHM+PEIgc3R5bGU9Im1zby1iaWRpLWZvbnQtd2VpZ2h0OiBub3JtYWwiPkZpcnN0IE5hdGlv bmFsIEJhbms8L0I+PC9TUEFOPjxCIHN0eWxlPSJtc28tYmlkaS1mb250LXdlaWdodDogbm9ybWFs Ij4gU3RhZGl1bTwvQj4gdG8gYSBmb3JlaWduIGNvbnRyYWN0aW5nIGZpcm0gYXQgdGhlIHR1bmUg b2YgPEIgc3R5bGU9Im1zby1iaWRpLWZvbnQtd2VpZ2h0OiBub3JtYWwiPlVTJDczIE1pbGxpb248 L0I+IFs8QiBzdHlsZT0ibXNvLWJpZGktZm9udC13ZWlnaHQ6IG5vcm1hbCI+c2V2ZW50eSB0aHJl ZSBtaWxsaW9uIDw/eG1sOm5hbWVzcGFjZSBwcmVmaXggPSBzdDEgbnMgPSAidXJuOnNjaGVtYXMt bWljcm9zb2Z0LWNvbTpvZmZpY2U6c21hcnR0YWdzIiAvPjxzdDE6cGxhY2UgdzpzdD0ib24iPjxz dDE6Y291bnRyeS1yZWdpb24gdzpzdD0ib24iPlVuaXRlZCBTdGF0ZXM8L3N0MTpjb3VudHJ5LXJl Z2lvbj48L3N0MTpwbGFjZT4gZG9sbGFyczwvQj5dPD94bWw6bmFtZXNwYWNlIHByZWZpeCA9IG8g bnMgPSAidXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiAvPjxvOnA+PC9v OnA+PC9GT05UPjwvU1BBTj48L1A+DQo8UCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9Ik1BUkdJTjog MGluIDBpbiAwcHQiPjxTUEFOIHN0eWxlPSJDT0xPUjogYmxhY2s7IEZPTlQtRkFNSUxZOiAnQ291 cmllciBOZXcnIj48bzpwPjxGT05UIHNpemU9Mz4mbmJzcDs8L0ZPTlQ+PC9vOnA+PC9TUEFOPjwv UD4NCjxQIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0iTUFSR0lOOiAwaW4gMGluIDBwdCI+PFNQQU4g c3R5bGU9IkNPTE9SOiBibGFjazsgRk9OVC1GQU1JTFk6ICdDb3VyaWVyIE5ldyciPjxGT05UIHNp emU9Mz5XZSB0aGUgYXdhcmRpbmcgY29tbWl0dGVlIGRlbGliZXJhdGVseSBvdmVyIGludm9pY2Ug dGhlIGNvbnRyYWN0IGJ5IGV4Y2VzcyBvZiA8QiBzdHlsZT0ibXNvLWJpZGktZm9udC13ZWlnaHQ6 IG5vcm1hbCI+JDEyLk1pbGxpb24gZG9sbGFyczwvQj4sIHRoZSBjb250cmFjdCBoYXMgYmVlbiBm dWxseSBleGVjdXRlZCBhbmQgdGhlIG9yaWdpbmFsIGNvbnRyYWN0b3IgaGFzIGJlZW4gZHVsbHkg cGFpZCB0aGUgYWdyZWVkIHN1bSBvZiA8L0ZPTlQ+PEZPTlQgc2l6ZT0zPjxCIHN0eWxlPSJtc28t YmlkaS1mb250LXdlaWdodDogbm9ybWFsIj5VUyQ2MSBNaWxsaW9uIFtTaXh0eSA8U1BBTiBjbGFz cz15c2hvcnRjdXRzPk9uZSBNaWxsaW9uIERvbGxhcnM8L1NQQU4+XSA8QlIgc3R5bGU9Im1zby1z cGVjaWFsLWNoYXJhY3RlcjogbGluZS1icmVhayI+PEJSIHN0eWxlPSJtc28tc3BlY2lhbC1jaGFy YWN0ZXI6IGxpbmUtYnJlYWsiPjwvQj48bzpwPjwvbzpwPjwvRk9OVD48L1NQQU4+PC9QPg0KPFAg Y2xhc3M9TXNvTm9ybWFsIHN0eWxlPSJNQVJHSU46IDBpbiAwaW4gMHB0Ij48U1BBTiBzdHlsZT0i Q09MT1I6IGJsYWNrOyBGT05ULUZBTUlMWTogJ0NvdXJpZXIgTmV3JyI+PEZPTlQgc2l6ZT0zPkhh dmluZyBwYWlkIHRoZSBvcmlnaW5hbCBjb250cmFjdG9yLCBJIHdhcyBtYW5kYXRlZCBieSBteSBj b2xsZWFndWVzIHRvIHNvdXJjZSBvdXQgYSByZWxpYWJsZSBhbmQgdHJ1c3R3b3J0aHkgZm9yZWln biBwYXJ0bmVyIHdob20gd2Ugc2hhbGwgdHJhbnNmZXIgdGhlIG92ZXIgaW52b2ljZSBmdW5kIGZv ciBkaXNidXJzZW1lbnQgYW5kIGludmVzdG1lbnQuIDxCUj48QlI+UGxlYXNlIHRha2Ugbm90ZSB0 aGUgc2FpZCBmdW5kIGlzIGxlZ2l0aW1hdGUsIHRoZSB0cmFuc2FjdGlvbiBpcyA8QiBzdHlsZT0i bXNvLWJpZGktZm9udC13ZWlnaHQ6IG5vcm1hbCI+MTAwJTwvQj4gcmlzayBmcmVlIGFuZCBhbGwg dGhlIG1vZGFsaXRpZXMgZm9yIHRoZSBzdWNjZXNzZnVsIHRyYW5zZmVyIG9mIHRoZSBmdW5kIGhh dmUgYmVlbiBwdXQgaW4gcGxhY2UuIDxvOnA+PC9vOnA+PC9GT05UPjwvU1BBTj48L1A+DQo8UCBj bGFzcz1Nc29Ob3JtYWwgc3R5bGU9Ik1BUkdJTjogMGluIDBpbiAwcHQiPjxTUEFOIHN0eWxlPSJD T0xPUjogYmxhY2s7IEZPTlQtRkFNSUxZOiAnQ291cmllciBOZXcnIj48bzpwPjxGT05UIHNpemU9 Mz4mbmJzcDs8L0ZPTlQ+PC9vOnA+PC9TUEFOPjwvUD4NCjxQIGNsYXNzPU1zb05vcm1hbCBzdHls ZT0iTUFSR0lOOiAwaW4gMGluIDBwdCI+PFNQQU4gc3R5bGU9IkNPTE9SOiBibGFjazsgRk9OVC1G QU1JTFk6ICdDb3VyaWVyIE5ldyciPjxGT05UIHNpemU9Mz5JdJJzIHdvcnRoIGJyaW5naW5nIHRv IHlvdXIgbm90aWNlIHRoYXQgdGhlIG9mZmljaWFscyBpbnZvbHZlZCBvbiB0aGlzIHRyYW5zYWN0 aW9uIGFyZSByZXB1dGFibGUgPFNQQU4gY2xhc3M9eXNob3J0Y3V0cz5jaXZpbCBzZXJ2YW50czwv U1BBTj4gd2hvIGhhcyBwdXQgaW4geWVhcnMgb2YgbWV0aWN1bG91cyBzZXJ2aWNlIGluIHRoZSBH b3Zlcm5tZW50IGFuZCB3b3VsZCBub3QgbGlrZSBhbnl0aGluZyB0aGF0IHdpbGwgamVvcGFyZGl6 ZSB0aGVpciBpbWFnZS4gPEJSPjxTUEFOIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+Jm5ic3A7 PC9TUEFOPjxCUj5XaGF0IHdlIG5lZWQgaXMgYSBjb3B5IG9mIHlvdXIgaWRlbnRpZmljYXRpb24g YW5kIHlvdXIgZGVzaWduYXRlZCBiYW5rIGNvb3JkaW5hdGVzIHdoZXJlIHlvdSB3aXNoIHRoZSBm dW5kIHRvIGJlIHRyYW5zZmVycmVkLiA8bzpwPjwvbzpwPjwvRk9OVD48L1NQQU4+PC9QPg0KPFAg Y2xhc3M9TXNvTm9ybWFsIHN0eWxlPSJNQVJHSU46IDBpbiAwaW4gMHB0Ij48U1BBTiBzdHlsZT0i Q09MT1I6IGJsYWNrOyBGT05ULUZBTUlMWTogJ0NvdXJpZXIgTmV3JyI+PG86cD48Rk9OVCBzaXpl PTM+Jm5ic3A7PC9GT05UPjwvbzpwPjwvU1BBTj48L1A+DQo8UCBjbGFzcz1Nc29Ob3JtYWwgc3R5 bGU9Ik1BUkdJTjogMGluIDBpbiAwcHQiPjxTUEFOIHN0eWxlPSJDT0xPUjogYmxhY2s7IEZPTlQt RkFNSUxZOiAnQ291cmllciBOZXcnIj48Rk9OVCBzaXplPTM+VGhlIGFjY291bnQgc2hvdWxkIGJl IHN1Y2ggdGhhdCB0aGUgaXNzdWUgb24gdGF4YXRpb24gdG9sbHMgd2lsbCBub3QgYmUgbXVjaCBv biB0aGUgZnVuZCB3aGVuIHRyYW5zZmVycmVkLiA8QlI+PEJSPldlIGFyZSB3aWxsaW5nIHRvIG9m ZmVyIHlvdSA8QiBzdHlsZT0ibXNvLWJpZGktZm9udC13ZWlnaHQ6IG5vcm1hbCI+MTUlPC9CPiBv ZiB0aGUgdG90YWwgc3VtLCB3aGlsZSB3ZSB0aGUgb2ZmaWNpYWxzIHdpbGwgc2hhcmUgdGhlIHJl bWFpbmluZyA8QiBzdHlsZT0ibXNvLWJpZGktZm9udC13ZWlnaHQ6IG5vcm1hbCI+ODUlPC9CPiBQ bGVhc2UgZmVlbCBmcmVlIHRvIGNvbnRhY3QgbWUgZm9yIGZ1cnRoZXIgY2xlYXJhbmNlIGFuZCBp ZiB5b3UgaGF2ZSBhbnkgcXVlc3Rpb24gYWxzbyBmZWVsIGZyZWUgdG8gZ2V0IGluIHRvdWNoIHdp dGggbWUuIDxCUiBzdHlsZT0ibXNvLXNwZWNpYWwtY2hhcmFjdGVyOiBsaW5lLWJyZWFrIj48QlIg c3R5bGU9Im1zby1zcGVjaWFsLWNoYXJhY3RlcjogbGluZS1icmVhayI+PG86cD48L286cD48L0ZP TlQ+PC9TUEFOPjwvUD4NCjxQIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0iTUFSR0lOOiAwaW4gMGlu IDBwdCI+PFNQQU4gc3R5bGU9IkNPTE9SOiBibGFjazsgRk9OVC1GQU1JTFk6ICdDb3VyaWVyIE5l dyciPjxGT05UIHNpemU9Mz5UaGFua2luZyB5b3UgYW5kIGxvb2tpbmcgZm9yd2FyZCB0byB5b3Vy IGZhdm9yYWJsZSByZXNwb25zZS4gWW91IGNhbiBjYWxsIG1lIG9uIG15IHByaXZhdGUgdGVsIG51 bWJlciArPEIgc3R5bGU9Im1zby1iaWRpLWZvbnQtd2VpZ2h0OiBub3JtYWwiPjI3LTczLTI3Ny0y MDY1PC9CPiBvciBvbiBteSBmYXggbnVtYmVyICs8QiBzdHlsZT0ibXNvLWJpZGktZm9udC13ZWln aHQ6IG5vcm1hbCI+MjcgODYtNTQwLTQ4MzkuPC9CPjxCUj5Zb3VycyBTaW5jZXJlbHksIDxCUiBz dHlsZT0ibXNvLXNwZWNpYWwtY2hhcmFjdGVyOiBsaW5lLWJyZWFrIj48QlIgc3R5bGU9Im1zby1z cGVjaWFsLWNoYXJhY3RlcjogbGluZS1icmVhayI+PG86cD48L286cD48L0ZPTlQ+PC9TUEFOPjwv UD4NCjxQIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0iTUFSR0lOOiAwaW4gMGluIDBwdCI+PEZPTlQg c2l6ZT0zPjxCIHN0eWxlPSJtc28tYmlkaS1mb250LXdlaWdodDogbm9ybWFsIj48U1BBTiBzdHls ZT0iQ09MT1I6IGJsYWNrOyBGT05ULUZBTUlMWTogJ0NvdXJpZXIgTmV3JyI+S2FyaXMgQmVuamFt aW48L1NQQU4+PC9CPjxTUEFOIHN0eWxlPSJDT0xPUjogYmxhY2s7IEZPTlQtRkFNSUxZOiAnQ291 cmllciBOZXcnIj4gWzxTUEFOIGNsYXNzPXlzaG9ydGN1dHM+QXVkaXRvciBHZW5lcmFsPC9TUEFO PiwgPFNQQU4gY2xhc3M9eXNob3J0Y3V0cz4yMDEwIFdvcmxkIEN1cDwvU1BBTj5dPG86cD48L286 cD48L1NQQU4+PC9GT05UPjwvUD48L0RJVj48L0JPRFk+PC9IVE1MPg0KPHByZT4NCg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpNZXNz YWdlIHNlbnQgdXNpbmcgV2lubWFpbCBNYWlsIFNlcnZlcg0KPC9wcmU+DQo= ----=__b_000_5226d586e6b892748d099e1abbe7a96e-- From no.reply@azet.sk Wed May 27 21:50:32 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.7 required=5.0 tests=ADVANCE_FEE_2,BAYES_95, DEAR_SOMETHING,EMAILBL_TEST_LEM,FORGED_MUA_OUTLOOK,L_SOME_STD_PROBS, MSOE_MID_WRONG_CASE,PHISH_05,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL, RCVD_IN_SORBS_DUL,RCVD_IN_SORBS_WEB,RDNS_DYNAMIC,SPF_FAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 2.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [217.98.30.2 listed in b.barracudacentral.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [213.233.64.133 listed in psbl.surriel.com] * 1.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [217.98.30.2 listed in psbl.surriel.com] [213.233.64.133 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 1.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address * [217.98.30.2 listed in dnsbl.sorbs.net] * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (salvet.mariket[at]gmail.com) * 0.7 SPF_FAIL SPF: sender does not match SPF record (fail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=no.reply%40azet.sk&ip=217.98.30.2&receiver=ga.impsec.org] * 1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)' * 0.2 PHISH_05 BODY: Phishing for account information * 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% * [score: 0.9518] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from geos.biz.pl (217.98.30.2.meganet.net.pl [217.98.30.2] (may be forged)) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4S4oRSo019436 for ; Wed, 27 May 2009 21:50:32 -0700 Received: from User (unknown [213.233.64.133]) by geos.biz.pl (Postfix) with ESMTP id BD10F5B0E; Thu, 28 May 2009 06:41:13 +0200 (CEST) From: "Frank Andrew" Subject: [SPAM] Reference Nr:5687SPL876 Date: Thu, 28 May 2009 07:47:41 +0300 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090528044113.BD10F5B0E@geos.biz.pl> To: undisclosed-recipients:; X-Spam-Prev-Subject: Reference Nr:5687SPL876 Status: R X-Status: X-Keywords: X-UID: 386 Dear Sir/ Madam, Greetings! Dulwich gallery with head office in South Korea wishes to seek your services as a consultant in receiving funds on its behalf. We offer 10% for every monies paid by our bidders in USA to you, and you remit the companys money to the United Kingdom. We shall provide you grants for a bank account opening if you dont have any, as well as take off grants. Your remuneration is tax free, and there are no hidden or upfront fees to be borne by you. This is real and legal! If interested, please provide your full names, mailing and contact details for immediate registration. For more details contact me. Street Address: 1st floor Shinho Villart, 452-3 Sungnae-Dong City: Gangdong-Gu Country: South Korea Telephone: 82-70-78914220 salvet.mariket@gmail.com Sincerely, Frank Andrew From data101@optonline.net Fri May 29 21:40:03 2009 Return-Path: Received: from mercury (tunnel.ga.impsec.org [127.0.0.1]) by mercury.impsec.org (8.14.0/8.14.0) with ESMTP id n4U4e3WB003971 for ; Fri, 29 May 2009 21:40:03 -0700 X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ****** X-Spam-Status: Yes, score=6.9 required=5.0 tests=BAYES_99,EMAILBL_TEST_LEM, HTML_MESSAGE,J_CHICKENPOX_31,MISSING_HEADERS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (p.ww1[at]hotmail.com) * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha * 0.0 HTML_MESSAGE BODY: HTML included in message Received: from tunnel.ga.impsec.org [127.0.0.1] by mercury with POP3 (fetchmail-6.3.9) for (single-drop); Fri, 29 May 2009 21:40:03 -0700 (PDT) Received: from wmta3.srv.hcvlny.cv.net (wmta3.srv.hcvlny.cv.net [167.206.10.6]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4U4aNgj005370 for ; Fri, 29 May 2009 21:36:27 -0700 Received: from optonline.net (mstr17a.srv.hcvlny.cv.net [10.240.4.16]) by wmta3.srv.hcvlny.cv.net (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTP id <0KKF0064RVEGY600@wmta3.srv.hcvlny.cv.net> for jhardin@impsec.org; Sat, 30 May 2009 00:06:17 -0400 (EDT) Received: from [10.240.3.201] (Forwarded-For: 196.12.36.225, [10.240.3.201]) by mstr17.srv.hcvlny.cv.net (mshttpd); Sat, 30 May 2009 04:06:16 +0000 (GMT) Date: Sat, 30 May 2009 04:06:16 +0000 (GMT) From: data101@optonline.net Subject: [SPAM] Important Business Proposal Bcc: Reply-to: p.ww1@hotmail.com Message-id: MIME-version: 1.0 X-Mailer: Sun Java(tm) System Messenger Express 6.2-8.04 (built Feb 28 2007) X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-type: multipart/alternative; boundary="Boundary_(ID_gPD4Pd+cMrmnyx8dRx/SuQ)" Content-language: en X-Accept-Language: en Priority: normal X-Greylist: Delayed for 00:30:04 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 29 May 2009 21:36:27 -0700 (PDT) X-Spam-Prev-Subject: Important Business Proposal Status: R X-Status: X-Keywords: X-UID: 387 Content-Length: 1302 This is a multi-part message in MIME format. --Boundary_(ID_gPD4Pd+cMrmnyx8dRx/SuQ) Content-type: text/plain; charset=iso-8859-1 Content-disposition: inline Content-transfer-encoding: quoted-printable Good Day=2CI am=A0 Mr=2E Paul Wolfenden=2C Manager of ABN AMRO BANK 250 = Bishopsgate=2C London EC2M 4AA =2E I have a business proposal valued at = GBP=A321=2C000=2C000=2E00 (Twenty-One Million Pounds) from=A0 my Branch=2E= Get back to me to enable me furnish you with full information concernin= g this letter via by email=2EEmail=3Ap=2Eww1=40hotmail=2Ecom=2ESincerely= =2CPaul Wolfenden --Boundary_(ID_gPD4Pd+cMrmnyx8dRx/SuQ) Content-type: text/html; charset=iso-8859-1 Content-disposition: inline Content-transfer-encoding: quoted-printable =3Cbr=3E=3Cbr=3EGood Day=2C=3Cbr=3E=3Cbr=3EI am=26nbsp=3B Mr=2E Paul Wol= fenden=2C Manager of ABN AMRO BANK 250 Bishopsgate=2C London EC2M 4AA =2E= I have a business proposal valued at GBP=A321=2C000=2C000=2E00 (Twenty-= One Million Pounds) from=26nbsp=3B my Branch=2E =3Cbr=3E=3Cbr=3EGet back= to me to enable me furnish you with full information concerning this le= tter via by email=2E=3Cbr=3EEmail=3Ap=2Eww1=40hotmail=2Ecom=2E=3Cbr=3E=3C= br=3ESincerely=2C=3Cbr=3EPaul Wolfenden=3Cbr=3E=3Cbr=3E=3Cbr=3E --Boundary_(ID_gPD4Pd+cMrmnyx8dRx/SuQ)-- From abdul.ma06@msn.com Thu May 28 10:53:46 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************************ X-Spam-Status: Yes, score=25.0 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,DEAR_FRIEND,FILL_THIS_FORM_01,HTML_MESSAGE,JM_SOUGHT_FRAUD_3, MILLIONS_01,MILLION_USD,MISSING_HEADERS,PHISH_05,RAZOR2_CHECK,SARE_FRAUD_X3, SARE_SUB_NEED_REPLY,SPF_PASS,SUBJ_ALL_CAPS,URG_BIZ autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.8 SARE_SUB_NEED_REPLY Spammer subject - black market or scam * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.3 MISSING_HEADERS Missing To: header * 1.5 FILL_THIS_FORM_01 BODY: Fill in your personal info * 1.6 URG_BIZ BODY: Contains urgent matter * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.2 PHISH_05 BODY: Phishing for account information * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam Received: from blu0-omc3-s11.blu0.hotmail.com (blu0-omc3-s11.blu0.hotmail.com [65.55.116.86]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4SHrgVW009425 for ; Thu, 28 May 2009 10:53:46 -0700 Received: from BLU131-W3 ([65.55.116.72]) by blu0-omc3-s11.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 28 May 2009 10:36:31 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_76efa65c-e811-442b-95b7-d7b8ab15c1ff_" X-Originating-IP: [41.203.230.61] Reply-To: From: Abdul Musa Subject: [SPAM] AWAITNG YOUR URGENT REPLY Date: Thu, 28 May 2009 17:36:31 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 28 May 2009 17:36:31.0456 (UTC) FILETIME=[D6A10E00:01C9DFBA] X-Greylist: Delayed for 00:17:11 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Thu, 28 May 2009 10:53:46 -0700 (PDT) X-Spam-Prev-Subject: AWAITNG YOUR URGENT REPLY Status: R X-Status: X-Keywords: X-UID: 388 Content-Length: 9530 --_76efa65c-e811-442b-95b7-d7b8ab15c1ff_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable mFROM THE DESK OF MR. ABDUL MUSA=2C DIRECTOR IN CHARGE OF AUDITING=20 AND ACCOUNTING SECTION=20 BANK OF AFRICA (B.O.A)=20 OUAGADOUGOU=2C BURKINA FASO=2C =20 WEST AFRICA=2C =20 =20 =20 Dear Friend=2C =20 STRICTLY CONFIDENTIAL=20 I know that this mail will come to you as a surprise as we never met before= . I am the Director in charge of Auditing section of Bank of African (B.O.A= )=2C I Hoped that you will not expose or betray this trust and confident th= at I am about to repose on you for the mutual benefit of our both families.= I need your urgent assistance in transferring the sum of Ten million unite= d state dollars ($10.000mUSD) immediately to your account.=20 The fund has been dormant (in-active) for 5 years in our Bank here without = any body coming for it. I want to apply for release of the fund to you as t= he nearest person to our deceased customer Mr. George Brumley Jr from Atlan= ta America (the owner of the account) who died a long with his supposed nex= t of kin in air crash since on July 21 2003. I don't want the fund to go in= to our Bank treasury as an abandoned fund=2C so this is the reason why I co= ntacted you=2C so that my Bank will release the fund to you as the nearest = person to the deceased customer.=20 Please I would like you to keep this proposal as a top secret and delete it= if you are not interested. Upon receipt of your reply=2C I will send you t= he application form you will fill and send to the bank for transfer of the = fund into your bank account and also note that you will have 40% of the abo= ve mentioned amount if you agree to help me execute this business. And also= 10% had been mapped out for you for the expense you will make in this tran= saction and 50% is for me. I need you information so that I will send you t= he application form. =20 YOUR FULL INFORMATIONS =20 Your Name. Your Home Addresses. City. Country. Home Telephone. Private Telephone. Fax No. Marital Status. Age. Occupation. Religion. Your picture. Waiting for your urgent reply so that we will starts immediately=2C Best Regards=2C=20 MR ABDUL MUSA (B.O.A) BANK OF AFRICA= --_76efa65c-e811-442b-95b7-d7b8ab15c1ff_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

mFROM T= HE DESK OF MR. ABDUL MUSA=2C
DIRECTOR IN CHARGE OF AUDITING
AND ACCOUNTING SECTION
BANK OF AFRICA= (B.O.A)
OU= AGADOUGOU=2C BURKINA FASO=2C =3B
WEST AFRICA=2C =3B= =20

 =3B
 =3B
Dear Friend=2C
 =3B =3B =3B =3B =3B =3B =3B&nbs= p=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B
 =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3BSTRICTLY CONFIDENTIAL <= B>
I know that this= mail will come to you as a surprise as we never met before. I am the Direc= tor in charge of Auditing section of Bank of African (B.O.A)=2C I Hoped tha= t you will not expose or betray this trust and confident that I am about to= repose on you for the mutual benefit of our both families. I need your urg= ent assistance in transferring the sum of =3BTen million =3Bunited = state dollars ($10.000mUSD) immediately to your account.
The fund has been dormant= (in-active) for 5 years in our Bank here without any body coming for it. I= want to apply for release of the fund to you as the nearest person to our = deceased customer Mr. George Brumley Jr from Atlanta America (the owner of = the account) who died a long with his supposed next of kin in air crash sin= ce on July 21 2003. I don't want the fund to go into our Bank treasury as a= n abandoned fund=2C so this is the reason why I contacted you=2C so that my= Bank will release the fund to you as the nearest person to the deceased cu= stomer.

Please I would like you to keep this proposal as a top secret and delete i= t if you are not interested. Upon receipt of your reply=2C I will send you = the application form you will fill and send to the bank for transfer of the= fund into your bank account and also note that you will have 40% of the ab= ove mentioned amount if you agree to help me execute this business. And als= o 10% had been mapped out for you for the expense you will make in this tra= nsaction and 50% is for me. I need you information so that I will send you = the application form. =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=
 =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3BYOUR FULL INFORMATIONS =3B&n= bsp=3B =3B
Your Name.
Your Home Addresses.
City.
Country.
Home Telephone.
Private Telephone.
Fax No.
Marital Status.
Age.
Occupation.
Religion.
Your picture.

Waiting for your urgent =3Breply so that we will starts imme= diately=2C

Best Regards=2C
MR ABDUL MUSA
(B.O.A) BANK OF AFRICA

= --_76efa65c-e811-442b-95b7-d7b8ab15c1ff_-- From info.contact@club-internet.fr Fri May 29 08:02:42 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: *********** X-Spam-Status: Yes, score=11.5 required=5.0 tests=BAYES_99,BL_COUNTRY_FR_2, HTML_EMBED_IMG_04,HTML_MESSAGE,MIME_HTML_ONLY,MIME_QP_LONG_LINE,SPF_PASS, SUBJ_ALL_CAPS,THOUS_EMAIL_ADDRS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_FR_2 Mail client in France * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.0 THOUS_EMAIL_ADDRS BODY: THOUS_EMAIL_ADDRS * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 1.0 HTML_EMBED_IMG_04 RAW: Contains embedded images * 1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars Received: from delay-cm.club-internet.fr (delay-cm.club-internet.fr [194.158.104.48]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4TF2aq2013592 for ; Fri, 29 May 2009 08:02:41 -0700 Received: from relay-dm.club-internet.fr (relay-dm.cs.clubint.net [172.16.20.40]) by delay-cm.club-internet.fr (Postfix) with ESMTP id 91EE83E1F6E for ; Fri, 29 May 2009 16:42:11 +0200 (CEST) Received: from club-internet.fr (flashmail-7t2.cs.clubint.net [172.16.24.117]) by relay-dm.club-internet.fr (Postfix) with SMTP id 6C2B025603; Fri, 29 May 2009 16:41:15 +0200 (CEST) Received: from [41.207.193.2/172.16.21.158] by flashmail-7t2.club-internet.fr via html interface From: info.contact@club-internet.fr To: info.contact@club-internet.fr Subject: [SPAM] VOTRE NUMERO DE TICKET (PW 8775TZ) Date: Fri, 29 May 2009 16:41:15 +0200 Mime-Version: 1.0 X-Mailer: Medianet/v2.0 Message-Id: Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Greylist: Delayed for 00:20:22 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Fri, 29 May 2009 08:02:42 -0700 (PDT) X-Spam-Prev-Subject: VOTRE NUMERO DE TICKET (PW 8775TZ) Status: R X-Status: X-Keywords: X-UID: 389 Content-Length: 5838 <=21DOCTYPE HTML PUBLIC =22-//W3C//DTD HTML 4.01 Transitional//EN=22> Flashmail =   =

F=C9LICITATION=21=21 EUROMILLIONNAIRE

 

A votre aimable attention=21=21=21

 

Nous avons le plaisir de vous annoncez que vous fa=EEtes partie des he= ureux gagnants du grand jeu e-Lottery ou soit free Lotto 2008-2009.La vale= ur totale en jeu est de 200.000.000 d'euro et votre adresse a =E9t=E9 tir=E9= au sort la s=E9lection informatique lors de notre tirage effectu=E9 la se= maine derni=E8re par la loterie e-Lottery =E0 Londres (Angleterre).=

 

Votre email a =E9t=E9 s=E9lectionn=E9 parmi les 50 gagnants chanceux e= t vous b=E9n=E9ficiez de la somme de 85.000 euros par le = biais de la promotion e-Lottery 2008-2009.Nous vous prions pour de plus am= ples informations de bien vouloir prendre imm=E9diatement contact avec not= re repr=E9sentant pour le retrait de votre lot.

 

contactez notre repr=E9sentant =E0 cette adresse. =

 
      &nbs= p;                  Contact du repr=E9sent= ant.
 
     Noms et pr=E9noms:  Monsieur= Nicolas MILHOUD 
     Code Repr=E9sentant: 029
 = ;    Email: nicolas.milhoud=40yahoo.fr

 

E-Lottery est un produit de la soci=E9t=E9 Euromillions. En outre cett= e loterie Anglaise =E0 pour but de rapprocher les diff=E9rentes couches so= ciales et de permettre =E0 toutes les personnes en possession de toutes le= urs facult=E9s mentales ou physiques de pouvoir b=E9n=E9ficier de prix off= erts par Euro millions lors du tirages =E0 des dates sp=E9cifiques. D=E9nomm=E9 =22TIRAGE GRAND PUBLIC.=

 

Recevez encore = toutes nos f=E9licitations.

 

Tr=E8s cordiale= ment,

Service Informa= tions

From ali_ahd0330@msn.com Sat May 30 17:21:26 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: **************************** X-Spam-Status: Yes, score=28.5 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,DEAR_FRIEND,HTML_MESSAGE,JM_SOUGHT_FRAUD_3, J_CHICKENPOX_71,J_CHICKENPOX_73,J_CHICKENPOX_83,J_CHICKENPOX_91,MILLIONS_01, MILLION_USD,MISSING_HEADERS,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5, SARE_FRAUD_X6,SPF_PASS,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.1 SUBJ_ALL_CAPS Subject is all capitals * -0.0 SPF_PASS SPF: sender matches SPF record * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_91 BODY: 9alpha-pock-1alpha * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) Received: from blu0-omc4-s12.blu0.hotmail.com (blu0-omc4-s12.blu0.hotmail.com [65.55.111.151]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4V0LNGM006731 for ; Sat, 30 May 2009 17:21:26 -0700 Received: from BLU121-W12 ([65.55.111.137]) by blu0-omc4-s12.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 30 May 2009 17:03:25 -0700 Message-ID: X-Security: message sanitized on ga.impsec.org See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.152pre7 $Date: 2006-01-20 07:29:24-08 Content-Type: multipart/alternative; boundary="_cc47328e-60d9-4e65-a7a0-552f5cd98710_" X-Originating-IP: [212.52.153.168] Reply-To: From: ali ahmed Subject: [SPAM] READ AND GET BACK TO ME Date: Sun, 31 May 2009 00:03:24 +0000 Importance: Normal MIME-Version: 1.0 Bcc: X-OriginalArrivalTime: 31 May 2009 00:03:25.0214 (UTC) FILETIME=[37EEEBE0:01C9E183] X-Greylist: Delayed for 00:16:26 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 30 May 2009 17:21:26 -0700 (PDT) X-Spam-Prev-Subject: READ AND GET BACK TO ME Status: R X-Status: X-Keywords: X-UID: 390 Content-Length: 9540 --_cc47328e-60d9-4e65-a7a0-552f5cd98710_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable TOP-SECRET = =20 RE -REMITTANCE OF $15 MILLION USD=20 = =20 Dear Friend=2C =20 I am MR.ALI AHMED =2Cfrom Burkina faso in West Africa.I got your e-mail con= tacts from computerised datas after my extensive search via the website for= a God-fearing and trust-worthy person to bestow this transaction which is= the only hope of our survival into his or her hands.When i got your addres= s=2CI prayed and meditated fervently over it and i commited it into the han= ds of God that you should be the rightful person to help us out before I ma= de up my decision to contact you.I am The Manager of Auditing Department of= Our Bank =2COuagadougou Burkina Faso. =20 In my department we discovered an abandoned usd$15M( fifteen Million Unit= ed States Dollars). In an account that belongs to this our foreign customer= who died along with his wife and and children in the plane crash.Since we = got information about his death=2C we have been expecting his next of kin t= o come over and claim his money because we cannot release it unless somebod= y applies for it as the next of kin or relation to the deceased=2C as indic= ated in our banking guidelines but unfortunately we learnt that all his sup= posed next of kin or relation died alongside with him in the plane crash le= aving nobody behind for the claim.It is therefore upon this discovery that = I decided to make this business proposals to you and release the money to y= ou as next of kin or relation to the deceased for safety and subsequent dis= bursement since nobody is coming for it because I don't want this money to = go into the bank treasury as unclaimed Bill.=20 The banking law and guidelines here stipulates that if such money remains = unclaimed after five years=2C the money will be transferred into the bank t= reasury as unclaimed fund.The request of foreigner in this transaction is n= ecessary because our late customer was a foreigner and a Burkinabe cannot s= tand as next of kin to a foreigner=2CI agree that 30% of this money will be= for you as foreigner partner in respect to the provision of a foreign acco= unt. 10% will be set aside for expenses incurred during the business and 60= % would be for me =2C after which I shall visit your country for disburseme= nt according to the percentages indicated.Therefore to enable the immediate= transfer of this fund to you as I have arranged=2Cyou will furnished me wi= th a good receiving account details where the money will betransfered=2Cyou= r private tel and fax number for easy communication.=20 Upon receipt of your reply=2C I will send to you by fax or e-mail a text of= the application which you shall retype and fax to our foreign remittance m= anager=2Cfor easy execution of the transaction.I will not fail to bring to = your notice that this transaction is 100% hitch-free on both side. As all r= equired arrangement have been made for the transfer and more so all the doc= uments backing this claim will be supplied to you after you might have appl= ied. Please I would like you you keep this transaction confidential and as a top= secret as you may wish to know that I am a senior Bank official. =20 Trusting to hear from you immediately. Yours Sincerely=2C Mr.Ali Ahmed= --_cc47328e-60d9-4e65-a7a0-552f5cd98710_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B TOP-SECRET =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B
 =3B =3B =3B =3B =3B =3B =3B =3B&nbs= p=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3BRE -REMITTANCE OF $15 MILLION USD = =3B
 =3B =3B =3B =3B =3B =3B =3B =3B&nbs= p=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B =3B=  =3B =3B =3B =3B =3B =3B =3B =3B =3B&nb= sp=3B =3B =3B =3B =3B =3B =3B =3B =3B = =3B =3B =3B =3B =3B =3B =3B =3B =3B
Dea= r Friend=2C
 =3B
I am MR.ALI AHMED =2Cfrom Burkina faso in West Africa.I got your e-mai= l contacts from computerised datas after my extensive search via the websit= e for a God-fearing and trust-worthy person to =3B bestow this transact= ion which is the only hope of our survival into his or her hands.When i got= your address=2CI prayed and meditated fervently over it and i commited it = into the hands of God that you should be the rightful person to help us out= before I made up my decision to contact you.I am The Manager of Auditing D= epartment of Our Bank =2COuagadougou Burkina Faso. =3B =3B
In my= department we discovered an abandoned usd$15M( fifteen =3B Million&nbs= p=3B United States Do= llars). In an account that belongs to this our foreign custom= er who died along with his wife and and children in the plane crash.Since w= e got information about his death=2C we have been expecting his next of kin= to come over and claim his money because we cannot release it unless someb= ody applies for it as the next of kin or relation to the deceased=2C as ind= icated in our banking guidelines but unfortunately we learnt that all his s= upposed next of kin or relation died alongside with him in the plane crash = leaving nobody behind for the claim.It is therefore upon this discovery tha= t I decided to make this business proposals to you and release the money to= you as next of kin or relation to the deceased for safety and subsequent d= isbursement since nobody is coming for it because I don't want this money t= o go into the bank treasury as unclaimed Bill. =3B
 =3BThe banki= ng law and guidelines here stipulates that if such money remains unclaimed = after five years=2C the money will be transferred into the bank treasury as= unclaimed fund.The request of foreigner in this transaction is necessary b= ecause our late customer was a foreigner and a Burkinabe cannot stand as ne= xt of kin to a foreigner=2CI agree that 30% of this money will be for you a= s foreigner partner in respect to the provision of a foreign account. 10% w= ill be set aside for expenses incurred during the business and 60% would be= for me =2C after which I shall visit your country for disbursement accordi= ng to the percentages indicated.Therefore to enable the immediate transfer = of this fund to you as I have arranged=2Cyou will furnished me with a good = receiving account details where the money will betransfered=2Cyour private = tel and fax number for easy communication.
Upon receipt of your reply= =2C I will send to you by fax or e-mail a text of the application which you= shall retype and fax to our foreign remittance manager=2Cfor easy executio= n of the transaction.I will not fail to bring to your notice that this tran= saction is 100% hitch-free on both side. As all required arrangement have b= een made for the transfer and more so all the documents backing this claim = will be supplied to you after you might have applied.
Please I would lik= e you you keep this transaction confidential and as a top secret as you may= wish to know that I am a senior Bank official.
 =3B
Trusting to = hear from you immediately.
Yours Sincerely=2C
Mr.Ali Ahmed
= --_cc47328e-60d9-4e65-a7a0-552f5cd98710_-- From chrisv@sns.nl Sat May 30 17:43:51 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ************* X-Spam-Status: Yes, score=13.9 required=5.0 tests=BAYES_99,EMAILBL_TEST_LEM, FORGED_MUA_OUTLOOK,J_CHICKENPOX_72,MILLIONS_01,MSOE_MID_WRONG_CASE, RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RBL_POXLAY_01 autolearn=disabled version=3.2.5 X-Spam-Report: * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9996] * 1.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.207.231.235 listed in dnsbl.sorbs.net] * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (chrisveenl[at]gmail.com) * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.6 J_CHICKENPOX_72 BODY: 7alpha-pock-2alpha * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from marciu.securemail19.com (marciu.securemail19.com [161.58.10.94]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n4V0hkWZ007095 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 30 May 2009 17:43:51 -0700 Received: from User ([196.207.231.235]) (authenticated bits=0) by marciu.securemail19.com (8.13.6.20060614/8.13.6) with ESMTP id n4UGnFtp077548; Sat, 30 May 2009 16:49:25 GMT Message-Id: <200905301649.n4UGnFtp077548@marciu.securemail19.com> Reply-To: From: "Chris V" To: chrisveenl@gmail.com Subject: [SPAM] Be advised accordingly Date: Sat, 30 May 2009 17:48:45 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Greylist: Delayed for 07:52:11 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sat, 30 May 2009 17:43:51 -0700 (PDT) X-Spam-Prev-Subject: Be advised accordingly Status: R X-Status: X-Keywords: X-UID: 391 Content-Length: 1503 MAIL REFERENCE: SNS/38493484/NL/09 BE ADVISED ACCORDINGLY. My previous mail was not responded to and found it necessary to write you once more regarding this subject matter. Be informed that our search revealed your last name to be same with a customer of the SNS Bank N.V. whom for some years we have not been able to trace any of his relatives. The benefit worth millions of dollars is overdue for payment. By virtue of my job as Head of Compensation and Benefits department, your last name can be accepted for a heir to this amount of money. You need not worry about the legal requirements as you shall be closely guided and directed on this. Due to the sensitive nature of this claim process,it in the best interest of success of this claim that you keep this to yourself for now unless informed otherwise. Kindly send to me your full names as stated in your drivers license or international passport and your mobile/cell phone number. Further details will be made available to you as soon at you respond to this mail. Sincerely yours Chris CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. Going contrary to this warning may be unlawful. From icpc.n1@gmail.com Sun May 31 20:00:16 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************************* X-Spam-Status: Yes, score=33.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_99,BL_COUNTRY_NG_2,EMAILBL_TEST_LEM,FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,HTML_MESSAGE,J_CHICKENPOX_37, J_CHICKENPOX_56,J_CHICKENPOX_73,L_SOME_STD_PROBS,MILLION_USD,MIME_HTML_ONLY, MISSING_HEADERS,PHISH_05,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RBL_PSBL_01,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL, RCVD_IN_SORBS_WEB,SARE_FRAUD_X3,SPF_NEUTRAL,STOX_30,SUBJ_ALL_CAPS autolearn=disabled version=3.2.5 X-Spam-Report: * 1.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [196.3.183.73 listed in dnsbl.sorbs.net] * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.5 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [196.3.183.73 listed in zen.spamhaus.org] * 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see ] * 2.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com * [196.3.183.73 listed in psbl.surriel.com] * 2.0 BL_COUNTRY_NG_2 Mail client in Nigeria * 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (icpc.nig0111[at]gmail.com) * 1.3 MISSING_HEADERS Missing To: header * 0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha * 1.5 MILLION_USD BODY: Talks about millions of dollars * 0.0 STOX_30 BODY: Stock market stuff - symbol * 0.2 PHISH_05 BODY: Phishing for account information * 0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha * 0.6 J_CHICKENPOX_56 BODY: 5alpha-pock-6alpha * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from FILESERVER.office.local (mail.cbho.org [71.83.246.122]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n512xcrT004354 for ; Sun, 31 May 2009 19:59:59 -0700 Received: from User ([196.3.183.73]) by FILESERVER.office.local with Microsoft SMTPSVC(6.0.3790.3959); Sun, 31 May 2009 19:39:31 -0700 Reply-To: From: "MR HANNATU RAJI" Subject: [SPAM] THE REAL TRUTH ABOUT YOUR FUNDS. Date: Sun, 31 May 2009 19:43:23 -0700 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: X-OriginalArrivalTime: 01 Jun 2009 02:39:34.0703 (UTC) FILETIME=[32FF3BF0:01C9E262] X-Greylist: Delayed for 00:15:06 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Sun, 31 May 2009 20:00:15 -0700 (PDT) X-Spam-Prev-Subject: THE REAL TRUTH ABOUT YOUR FUNDS. Status: R X-Status: X-Keywords: X-UID: 392 Content-Length: 19110
I am Mr Hannatu Raji. a computer scientist working with central bank of Nigeria.I just started work with C.B.N. and
I came across your file which was marked X and your released disk painted RED, I took time to study it and found out that you have paid VIRTUALLY all fees and but the fund was not released to you.
The most annoying thing is that they won't tell you the truth that on no account will they ever release the fund to you,instead they allow you spend money unnecessarily,I do not intend to work here all the days of my life, I can release this fund to you if you can certify me of my security.
I needed to do this because you need to know the statues of your Funds and cause for the delay,Please this is like a Mafia setting in Nigeria, you may not understand it because you are not a Nigerian.
The only thing needed to release this fund is the Anti drug/terrorist clearance certificate which will be tendered to any of your nominated bank and the INTERNAL REVENUE SERVICE(IRS)for clearance of the transfered amount in your account.
Once the Anti drug /terrorist clearance certificate is obtained funds will immediately reflect in your bank within 10 Minutes,the certificate is all that is needed to complete this transaction.
Note that the actual funds is valued at $15.5 MILLION USD and the president made a compensation fund release for all unpaid beneficiary valued at $10 million usd.
Listed below are the mafia's and banks behind the non release of your funds that i managed to sneak out for your kind persual.
1) Prof. Charles soludo
2) Senator David Mark
3) Chief Joseph Sanusi
4) Dr. R. Rasheed
5) Barrister Awele Ugorji
6) Mr Roland Ngwa
7) Barrister Ucheuzo Williams
8) Mr. Ernest Chukwudi Obi
9) Dr. Patrick Aziza
Deputy Governor - Policy / Board Member
10) Mr. Tunde Lemo
Deputy Governor - Financial Sector Surveillance / Board Member
11) Mrs. W. D. A. Mshelia
Deputy Governor - Corporate Services / Board Members
12) Mrs. Okonjo Iweala
13) Mrs. Rita Ekwesili
14) Barr Jacob Onyema
15) Dr. Godwin Oboh: Director Union Bank Of Nigeria.
16) Mr John Collins: Global Diplomat Director.
17) Foreign fund diplomatic courier
18) Barr. Becky Owens
19)Rev. Steven Jones
20) bank of Africa
21)Mrs. Debbie Hargrove
22)Mr. Micheal Wagner
23)Barr. Isa Farid
24)Dr. Raymond Faye
25)Ibraheem Fashola
26)Dr. Leslie Fawaz
27)Mercy Fajaroo
28)Walter K. Falana
29)Azeez Fatou
30)Ibrahim Fabumi
31)Daniel Faras
32)Micheal Faras
33)Minassa Fernandez
34)Viresh Fernando
35)Deacon Diende Fernandez
36)Ben Felix
37)Dr. Ige Femi
38)Chen Hsiu Fei
39)Gloria Festus
40)Lopez Fernando
41)Aloye Fidelis
42)Augusto Fish
43)Dr. Raymond Fingesi
44)Dr. Martin Fibu
45)Joseph Finn
46)Ogom Fidelis
47)Jennifer H. Fiedler
48)Dr. Jimmy Fowler
49)Robert Fortin
50)Dr. Sharon Forrest
51)Prince Michael Fofano
52)Sarah Fofano
53)Tony Foster
54)Dr. Koman Fofar
55)Samuel Fona
56)Grace Fona
57)Funmi Folorunso
58)Mike Franklin
59)Egbo Francois
60)George Freeman
61)Senator Jude Fred
62)Paul Frank
63)Dr. Francis Fregere
64)Walter Freer
65)Olu-Segun Fredrick
66)Justice Philip Francis
67)Raul Franco
68)Desmond Fred
69)Madu Frank
70)Rita Frank
71)Godwin Frank
72)Dr. J. Frances
73)Frank Francis
74)Derrick Frans
75)Kingsley Fred
76)Dr. Carlos Frederico
77)Dr Ola Funmilowo
78)Alan Fumbi
79)Vincent Fuso
80)Dr. John Fugar
81)William Funsho
82)Michael Funsho
83)Shahla Ghasemi
84)Ali-Reza Ghasemi
85)Martins Gambari
86)Jim Gallo
87)Paulo Gato
88)Ben Gafhar
89)Byron Gate
90)Arthur Gai
91)Shinder Gangar
92)Lopez Garvin
93)Abdul Gafah
94)Dr. Rufus Gaba
95)Alhaji Garba
96)Dr. Frank Gani
97)Brigadier Williams Gal
98)Egonna Duru Gal
99)Lucky Garbi
100)Sadique Gadaffi
101)Federick Ike Ganziri
102)Dr. Dennis Gavey
103)Jose Sanchez Garcia
104)Ahmed Gana
105)Jose A. Garcia
106)Major Archie Gates
107)Bavolleni Gallilo
108)Musa Galadima
109)Shehu Galadima
110)Barr. Imam Galadima
111)Barr. Jerry Galadima
112)Mustapha Gambo
113)Dr. Isah Gambo
114)Usman Gambo
115)Engr. Isaac Garuba
116)Alhani Azeez Garuba
117)Engr. Sule Garuba
118)Idris Garuba
119)Mustaph Garuba
120) ADB Bank Ouagadougou Burkinafaso
121) FSA UK
122) NATWEST BANK
123) ECO Bank
124) Credit Bank
125)Barr Greg Thompson
126)Mr Raymond Osaze icpc chairman.
Do get in touch with me immediately with my direct number +2348035619496 to conclude this final transaction immediately,and also send to me your convenient tel/fax numbers for easy communications.
Regards,
Mr Hannatu Raji
 From mikegoff@wildlifetechnical.com Wed Jun 3 00:39:41 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.4 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, BAYES_99,BL_COUNTRY_CN_1,BL_COUNTRY_CN_2,EMAILBL_TEST_LEM,FORGED_MUA_OUTLOOK, L_SOME_STD_PROBS,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,RBL_POXLAY_01,RCVD_IN_BRBL,RDNS_NONE,SARE_FRAUD_X3,SARE_FRAUD_X4, SARE_RECV_IP_061172,SPF_SOFTFAIL autolearn=disabled version=3.2.5 X-Spam-Report: * 1.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL * [61.172.245.60 listed in b.barracudacentral.org] * 1.0 RBL_POXLAY_01 RBL: Mail received from open proxy or relay * [97.82.166.78 listed in dnsbl.sorbs.net] * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.5 BL_COUNTRY_CN_1 RBL: Mail client in China * [61.172.245.60 listed in cn.countries.nerd.dk] * 1.7 SARE_RECV_IP_061172 Spam passed through possible spammer relay * 0.5 BL_COUNTRY_CN_2 Mail client in China * 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * 0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me. * (mikebeneth4[at]msn.com) * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.5 L_SOME_STD_PROBS At least two standards-compliance problems Received: from mail.bizmatch.com.cn ([61.172.245.60]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n537daYJ024784 for ; Wed, 3 Jun 2009 00:39:40 -0700 Received: from User ([97.82.166.78]) by mail.bizmatch.com.cn (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTPA id <0KGX005ECMGWWX20@mail.bizmatch.com.cn> for jhardin@impsec.org; Mon, 23 Mar 2009 07:57:19 +0800 (CST) Date: Sun, 22 Mar 2009 23:54:05 +0000 From: Mike Beneth Subject: [SPAM] Consignment delivery, need your assistance To: Undisclosed recipients: ; Reply-to: mikebeneth4@msn.com Message-id: <0KGX005EFMH3WX20@mail.bizmatch.com.cn> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Content-type: text/plain; charset=Windows-1251 Content-transfer-encoding: 8BIT X-Priority: 3 X-MSMail-priority: Normal X-Greylist: Delayed for 03:51:55 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 03 Jun 2009 00:39:41 -0700 (PDT) X-Spam-Prev-Subject: Consignment delivery, need your assistance Status: R X-Status: X-Keywords: X-UID: 393 Content-Length: 1233 Consignment delivery, need your assistance Dear Partner, Contact me urgently for a consignment transaction; a consignment was deposited in Global Security Company, Accra Ghana, for the past five years by our late customer who lost his life two years ago. Arrangement has been finalized for the claim of consignment No. 1401, containing $8. 2 Million. (Eight Million, Two Hundred Thousand) I will supply you with the papers that will facilitate your easy claim of the consignment; I will also furnish you with further details regarding the modus operandi for the execution of this transaction. You can reach me by my email and I will direct you on what to do. For further direction and success of this transaction l want you to forward your full name, contact address, ID, phone/fax number(s) for easy reach and execution of this transaction. Your details will be submitted to the head of department as the next of kin to our deceased customer who deposited the consignment five years ago. All action towards the success of this transaction will be finalized by both parties, if you agree to the success of this transaction please expedite action by contacting and providing details above. Yours faithfully, Mr. Mike Beneth From noreply@miller.com Wed Jun 17 03:46:18 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.9 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_60,BL_COUNTRY_FR_2,DATE_IN_PAST_96_XX,DEAR_FRIEND, FORGED_MUA_OUTLOOK,J_CHICKENPOX_74,MILLIONS_01,MILLION_USD, MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,STOX_30,SUBJ_ALL_CAPS,URG_BIZ,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 BL_COUNTRY_FR_2 Mail client in France * 1.7 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 1.6 URG_BIZ BODY: Contains urgent matter * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.0 STOX_30 BODY: Stock market stuff - symbol * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7968] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp2c.orange.fr (smtp2c.orange.fr [80.12.242.153]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n5HAkE8n005872 for ; Wed, 17 Jun 2009 03:46:17 -0700 Received: from smtp2c.orange.fr (mwinf2c06 [10.232.23.34]) by mwinf2c05.orange.fr (SMTP Server) with ESMTP id CC7991C01A42 for ; Wed, 17 Jun 2009 12:16:37 +0200 (CEST) Received: from User (CPE001320ad6bfb-CM001ceab5d90a.cpe.net.cable.rogers.com [99.250.94.183]) by mwinf2c06.orange.fr (SMTP Server) with ESMTP id 56B8B7000084; Wed, 17 Jun 2009 12:13:46 +0200 (CEST) X-ME-UUID: 20090617101348355.56B8B7000084@mwinf2c06.orange.fr Reply-To: From: "Mr. David Miller" To: drdavidmiller56@yahoo.com.hk Subject: [SPAM] INVESTMENT PROPOSAL Date: Sat, 17 Jan 2009 11:18:39 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090617101348.56B8B7000084@mwinf2c06.orange.fr> X-Greylist: Delayed for 00:29:34 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 17 Jun 2009 03:46:17 -0700 (PDT) X-Spam-Prev-Subject: INVESTMENT PROPOSAL Status: R X-Status: X-Keywords: X-UID: 394 Content-Length: 2257 Dear Friend, I write to you based on a request for an investment option in your country by a high profile clients of mine My name is Dr.David Miller, I'm a business developer in my Country.With the global economic crisis my client has some huge funds invested in a capital market which has depreciated so much and he quickly pull out the funds and deposited it with a financial institution so that he could wait until the global capital market regain its image and financial strength. you can read about it : http://www.thetimes.co.za/specialreports/TheGlobalEconomyCrisis/Default.aspx?id=438248 and http://www.cnn.com/2008/POLITICS/10/18/camp.david.meeting/index.html With this development my client contacted me so that as a successfull business developer with excellent track record, i could assist him make some increase with the deposited funds so that his lossess will not be much felt. With that I have urgently request your esteem personality to invest some fund amounting to US$35,000,000.00 (Thirty Five Million, United States Dollars)only into viable business in your country for my client. What he requested is an individual like you who is trustworthy,most reliable and should be willing to put this money to good use for a period of 30 months for a start.He is offering you these terms; 1) 5% will be paid to you as an administrator of the total fund to be managed. 2) The fund will be used by you as a foreign Administrator and reprofile the fund as a loan without any interest. That is, you are not expected to pay any interest on the money, but you will give him 50% of all profits after tax(PAT) that will accrue from the use of the fund. If you know you are very honest and these terms are accepted by you, then kindly and quickly let me know by furnishing me with the following information. 1) YOUR FULL NAMES AND ADDRESS. 2) HOME/OFFICE ADDRESS. 3) DIRECT HOME/OFFICE TELEPHONE LINES, CELL PHONES AND FAXES. 4) BUSINESS TYPE. 5) PRESENT POSITION OCCUPYING IN YOUR BUSINESS/OFFICE. As soon as I hear from you with details I shall provide you with all necessary information for immediate proceedings. Your prompt response will be appreciated.email me on drdavidmiller56@yahoo.com.hk Best Regards, Dr.David Miller From noreply@miller.com Wed Jun 17 03:46:18 2009 Return-Path: X-Spam-DCC: _DCCB_: _DCCR_ X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ga.impsec.org X-Spam-Level: ********************** X-Spam-Status: Yes, score=22.9 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3, ADVANCE_FEE_4,BAYES_60,BL_COUNTRY_FR_2,DATE_IN_PAST_96_XX,DEAR_FRIEND, FORGED_MUA_OUTLOOK,J_CHICKENPOX_74,MILLIONS_01,MILLION_USD, MSOE_MID_WRONG_CASE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100, RAZOR2_CHECK,STOX_30,SUBJ_ALL_CAPS,URG_BIZ,US_DOLLARS_3 autolearn=disabled version=3.2.5 X-Spam-Report: * 0.5 BL_COUNTRY_FR_2 Mail client in France * 1.7 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date * 2.1 SUBJ_ALL_CAPS Subject is all capitals * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 1.6 URG_BIZ BODY: Contains urgent matter * 1.5 MILLION_USD BODY: Talks about millions of dollars * 1.0 MILLIONS_01 BODY: Millions of dollars|pounds * 0.0 STOX_30 BODY: Stock market stuff - symbol * 2.7 DEAR_FRIEND BODY: Dear Friend? That's not very dear! * 0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha * 1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% * [score: 0.7968] * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) * 1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) * 0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) * 3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook Received: from smtp2c.orange.fr (smtp2c.orange.fr [80.12.242.153]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id n5HAkE8n005872 for ; Wed, 17 Jun 2009 03:46:17 -0700 Received: from smtp2c.orange.fr (mwinf2c06 [10.232.23.34]) by mwinf2c05.orange.fr (SMTP Server) with ESMTP id CC7991C01A42 for ; Wed, 17 Jun 2009 12:16:37 +0200 (CEST) Received: from User (CPE001320ad6bfb-CM001ceab5d90a.cpe.net.cable.rogers.com [99.250.94.183]) by mwinf2c06.orange.fr (SMTP Server) with ESMTP id 56B8B7000084; Wed, 17 Jun 2009 12:13:46 +0200 (CEST) X-ME-UUID: 20090617101348355.56B8B7000084@mwinf2c06.orange.fr Reply-To: From: "Mr. David Miller" To: drdavidmiller56@yahoo.com.hk Subject: [SPAM] INVESTMENT PROPOSAL Date: Sat, 17 Jan 2009 11:18:39 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20090617101348.56B8B7000084@mwinf2c06.orange.fr> X-Greylist: Delayed for 00:29:34 by milter-greylist-1.6 (ga.impsec.org [207.210.83.140]); Wed, 17 Jun 2009 03:46:17 -0700 (PDT) X-Spam-Prev-Subject: INVESTMENT PROPOSAL Status: R X-Status: X-Keywords: X-UID: 395 Content-Length: 2257 Dear Friend, I write to you based on a request for an investment option in your country by a high profile clients of mine My name is Dr.David Miller, I'm a business developer in my Country.With the global economic crisis my client has some huge funds invested in a capital market which has depreciated so much and he quickly pull out the funds and deposited it with a financial institution so that he could wait until the global capital market regain its image and financial strength. you can read about it : http://www.thetimes.co.za/specialreports/TheGlobalEconomyCrisis/Default.aspx?id=438248 and http://www.cnn.com/2008/POLITICS/10/18/camp.david.meeting/index.html With this development my client contacted me so that as a successfull business developer with excellent track record, i could assist him make some increase with the deposited funds so that his lossess will not be much felt. With that I have urgently request your esteem personality to invest some fund amounting to US$35,000,000.00 (Thirty Five Million, United States Dollars)only into viable business in your country for my client. What he requested is an individual like you who is trustworthy,most reliable and should be willing to put this money to good use for a period of 30 months for a start.He is offering you these terms; 1) 5% will be paid to you as an administrator of the total fund to be managed. 2) The fund will be used by you as a foreign Administrator and reprofile the fund as a loan without any interest. That is, you are not expected to pay any interest on the money, but you will give him 50% of all profits after tax(PAT) that will accrue from the use of the fund. If you know you are very honest and these terms are accepted by you, then kindly and quickly let me know by furnishing me with the following information. 1) YOUR FULL NAMES AND ADDRESS. 2) HOME/OFFICE ADDRESS. 3) DIRECT HOME/OFFICE TELEPHONE LINES, CELL PHONES AND FAXES. 4) BUSINESS TYPE. 5) PRESENT POSITION OCCUPYING IN YOUR BUSINESS/OFFICE. As soon as I hear from you with details I shall provide you with all necessary information for immediate proceedings. Your prompt response will be appreciated.email me on drdavidmiller56@yahoo.com.hk Best Regards, Dr.David Miller