Scams operating under the guise of a charity.
#225162 by Faizan Docherty Tue Oct 28, 2014 8:13 pm
ipTRACKERonline.com wrote:Header Analysis Quick Report
Originating IP: 213.136.121.182
Originating ISP: Cote D'ivoire Telecom
City: Abidjan
Country of Origin: Cote D'Ivoire
* For a complete report on this email header goto ipTRACKERonline


Delivered-To: <snipped>
Received: by 10.70.125.234 with SMTP id mt10csp525980pdb;
Tue, 28 Oct 2014 13:43:15 -0700 (PDT)
X-Received: by 10.69.31.74 with SMTP id kk10mr5745989pbd.119.1414528995370;
Tue, 28 Oct 2014 13:43:15 -0700 (PDT)
Return-Path: <[email protected]>
Received: from relay.mailchannels.net (tkt-001-i390.relay.mailchannels.net. [72.249.144.205])
by mx.google.com with ESMTP id qq6si2365273pbb.23.2014.10.28.13.43.13
for <snipped>;
Tue, 28 Oct 2014 13:43:15 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 72.249.144.205 as permitted sender) client-ip=72.249.144.205;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 72.249.144.205 as permitted sender) [email protected];
dkim=pass [email protected]
X-Sender-Id: _forwarded-from|183.79.150.95
Received: from r8-chicago.webserversystems.com (ip-10-213-14-133.us-west-2.compute.internal [10.213.14.133])
by relay.mailchannels.net (Postfix) with ESMTPA id 4A7A84C23
for <snipped>; Tue, 28 Oct 2014 20:43:11 +0000 (UTC)
X-Sender-Id: _forwarded-from|183.79.150.95
Received: from r8-chicago.webserversystems.com (r8-chicago.webserversystems.com [10.248.11.136])
(using TLSv1 with cipher DHE-RSA-AES256-SHA)
by 0.0.0.0:2500 (trex/5.3.2);
Tue, 28 Oct 2014 20:43:12 GMT
X-MC-Relay: Forwarding
X-MailChannels-SenderId: _forwarded-from|183.79.150.95
X-MailChannels-Auth-Id: wwwh
X-MC-Loop-Signature: 1414528991640:1350875443
X-MC-Ingress-Time: 1414528991521
Received: from web101608.mail.kks.yahoo.co.jp ([183.79.150.95]:47652)
by r8-chicago.webserversystems.com with smtp (Exim 4.82)
(envelope-from <[email protected]>)
id 1XjDbe-0004hZ-4q
for <snipped>; Tue, 28 Oct 2014 15:43:09 -0500
Received: (qmail 39122 invoked by uid 60001); 28 Oct 2014 20:43:01 -0000
DKIM-Signature: <snipped>
DomainKey-Signature: <snipped>;
Message-ID: <[email protected]>
X-YMail-OSG: <snipped>
Received: from [213.136.121.182] by web101608.mail.kks.yahoo.co.jp via HTTP; Wed, 29 Oct 2014 05:43:00 JST
X-Mailer: YahooMailWebService/0.8.111_56
X-YMail-JAS: <snipped>
Date: Wed, 29 Oct 2014 05:43:00 +0900 (JST)
From: Juliet Timothy kone <[email protected]>
Reply-To: Juliet Timothy kone <[email protected]>
Subject: Hello Respect, This mail is from Red Cross International Federations Office Malaysian /Asia. The reason of contacting you is because FedEx Company delivered a wrong Parcel to our address 2 days ago but the parcel contains your name and your email address as the owner. Please Clarify us, Are you the original owner of this parcel? and we don't know the real contains yet. Thanks. Mrs Mrs Juliet Timothy K (Director). Dr Mohammad Abu Bakar ( Assistant Director). Red Cross International Federations. 308, Jalan Tun Razak, 50400 Kuala Lumpur/ Malaysia. Telephone: +603 2381 346
To: "[email protected]" <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-242711461-1333414505-1414528980=:16245"
X-Spam-Status: No, score=3.5
X-Spam-Score: 35
X-Spam-Bar: +++
X-Ham-Report: Spam detection software, running on the system "r8-chicago.webserversystems.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: [...]

Content analysis details: (3.5 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[183.79.150.95 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(valasca001[at]yahoo.co.jp)
0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[213.136.121.182 listed in dnsbl.sorbs.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.6 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (valasca001[at]yahoo.co.jp)
0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 0.9996]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
2.0 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
X-Spam-Flag: NO
X-AuthUser:


No message in the email body.

Please DO NOT tell a scammer that he has been posted here!

If you wish you can email me at
faizandocherty @ scamwarners [dot] com

How do I find email headers???

How to analyze an email header.
Advertisement

Who is online

Users browsing this forum: No registered users and 7 guests