micheal harrison, [email protected], western union

"Western union" offers you money? it's a scam!

Subject: Dear Customer
From: "WESTERN UNION" <[email protected]>
Date: Fr, 24.02.2012, 11:17
To: Undisclosed recipients:;
--------------------------------------------------------------------------

Dear Customer,

Please be informed that you have £50,000.00 (Fifty Thousand pound sterling) Lodged in our Western Union outlet in UK to be transferred to you as a Compensation.Contact Western Union Office.Note that you are to copy the email Address below and send your reply to the Office.

HERE IS THE CONTACT INFORMATION OF WESTERN UNION:MR. MICHEAL HARRISON EMAIL ADDRESS: [email protected]

header (I removed info referring to myself):

Return-Path: <[email protected]>
Received: from lmtpproxyd (jarvis.xxxxxxx [13xxxxx.112])
by lillian.xxxxx (Cyrus v2.4.12-xxx-1.2) with LMTPA;
Fri, 24 Feb 2012 11:17:24 +0100
X-Sieve: CMU Sieve 2.4
Received: from ray.xxxxxxx (ray.xxxxx [13xxxxx.100])
by jarvis.xxxxxx (Cyrus v2.4.12-xxxxx-1.2) with LMTPA;
Fri, 24 Feb 2012 11:17:23 +0100
Received: from vms173015pub.verizon.net ([206.46.173.15] helo=vms173015pub.verizon.net)
by ray.xxxxx with esmtp (Exim 4.77)
(envelope-from <[email protected]>)
id 1S0sDK-0004nm-2G; Fri, 24 Feb 2012 11:17:23 +0100
Received: from vznit170126 ([unknown] [172.18.12.132])
by vms173015.mailsrvcs.net
(Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
with ESMTPA id <[email protected]>; Fri,
24 Feb 2012 04:17:06 -0600 (CST)
Received: from 41.138.189.22 ([41.138.189.22]) by vznit170126 (Verizon Webmail)
with HTTP; Fri, 24 Feb 2012 04:17:04 -0600 (CST)
Received-SPF: pass (ray.xxxxx: domain of verizon.net designates 206.46.173.15 as permitted sender) client-ip=206.46.173.15; [email protected]; helo=vms173015pub.verizon.net;
Date: Fri, 24 Feb 2012 04:17:04 -0600 (CST)
From: WESTERN UNION <[email protected]>
Reply-to: [email protected]
Message-id: <30886531.1395121.1330078624893.JavaMail.root@vznit170126>
Subject: Dear Customer
MIME-version: 1.0
Content-type: text/html; charset=UTF-8
Content-transfer-encoding: quoted-printable
X-Mailer: Verizon Webmail
X-Originating-IP: [41.138.189.22]
To: Undisclosed recipients: ;
X-xxxx-DKIM-Check: [email protected] adsp:unknown result:none
X-DCC-Univie-Metrics: ray.xxxxx 32722; Body=160 Fuz1=160 Fuz2=160
X-xxxx-expurgate: clean
X-xxxx-Virus-Scan: scanned by ClamAV on ray.xxxxxxt
X-xxxx-Spam-Score: 2.7
X-xxxx-Spam-Score-Int: 27
X-xxxx-Spam-Level: ++
X-xxxx-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
ray.xxxxx
X-xxxx-Spam-Status: No, score=2.7, tests=HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,
LOTS_OF_MONEY,MIME_HTML_ONLY,RCVD_IN_BRBL_RELAY,RCVD_IN_DNSWL_NONE,
SINGLE_HEADER_2K,SPF_PASS,T_RP_MATCHES_RCVD
X-xxxx-Spam-Languages: en
X-xxxx-Spam-Relay-Countries: US ** XX XX
X-xxxx-Spam-Report: Content analysis details: (2.7 points)
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
* trust
* [206.46.173.15 listed in list.dnswl.org]
* 1.0 RCVD_IN_BRBL_RELAY RBL: received via a relay rated as poor by
* Barracuda
* [41.138.189.22 listed in b.barracudacentral.org]
* 0.0 SINGLE_HEADER_2K A single header contains 2K-3K characters
* -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
* domain
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
* 0.0 LOTS_OF_MONEY Huge... sums of money

IP 41.138.189.22 resolves to Lagos, Nigeria

greez,
the Clerk