by buried under 419s
Return-path: <>
Envelope-to:
Delivery-date: Sat, 24 Oct 2015 11:13:48 -0700
Received: from mail-ma1ind01hn0225.outbound.protection.outlook.com ([104.47.100.225]:64327 helo=IND01-MA1-obe.outbound.protection.outlook.com)
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.80)
id 1Zq3K7-0000q4-IV
for ; Sat, 24 Oct 2015 11:13:48 -0700
Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=<>;
Received: from [100.76.98.225] (123.239.174.172) by
PN1PR01MB0480.INDPRD01.PROD.OUTLOOK.COM (10.164.141.138) with Microsoft SMTP
Server (TLS) id 15.1.306.13; Sat, 24 Oct 2015 18:26:31 +0000
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
To: Recipients
From: <>
Date: Sat, 24 Oct 2015 13:26:06 -0500
Reply-To: <[email protected]>
X-Originating-IP: [123.239.174.172]
X-ClientProxiedBy: MAXPR01CA0024.INDPRD01.PROD.OUTLOOK.COM (25.164.147.31) To
PN1PR01MB0480.INDPRD01.PROD.OUTLOOK.COM (25.164.141.138)
Message-ID: <PN1PR01MB0480FB0B140B106521670CD2B8250@PN1PR01MB0480.INDPRD01.PROD.OUTLOOK.COM>
X-Microsoft-Exchange-Diagnostics: 1;PN1PR01MB0480;2:oPg85htqZYbK2iGAQsiJTX4Bw/a2uloYlMi00k9HYNLwczqofF5c5ngfyntjXNRrYIdk+/Fn0A1GfRlDoFg54XwyD3aWuzM4GzVofFYqAizA1EkF8yCsqpJ5sT7ekis+dx/bLy7/+5nME4yhPKZjeFMlsTAd4642+Wc9Ypi9czk=;3:3x/pGaTG8IG9K3I14CoQ9a/DjzFJFESl4AF5mBKgoGmrFZOmtQYwhCvGe3Awh2MCU+WYOPgzajYt4jNsBGMQP6dFFxi22PFlpgW7PZQEVBt/HcZMhjKCrUTz0yg33E+UpBckjHPSDGIJHhutWe0dFw==;25:z1GPRZOXrRqysbEqdjwH3vozmJbcCBhEzQ8eHilv6IjYW6pd1Qfu2tcCX0NPALmmps6+6oyGWmNcAzDiTPUkxbN98bt8kz6Y3guzs508Vs5MnPy6XJ/cosHHXzqetdIKLeO3ml5HUg/Rdp1vzC5rQTp7WHJ5311PsMfVSEnELP77g8r/GVILoHsnIPm+H6L9rDBjAs7SYhRwm5eqD+4S3ZjDgDb2I/nc2qeXf9QT3IcWUbsT/95tlKQm1z4uovg1
X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:PN1PR01MB0480;
X-Microsoft-Antispam-PRVS: <PN1PR01MB0480C4BEAC859F0AEA79C639B8250@PN1PR01MB0480.INDPRD01.PROD.OUTLOOK.COM>
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(2401047)(5005006)(8121501046)(520078)(3002001)(102215026)(6004014)(6003046);SRVR:PN1PR01MB0480;BCL:0;PCL:0;RULEID:;SRVR:PN1PR01MB0480;
X-Microsoft-Exchange-Diagnostics: 1;PN1PR01MB0480;4:LyjOum9rgZtD1kM0wKBOB4fQ/oj7OqkXZq6eB+Aom0q3nucIh/JBO1Wg30gCZpzWO4B5HMFBpwlw5RiGUCg1vy5HlNN13CqvviAI1jIPRaCked5w3PgrgB1fonsDMC5JI1yeemLHugJZofudi7SM8Z1tdn9yqZsiIXe1CMXLgGrTHqbKe/rBA9EpvevBINA0fKFnO/chCjbVepykPZPhnggUTEioKBXDRIbZqVpZKjKzonfTfK+PNQyxDFk2O9kqqlH6KYeuz5DoYPdK6nnAxb9UUqqYtWIZrTQwoe40yOKgxgn/Lqd+RjDXSpTOZey6IGMU4uPLcsIWIdkPcImjy0SoCLlm6rq0T7AY/9NfpekjKG3t7T/kwJBIqcp2YzM9fPSX0vGo05wgNoB/RoyZpw==;23:Cyhyx136UyQvxJmUOPEERAm/kKeU9cH/F6uxKBkXBIHxtCjKVgRFBMtnzaAcxngF3HfMBaX1W6QK6TjvqpccS7rmrNoBb564rE2oIcx5sYnkr6TJeFugAJD5rP5wFyrOqStH3nEQydkwdeV4KHbuAXV8Uyw0vfdN+XyyL+cTcNFQxiImcfmHVrlptgT/w7z8fldXT9NS35NVMoaAxLxr7BkVdZkJX+OGqIeYl70X1OAM4jwZM5rwut0rQxqPM3r1;5:ReNEwnP3yLekV3Uhlhm/L2vGi/uMGmI0gpsbsZNyEjteaWN/D5dUldd5V8SeMNqkRw0Pk1KM36/hGSSaBTRqx8iutSEqRT3mvXsXUBT58g9x+r5gGdCsaz10PRdbBl52qzuIzBKQzbt5mV1t20tljA==;24:7p0aHX7m7Vpj0vSIyOiiex2yUqZmTVs1f9dh/czrvZ+uXHITA87WQS3Oky6fjuJlU2aBnoJGqj4l6OeRAaD3Sw==
X-Forefront-PRVS: 073966E86B
X-Forefront-Antispam-Report: SFV:SPM;SFS:(10009020)(6049001)(6009001)(5005620100007);DIR:OUT;SFP:1501;SCL:9;SRVR:PN1PR01MB0480;H:[100.76.98.225];FPR:;SPF:None;PTR:InfoNoRecords;LANG:en;
Received-SPF: None (protection.outlook.com: [100.76.98.225] does not designate
permitted sender hosts)
SpamDiagnosticOutput: 1:22
SpamDiagnosticMetadata: 00000000%2D0000%2D0000%2D0000%2D000000000000
X-Microsoft-Exchange-Diagnostics: 1;PN1PR01MB0480;20:llubwJzm5W7HteBIScIU1EtELFZy/FWpOW6qi+v+Uc0wtNoPUN0cYnQgzrwVwsD3tzee5TkuruzkWLi3iuzZMA==
X-OriginatorOrg: sdfghjdrfgh.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Oct 2015 18:26:31.2428
(UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PN1PR01MB0480
X-Spam-Status: Yes, score=9.2
X-Spam-Score: 92
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello My Dearest One. I will need your help in this situation
I find myself, Am really afraid and i don't know who to confide in. Am Jamela
Hassan, I have some amount of money with me that my late father left for
me. I have kept it as secret for a little while and I need someone I can trust
to work and transfer this money out of SYRIA as a medical documents. Please
I will need your help on this for I can forfeit 30 percent of this money
to make sure is safely used for me until I will be living the doctor this
year. Please I will need to work with you in getting this money out of SYRIA,
Get back to me and I will make the arrangement on how to get this done. I
have no one to confide in, I joined the NATO as a Medical Doctor and don't
have someone to confide in I believe you will be of helpful to me. I will
be reviling the said amount immediately you give me your word of confidence
to go ahead for this is a very huge amount of money. Expecting your reply
soonest for time is not on my side. [...]
Content analysis details: (9.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.1 TO_MALFORMED To: has a malformed address
0.8 FROM_NO_USER From: has no local-part before @ sign
0.5 AXB_X_FF_SEZ_S Forefront sez this is spam
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[104.47.100.225 listed in list.dnswl.org]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[104.47.100.225 listed in bb.barracudacentral.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4475]
2.0 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** CAN I TRUST YOU!
Hello My Dearest One.
I will need your help in this situation I find myself, Am really afraid and i don't know who to confide in. Am Jamela Hassan, I have some amount of money with me that my late father left for me. I have kept it as secret for a little while and I need someone I can trust to work and transfer this money out of SYRIA as a medical documents. Please I will need your help on this for I can forfeit 30 percent of this money to make sure is safely used for me until I will be living the doctor this year. Please I will need to work with you in getting this money out of SYRIA, Get back to me and I will make the arrangement on how to get this done. I have no one to confide in, I joined the NATO as a Medical Doctor and don't have someone to confide in I believe you will be of helpful to me. I will be reviling the said amount immediately you give me your word of confidence to go ahead for this is a very huge amount of money. Expecting your reply soonest for time is not on my side.
Best Regards
Miss. Jamela Hassan.
Envelope-to:
Delivery-date: Sat, 24 Oct 2015 11:13:48 -0700
Received: from mail-ma1ind01hn0225.outbound.protection.outlook.com ([104.47.100.225]:64327 helo=IND01-MA1-obe.outbound.protection.outlook.com)
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.80)
id 1Zq3K7-0000q4-IV
for ; Sat, 24 Oct 2015 11:13:48 -0700
Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=<>;
Received: from [100.76.98.225] (123.239.174.172) by
PN1PR01MB0480.INDPRD01.PROD.OUTLOOK.COM (10.164.141.138) with Microsoft SMTP
Server (TLS) id 15.1.306.13; Sat, 24 Oct 2015 18:26:31 +0000
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
To: Recipients
From: <>
Date: Sat, 24 Oct 2015 13:26:06 -0500
Reply-To: <[email protected]>
X-Originating-IP: [123.239.174.172]
X-ClientProxiedBy: MAXPR01CA0024.INDPRD01.PROD.OUTLOOK.COM (25.164.147.31) To
PN1PR01MB0480.INDPRD01.PROD.OUTLOOK.COM (25.164.141.138)
Message-ID: <PN1PR01MB0480FB0B140B106521670CD2B8250@PN1PR01MB0480.INDPRD01.PROD.OUTLOOK.COM>
X-Microsoft-Exchange-Diagnostics: 1;PN1PR01MB0480;2:oPg85htqZYbK2iGAQsiJTX4Bw/a2uloYlMi00k9HYNLwczqofF5c5ngfyntjXNRrYIdk+/Fn0A1GfRlDoFg54XwyD3aWuzM4GzVofFYqAizA1EkF8yCsqpJ5sT7ekis+dx/bLy7/+5nME4yhPKZjeFMlsTAd4642+Wc9Ypi9czk=;3:3x/pGaTG8IG9K3I14CoQ9a/DjzFJFESl4AF5mBKgoGmrFZOmtQYwhCvGe3Awh2MCU+WYOPgzajYt4jNsBGMQP6dFFxi22PFlpgW7PZQEVBt/HcZMhjKCrUTz0yg33E+UpBckjHPSDGIJHhutWe0dFw==;25:z1GPRZOXrRqysbEqdjwH3vozmJbcCBhEzQ8eHilv6IjYW6pd1Qfu2tcCX0NPALmmps6+6oyGWmNcAzDiTPUkxbN98bt8kz6Y3guzs508Vs5MnPy6XJ/cosHHXzqetdIKLeO3ml5HUg/Rdp1vzC5rQTp7WHJ5311PsMfVSEnELP77g8r/GVILoHsnIPm+H6L9rDBjAs7SYhRwm5eqD+4S3ZjDgDb2I/nc2qeXf9QT3IcWUbsT/95tlKQm1z4uovg1
X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:PN1PR01MB0480;
X-Microsoft-Antispam-PRVS: <PN1PR01MB0480C4BEAC859F0AEA79C639B8250@PN1PR01MB0480.INDPRD01.PROD.OUTLOOK.COM>
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(2401047)(5005006)(8121501046)(520078)(3002001)(102215026)(6004014)(6003046);SRVR:PN1PR01MB0480;BCL:0;PCL:0;RULEID:;SRVR:PN1PR01MB0480;
X-Microsoft-Exchange-Diagnostics: 1;PN1PR01MB0480;4:LyjOum9rgZtD1kM0wKBOB4fQ/oj7OqkXZq6eB+Aom0q3nucIh/JBO1Wg30gCZpzWO4B5HMFBpwlw5RiGUCg1vy5HlNN13CqvviAI1jIPRaCked5w3PgrgB1fonsDMC5JI1yeemLHugJZofudi7SM8Z1tdn9yqZsiIXe1CMXLgGrTHqbKe/rBA9EpvevBINA0fKFnO/chCjbVepykPZPhnggUTEioKBXDRIbZqVpZKjKzonfTfK+PNQyxDFk2O9kqqlH6KYeuz5DoYPdK6nnAxb9UUqqYtWIZrTQwoe40yOKgxgn/Lqd+RjDXSpTOZey6IGMU4uPLcsIWIdkPcImjy0SoCLlm6rq0T7AY/9NfpekjKG3t7T/kwJBIqcp2YzM9fPSX0vGo05wgNoB/RoyZpw==;23:Cyhyx136UyQvxJmUOPEERAm/kKeU9cH/F6uxKBkXBIHxtCjKVgRFBMtnzaAcxngF3HfMBaX1W6QK6TjvqpccS7rmrNoBb564rE2oIcx5sYnkr6TJeFugAJD5rP5wFyrOqStH3nEQydkwdeV4KHbuAXV8Uyw0vfdN+XyyL+cTcNFQxiImcfmHVrlptgT/w7z8fldXT9NS35NVMoaAxLxr7BkVdZkJX+OGqIeYl70X1OAM4jwZM5rwut0rQxqPM3r1;5:ReNEwnP3yLekV3Uhlhm/L2vGi/uMGmI0gpsbsZNyEjteaWN/D5dUldd5V8SeMNqkRw0Pk1KM36/hGSSaBTRqx8iutSEqRT3mvXsXUBT58g9x+r5gGdCsaz10PRdbBl52qzuIzBKQzbt5mV1t20tljA==;24:7p0aHX7m7Vpj0vSIyOiiex2yUqZmTVs1f9dh/czrvZ+uXHITA87WQS3Oky6fjuJlU2aBnoJGqj4l6OeRAaD3Sw==
X-Forefront-PRVS: 073966E86B
X-Forefront-Antispam-Report: SFV:SPM;SFS:(10009020)(6049001)(6009001)(5005620100007);DIR:OUT;SFP:1501;SCL:9;SRVR:PN1PR01MB0480;H:[100.76.98.225];FPR:;SPF:None;PTR:InfoNoRecords;LANG:en;
Received-SPF: None (protection.outlook.com: [100.76.98.225] does not designate
permitted sender hosts)
SpamDiagnosticOutput: 1:22
SpamDiagnosticMetadata: 00000000%2D0000%2D0000%2D0000%2D000000000000
X-Microsoft-Exchange-Diagnostics: 1;PN1PR01MB0480;20:llubwJzm5W7HteBIScIU1EtELFZy/FWpOW6qi+v+Uc0wtNoPUN0cYnQgzrwVwsD3tzee5TkuruzkWLi3iuzZMA==
X-OriginatorOrg: sdfghjdrfgh.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Oct 2015 18:26:31.2428
(UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PN1PR01MB0480
X-Spam-Status: Yes, score=9.2
X-Spam-Score: 92
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello My Dearest One. I will need your help in this situation
I find myself, Am really afraid and i don't know who to confide in. Am Jamela
Hassan, I have some amount of money with me that my late father left for
me. I have kept it as secret for a little while and I need someone I can trust
to work and transfer this money out of SYRIA as a medical documents. Please
I will need your help on this for I can forfeit 30 percent of this money
to make sure is safely used for me until I will be living the doctor this
year. Please I will need to work with you in getting this money out of SYRIA,
Get back to me and I will make the arrangement on how to get this done. I
have no one to confide in, I joined the NATO as a Medical Doctor and don't
have someone to confide in I believe you will be of helpful to me. I will
be reviling the said amount immediately you give me your word of confidence
to go ahead for this is a very huge amount of money. Expecting your reply
soonest for time is not on my side. [...]
Content analysis details: (9.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.1 TO_MALFORMED To: has a malformed address
0.8 FROM_NO_USER From: has no local-part before @ sign
0.5 AXB_X_FF_SEZ_S Forefront sez this is spam
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[104.47.100.225 listed in list.dnswl.org]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[104.47.100.225 listed in bb.barracudacentral.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4475]
2.0 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** CAN I TRUST YOU!
Hello My Dearest One.
I will need your help in this situation I find myself, Am really afraid and i don't know who to confide in. Am Jamela Hassan, I have some amount of money with me that my late father left for me. I have kept it as secret for a little while and I need someone I can trust to work and transfer this money out of SYRIA as a medical documents. Please I will need your help on this for I can forfeit 30 percent of this money to make sure is safely used for me until I will be living the doctor this year. Please I will need to work with you in getting this money out of SYRIA, Get back to me and I will make the arrangement on how to get this done. I have no one to confide in, I joined the NATO as a Medical Doctor and don't have someone to confide in I believe you will be of helpful to me. I will be reviling the said amount immediately you give me your word of confidence to go ahead for this is a very huge amount of money. Expecting your reply soonest for time is not on my side.
Best Regards
Miss. Jamela Hassan.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
