by Clerk of Oxenford
Hi all,
lottery scam, appears to originate in the netherlands.
best,
the clerk
text:
header:
Return-Path: <[email protected]>
Received: from lmtpproxyd (jarvis.xxx.xx [131.130.3.112])
by lauren.xxxx.xx (Cyrus v2.3.16-xxx-1.1) with LMTPA;
Sun, 02 Oct 2011 02:58:35 +0200
X-Sieve: CMU Sieve 2.3
Received: from roger.xxx.xx (roger.xxx.xx [131.130.3.102])
by jarvis.xxx.xx (Cyrus v2.4.11-xxx-1.6) with LMTPA;
Sun, 02 Oct 2011 02:58:35 +0200
Received: from smtp-10.smtp.ucla.edu ([2607:f010:3fe:102
23ff:fec1:5389] helo=out-52.smtp.ucla.edu)
by roger.xxx.xx with esmtp (Exim 4.76)
(envelope-from <[email protected]>)
id 1RAAO1-0001hq-Jj
for xxxx@xxx.xx; Sun, 02 Oct 2011 02:58:34 +0200
Received: from smtp-10.smtp.ucla.edu (smtp-10.smtp.ucla.edu [169.232.46.246])
by out-52.smtp.ucla.edu with ESMTP id p920XOMV010404;
Sat, 01 Oct 2011 17:33:25 -0700
Received: from mail.ucla.edu (mail.ucla.edu [169.232.46.157])
by smtp-10.smtp.ucla.edu (8.14.3/8.14.3) with ESMTP id p920XOMV010404;
Sat, 1 Oct 2011 17:33:24 -0700
Received: from nn-f7904ca626.Belkin (dhcp-095-096-160-218.chello.nl [95.96.160.218])
(user=swestin mech=PLAIN bits=0)
by mail.ucla.edu (8.14.4/8.14.4) with ESMTP id p920Tr2Y029990
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
Sat, 1 Oct 2011 17:33:20 -0700
Received-SPF: pass (roger.xxx.xx: domain of evergreen.nl designates 2607:f010:3fe:10223ff:fec1:5389 as permitted sender) client-ip=2607:f010:3fe:10223ff:fec1:5389; envelope-from=[email protected]; helo=out-52.smtp.ucla.edu;
Message-Id: <[email protected]>
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Postcode Announcement
To: Recipients <[email protected]>
From: [email protected]
Date: Sun, 02 Oct 2011 02:33:06 +0200
Reply-To: [email protected]
X-Probable-Spam: no
X-Spam-Hits: 2.534
X-Spam-Score: ***
X-Spam-Report: DCC_CHECK,SPF_PASS,US_DOLLARS_3
X-Scanned-By: smtp.ucla.edu on 169.232.46.246
X-xxx-DKIM-Check: [email protected] adsp:unknown result:none
X-DCC-xxx-Metrics: roger.xxx.xx 32724; Body=100063 Fuz1=100063 Fuz2=100063
X-xxx-expurgate: spam
X-xxx-Virus-Scan: scanned by ClamAV on roger.xxx.xx
X-xxx-Spam-Score: 12.6
X-xxx-Spam-Score-Int: 126
X-xxx-Spam-Level: ++++++++++++
X-xxx-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
roger.xxx.xx
X-xxx-Spam-Status: Yes, score=12.6, tests=ADVANCE_FEE_2_NEW_MONEY,
LOTS_OF_MONEY,MONEY_LOTTERY,NIXSPAM_IXHASH,SPF_PASS,US_DOLLARS_3,
ZIDDCC_BODY_HIGH,ZIDDCC_FUZ1_HIGH,ZIDDCC_FUZ2_HIGH,ZIDEXPURGATE,ZIDGREY
X-xxx-Spam-Languages: en
X-xxx-Spam-Relay-Countries: XX US US NL
X-xxx-Spam-Report: Content analysis details: (12.6 points)
* 3.5 ZIDEXPURGATE eXpurgate thinks this mail is spam
* -0.0 SPF_PASS SPF: sender matches SPF record
* 2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
* 2.0 NIXSPAM_IXHASH BODY: iXhash says its spam
* 1.5 ZIDDCC_FUZ2_HIGH DCC fuz2 count reached threshold
* 1.0 ZIDDCC_FUZ1_HIGH DCC fuz1 count reached threshold
* 0.0 LOTS_OF_MONEY Huge... sums of money
* 1.0 ZIDDCC_BODY_HIGH DCC body count reached threshold
* 0.0 MONEY_LOTTERY Lots of money from a lottery
* 0.0 ZIDGREY greylisting triggered
* 1.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-xxx-Spam-Flag: YES
iptracker:
* 95.96.160.218 UPC NL Nijmegen Netherlands
lottery scam, appears to originate in the netherlands.
best,
the clerk
text:
We are pleased to inform you of the final announcement of
postcode online promo programme you have won $1,000,000.00
dollars from postcode casino international. NL urgenly get
to the below contact immediately for your claim.
****************************************************
Customer Address:
Customer Full Name:
Customer Contact Numbers:
Tell : +31-686-142-655
Fax : +31-847-367-971
Email: [email protected]
****************************************************
Lucky Number: 6459/9734/5725: Ref Number: ES/8657/6897/7698:
Sincerely Yours,
Contact: Dr. Johannes Beugels.
Mrs. Caroline Tensen (Public Relation Officer)
De Lotto (Official Website: http://www. postcodeloterij .nl) [spacing in url mine]
Tel: 0900-0202 ( 0, 20 p/min.)
header:
Return-Path: <[email protected]>
Received: from lmtpproxyd (jarvis.xxx.xx [131.130.3.112])
by lauren.xxxx.xx (Cyrus v2.3.16-xxx-1.1) with LMTPA;
Sun, 02 Oct 2011 02:58:35 +0200
X-Sieve: CMU Sieve 2.3
Received: from roger.xxx.xx (roger.xxx.xx [131.130.3.102])
by jarvis.xxx.xx (Cyrus v2.4.11-xxx-1.6) with LMTPA;
Sun, 02 Oct 2011 02:58:35 +0200
Received: from smtp-10.smtp.ucla.edu ([2607:f010:3fe:102
23ff:fec1:5389] helo=out-52.smtp.ucla.edu)by roger.xxx.xx with esmtp (Exim 4.76)
(envelope-from <[email protected]>)
id 1RAAO1-0001hq-Jj
for xxxx@xxx.xx; Sun, 02 Oct 2011 02:58:34 +0200
Received: from smtp-10.smtp.ucla.edu (smtp-10.smtp.ucla.edu [169.232.46.246])
by out-52.smtp.ucla.edu with ESMTP id p920XOMV010404;
Sat, 01 Oct 2011 17:33:25 -0700
Received: from mail.ucla.edu (mail.ucla.edu [169.232.46.157])
by smtp-10.smtp.ucla.edu (8.14.3/8.14.3) with ESMTP id p920XOMV010404;
Sat, 1 Oct 2011 17:33:24 -0700
Received: from nn-f7904ca626.Belkin (dhcp-095-096-160-218.chello.nl [95.96.160.218])
(user=swestin mech=PLAIN bits=0)
by mail.ucla.edu (8.14.4/8.14.4) with ESMTP id p920Tr2Y029990
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
Sat, 1 Oct 2011 17:33:20 -0700
Received-SPF: pass (roger.xxx.xx: domain of evergreen.nl designates 2607:f010:3fe:102
23ff:fec1:5389 as permitted sender) client-ip=2607:f010:3fe:10223ff:fec1:5389; envelope-from=[email protected]; helo=out-52.smtp.ucla.edu;Message-Id: <[email protected]>
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Postcode Announcement
To: Recipients <[email protected]>
From: [email protected]
Date: Sun, 02 Oct 2011 02:33:06 +0200
Reply-To: [email protected]
X-Probable-Spam: no
X-Spam-Hits: 2.534
X-Spam-Score: ***
X-Spam-Report: DCC_CHECK,SPF_PASS,US_DOLLARS_3
X-Scanned-By: smtp.ucla.edu on 169.232.46.246
X-xxx-DKIM-Check: [email protected] adsp:unknown result:none
X-DCC-xxx-Metrics: roger.xxx.xx 32724; Body=100063 Fuz1=100063 Fuz2=100063
X-xxx-expurgate: spam
X-xxx-Virus-Scan: scanned by ClamAV on roger.xxx.xx
X-xxx-Spam-Score: 12.6
X-xxx-Spam-Score-Int: 126
X-xxx-Spam-Level: ++++++++++++
X-xxx-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
roger.xxx.xx
X-xxx-Spam-Status: Yes, score=12.6, tests=ADVANCE_FEE_2_NEW_MONEY,
LOTS_OF_MONEY,MONEY_LOTTERY,NIXSPAM_IXHASH,SPF_PASS,US_DOLLARS_3,
ZIDDCC_BODY_HIGH,ZIDDCC_FUZ1_HIGH,ZIDDCC_FUZ2_HIGH,ZIDEXPURGATE,ZIDGREY
X-xxx-Spam-Languages: en
X-xxx-Spam-Relay-Countries: XX US US NL
X-xxx-Spam-Report: Content analysis details: (12.6 points)
* 3.5 ZIDEXPURGATE eXpurgate thinks this mail is spam
* -0.0 SPF_PASS SPF: sender matches SPF record
* 2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
* 2.0 NIXSPAM_IXHASH BODY: iXhash says its spam
* 1.5 ZIDDCC_FUZ2_HIGH DCC fuz2 count reached threshold
* 1.0 ZIDDCC_FUZ1_HIGH DCC fuz1 count reached threshold
* 0.0 LOTS_OF_MONEY Huge... sums of money
* 1.0 ZIDDCC_BODY_HIGH DCC body count reached threshold
* 0.0 MONEY_LOTTERY Lots of money from a lottery
* 0.0 ZIDGREY greylisting triggered
* 1.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-xxx-Spam-Flag: YES
iptracker:
* 95.96.160.218 UPC NL Nijmegen Netherlands
