Mr. & Mrs. Colin Weir <[email protected]>

[Faizan Docherty]

This scammer put his message in the subject line of the email to avoid possible spam filters.

Header Analysis Quick Report<br>Originating IP: 157.56.236.5<br>Originating ISP: Microsoft Corporation<br> City: Redmond<br>Country of Origin: United States<br>* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.227.64.193 with SMTP id f1csp43811wbi;
Fri, 20 Dec 2013 01:04:16 -0800 (PST)
X-Received: by 10.180.206.11 with SMTP id lk11mr6483865wic.16.1387530256264;
Fri, 20 Dec 2013 01:04:16 -0800 (PST)
Return-Path: <[email protected]>
Received: from emea01-am1-obe.outbound.protection.outlook.com (emea01-am1-ndr.ptr.protection.outlook.com. [157.56.116.104])
by mx.google.com with ESMTPS id z2si2943633wix.53.2013.12.20.01.04.08
for <multiple recipients>
(version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Fri, 20 Dec 2013 01:04:16 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 157.56.116.104 as permitted sender) client-ip=157.56.116.104;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 157.56.116.104 as permitted sender) smtp.mail=[email protected]
Received: from BY2PRD0310HT001.namprd03.prod.outlook.com (157.56.236.5) by
AMXPR01MB070.eurprd01.prod.exchangelabs.com (10.255.255.154) with Microsoft
SMTP Server (TLS) id 15.0.851.11; Fri, 20 Dec 2013 09:04:07 +0000
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Re: Mr. & Mrs. Colin Weir made a donation of 750,
000.00 USD to you.contact immediately for more details.
To: Recipients <[email protected]>
From: Mr.& Mrs.Colin Weir <[email protected]>
Date: Fri, 20 Dec 2013 14:33:27 +0530
Reply-To: <[email protected]>
Message-ID: <97d0c7b3-a026-45a3-9771-1d8d9ad68c68@AMXPR01MB070.eurprd01.prod.exchangelabs.com>
Return-Path: [email protected]
X-Originating-IP: [157.56.236.5]
X-ClientProxiedBy: DB4PR01CA018.eurprd01.prod.exchangelabs.com
(10.242.152.48) To AMXPR01MB070.eurprd01.prod.exchangelabs.com
(10.255.255.154)
X-Forefront-PRVS: 0066D63CE6
X-Forefront-Antispam-Report: SFV:SPM;SFS:(10009001)(189002)(199002)(50986001)(74876001)(33646001)(46102001)(76176001)(74706001)(50466002)(47976001)(49866001)(4396001)(74316001)(47736001)(74366001)(76482001)(77096001)(51856001)(555874004)(558084003)(42186004)(54356001)(63696002)(81542001)(81342001)(47776003)(64872005)(79102001)(54316002)(23756003)(223583001)(83322001)(65816001)(80976001)(66066001)(80022001)(81816001)(31686002)(81686001)(89136003)(87266001)(85306002)(74662001)(74502001)(47446002)(85852003)(43066001)(77982001)(59766001)(87976001)(53256004)(76796001)(76786001)(90146001)(69226001)(83072002)(56776001)(56816005)(62346011);DIR:OUT;SFP:1501;SCL:5;SRVR:AMXPR01MB070;H:BY2PRD0310HT001.namprd03.prod.outlook.com;CLIP:157.56.236.5;FPR:;RD:InfoNoRecords;MX:1;A:0;LANG:en;
X-OriginatorOrg: donation191.onmicrosoft.com

my message...

[Wiljames]

New email address, same old scam:

On Mon, Nov 3, 2014 at 1:11 AM, Aswin Promsopa <[email protected]> wrote:

My wife and I have awarded you with a donation of $ 1.5 million Dollars from part of our Jackpot Lottery of 161,653,000 Million Pounds, send your name, address, phone to ([email protected]) for claims

View http://www.bbc.co.uk/news/uk-scotland-g ... t-18801698

We await your earliest response and God Bless you.

Regards

Colin & Chris Weir

E-mail: [email protected]

The source IP address is 41.190.2.184.

Geo-Location Information
Country Nigeria
State/Region 05
City Lagos
Latitude 6.4531
Longitude 3.3958