Mrs. Shirley Levine <[email protected]>

[Faizan Docherty]

Header Analysis Quick Report
Originating IP: 41.189.43.49
Originating ISP: Cote D'ivoire Telecom
City: Abidjan
Country of Origin: Cote D'Ivoire
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.70.138.105 with SMTP id qp9csp4610313pdb;
Wed, 8 Apr 2015 05:31:30 -0700 (PDT)
X-Received: by 10.68.216.199 with SMTP id os7mr45514280pbc.90.1428496290158;
Wed, 08 Apr 2015 05:31:30 -0700 (PDT)
Return-Path: <[email protected]>
Received: from relay.mailchannels.net (aso-006-i413.relay.mailchannels.net. [207.210.193.22])
by mx.google.com with ESMTP id ix2si16059648pbc.16.2015.04.08.05.31.28
for <snipped>;
Wed, 08 Apr 2015 05:31:30 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 207.210.193.22 as permitted sender) client-ip=207.210.193.22;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 207.210.193.22 as permitted sender) smtp.mail=[email protected];
dkim=fail [email protected]
X-Sender-Id: _forwarded-from|183.79.150.99
Received: from r8-chicago.webserversystems.com (ip-10-229-11-165.us-west-2.compute.internal [10.229.11.165])
by relay.mailchannels.net (Postfix) with ESMTPA id 3AE8D1208DA
for <snipped>; Wed, 8 Apr 2015 12:31:27 +0000 (UTC)
X-Sender-Id: _forwarded-from|183.79.150.99
Received: from r8-chicago.webserversystems.com (r8-chicago.webserversystems.com [10.254.9.84])
(using TLSv1 with cipher DHE-RSA-AES256-SHA)
by 0.0.0.0:2500 (trex/5.4.8 );
Wed, 08 Apr 2015 12:31:27 +0000
X-MC-Relay: Junk
X-MailChannels-SenderId: _forwarded-from|183.79.150.99
X-MailChannels-Auth-Id: wwwh
X-MC-Loop-Signature: 1428496287450:160880292
X-MC-Ingress-Time: 1428496287450
Received: from web101612.mail.kks.yahoo.co.jp ([183.79.150.99]:40288)
by r8-chicago.webserversystems.com with smtp (Exim 4.82)
(envelope-from <[email protected]>)
id 1Yfp8Y-0002t6-AF
for <snipped>; Wed, 08 Apr 2015 07:31:26 -0500
Received: (qmail 89921 invoked by uid 60001); 8 Apr 2015 12:31:16 -0000
DKIM-Signature: <snipped>
DomainKey-Signature: <snipped>;
Message-ID: <[email protected]>
X-YMail-OSG: <snipped>
Received: from [41.189.43.49] by web101612.mail.kks.yahoo.co.jp via HTTP; Wed, 08 Apr 2015 21:31:16 JST
X-Mailer: YahooMailWebService/0.8.111_63
X-YMail-JAS: <snipped>
Date: Wed, 8 Apr 2015 21:31:16 +0900 (JST)
From: Shirley Levine <[email protected]>
Reply-To: Shirley Levine <[email protected]>
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-83816484-286119854-1428496276=:82527"
X-Spam-Status: Yes, score=8.1
X-Spam-Score: 81
X-Spam-Bar: ++++++++
X-Spam-Report: Spam detection software, running on the system "r8-chicago.webserversystems.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: [...]

Content analysis details: (8.1 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[183.79.150.99 listed in list.dnswl.org]
3.0 SUBJ_YOUR_FAMILY Subject contains "Your Family"
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(kadycoba[at]yahoo.co.jp)
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(shirley levine <shirley_levine71[at]yahoo.fr>
)
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
2.0 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.0 MONEY_FROM_41 Lots of money from Africa
X-Spam-Flag: YES
Subject: ***SPAM*** Dearest In the Lord Jesus Christ Greetings,I am Mrs,Shirley Levine. an aging widow suffering from long time illness. i am currently admitted in a private hospital here in Abidjan cote d' Ivory, I have some funds I inherited from my late loving husband Mr.Levine Zokora. The amount of US$7.500, 000.00 which he deposited in one of the Bank Here and I need a honest and God fearing person who have the feelings of human that can use this funds for God's work and 15% out of the total funds will be for your compasation for doing this work of God. Please if you would be able to use these funds for the Lord's work kindly reply to me. May the Grace of our Lord Jesus Christ the love of God and the sweet fellowship of the Lord be with you and your family's Amen. Your Sister In The Lord. Mrs.Shirley Levine
X-AuthUser:

Nothing in the email body.

Message is on the subject line.

[Tim Atem]

Using the same email address [email protected] Same message, in the subject line.

Header Analysis Quick Report
Originating IP: 41.189.51.40
Originating ISP: Cote D'ivoire Telecom
City: Abidjan
Country of Origin: Cote D'Ivoire
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.107.9.195 with SMTP id 64csp3017732ioj;
Tue, 25 Aug 2015 03:42:49 -0700 (PDT)
X-Received: by 10.140.128.2 with SMTP id 2mr69395160qha.8.1440499369336;
Tue, 25 Aug 2015 03:42:49 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nh605-vm5.bullet.mail.ssk.yahoo.co.jp (nh605-vm5.bullet.mail.ssk.yahoo.co.jp. [182.22.90.78])
by mx.google.com with ESMTP id i72si32816870qhc.65.2015.08.25.03.42.41
for <<snipped>>;
Tue, 25 Aug 2015 03:42:49 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 182.22.90.78 as permitted sender) client-ip=182.22.90.78;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 182.22.90.78 as permitted sender) smtp.mailfrom=[email protected];
dmarc=fail (p=NONE dis=NONE) header.from=gmail.com
Received: from [182.22.66.104] by nh605.bullet.mail.ssk.yahoo.co.jp with NNFMP; 25 Aug 2015 10:15:48 -0000
Received: from [182.22.91.131] by t602.bullet.mail.ssk.yahoo.co.jp with NNFMP; 25 Aug 2015 10:15:48 -0000
Received: from [127.0.0.1] by omp604.mail.ssk.yahoo.co.jp with NNFMP; 25 Aug 2015 10:15:48 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 14690 invoked by uid 60001); 25 Aug 2015 10:15:46 -0000
DomainKey-Signature: <snipped>
Message-ID: <[email protected]>
X-YMail-OSG: <snipped>
Received: from [41.189.51.40] by web101604.mail.kks.yahoo.co.jp via HTTP; Tue, 25 Aug 2015 19:15:46 JST
X-RocketYMMF: kadycoba
X-Mailer: YahooMailWebService/0.8.111_67
X-YMail-JAS: <snipped>
Sender: [email protected]
Date: Tue, 25 Aug 2015 19:15:46 +0900 (JST)
From: Shirley Levine <[email protected]>
Reply-To: Shirley Levine <[email protected]>
Subject: Dearest In the Lord Jesus Christ Greetings,I am Mrs,Shirley Levine. an aging widow suffering from long time illness. i am currently admitted in a private hospital here in Abidjan cote d' Ivory, I have some funds I inherited from my late loving husband Mr.Levine Zokora. The amount of US$7.500, 000.00 which he deposited in one of the Bank Here and I need a honest and God fearing person who have the feelings of human that can use this funds for God's work and 15% out of the total funds will be for your compasation for doing this work of God. Please if you would be able to use these funds for the Lord's work kindly reply to me. May the Grace of our Lord Jesus Christ the love of God and the sweet fellowship of the Lord be with you and your family's Amen. Your Sister In The Lord. Mrs.Shirley Levine
To: undisclosed recipients: ;
MIME-Version: 1.0