#301207 by buried under 419s
Wed Jul 20, 2016 2:30 am
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Tue, 19 Jul 2016 22:32:07 -0700
Received: from mail-sn1nam02hn0225.outbound.protection.outlook.com ([104.47.36.225]:62138 helo=NAM02-SN1-obe.outbound.protection.outlook.com)
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1bPk71-0000N4-F5
for ; Tue, 19 Jul 2016 22:32:07 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=vfcdcxsx.onmicrosoft.com; s=selector1-szzar-net;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
bh=jdtOsyUzOHe3LZOL4tUS1+/OhFJy5m8Kwq0+v7FeMuA=;
b=g/MTYFgEpc6TOt7MoVGHTF8AmHJpVEcIRJLjoNJyhFgN2h50kV+mYuz1VkvtFKrgENxSKb4buAnafsa3Dohw5bqTOhrm4k0fz55fwKRo/FIXBnP6I4YwIT3ybn2vubljcDw07dgJ+tOgohwgAoUFJJXTAh1JE3gX/DCEU77Tm2M=
Authentication-Results: spf=none (sender IP is )
[email protected];
Received: from [10.211.1.8] (112.166.27.126) by
CO1PR14MB1063.namprd14.prod.outlook.com (10.166.29.27) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
15.1.544.10; Wed, 20 Jul 2016 05:57:42 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
To: Recipients <[email protected]>
From: Barrister.Don Philip <[email protected]>
Date: Wed, 20 Jul 2016 06:57:21 +0100
Reply-To: <[email protected]>
X-Originating-IP: [112.166.27.126]
X-ClientProxiedBy: KL1PR03CA0083.apcprd03.prod.outlook.com (10.165.174.179) To
CO1PR14MB1063.namprd14.prod.outlook.com (10.166.29.27)
Message-ID: <CO1PR14MB106398417C2CAB1FFCC5829DFD080@CO1PR14MB1063.namprd14.prod.outlook.com>
X-MS-Office365-Filtering-Correlation-Id: 561d0a0c-4ca8-49df-8921-08d3b062cd5b
X-Microsoft-Exchange-Diagnostics: 1;CO1PR14MB1063;2:QSdrOi0lZu1BV/KkJ/64ashKUC40GEmLPQqJuRVfUfwks9EilyYtZwpz2/Sd3ePKy+l9AtwvwKLTCr9rU8d1XCaeW+ZTvvRsJqGflQRYWUMKuXZYQLWBzLwX4MmKMyPlkDCxEIRa+vrBDuis3v9qALo0uSiRMn7306TQ1RMIrCYN5W8uArDLi5y6kUGkkfe2;3:osz+CU6sD8EQLkMwRbT66KHtonhriM4ExRjzo+jGsBHw43JEuTltyEdq+/k1YaTiuJjRX8A2cJdIEBNZAR+iul3DJV5i4o3C4xUCzhuNWhbLuAs4rwuPjsdYffToss5Y
X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CO1PR14MB1063;
X-Microsoft-Exchange-Diagnostics: 1;CO1PR14MB1063;25:3bMoiaRDhrEs4D6iKg3rW+AE5vlg2tUD2mbyXynSbOdzYAb8qAJbNA9uNryHn8O6ooihzh3F0C7y97Mb3HPXTjS3AsKfAv+VX8HT6wcs6gvvMCDO4HKSCN1U5IAosOcVROKVdUs64pHSkcoDKkKS4fCVkFbyVTsIQ6vYN/lljYQTqgiroYu+LCEPn0PY6sm2RS81GJNDHfMWO5ehoKt0WS7yUDR359uvw7M62253kscPI+njz5XzZ/5u+02dJdXudbPR8SaSo49GEq8rqipLPZXkANVW4nKWqZ/TqblmEoqP/pVaIsw1zNv2gehdceHnO8cXDSmSk7xQ7x0JhQRfhLkw37MJ/CIjrt09ENk+NTRlvyz+SaPYmWWo7mXO38xv27l7o9PlOjIT1Ex/TpFjql1mrcWnlt7yfrP1DmhKlwbj7Ie65BpJ/JT58E2+8+v+M/6k9NKUU0Hk9Toi+gSIU6ooefwUsc9tO3ZGdXo3iQTVvfSlSXpb7mnjo/DnfuugGo1z496iVt2i3wbBKxDVibmEKANkGN6Z2ReFihX4F0yD0eVw6mypyN3CcIhqOCGFLorKEBCXIDOkg4+oVfoRSOLMgFyLllRWqaz1zVGCof8qqUu03jNyg30rlJ2iPuJfsCzwFsq9DyKyWIW30BfYXP2tsi4dGa5d00zQqvIO+D52sNXOYRz/ujQRoDKR7dml5b+jjgMFFxVlQRpvLwkwHKPVYWLCuDlv35c4QneAdiqLbEL/Ix2x8VBc+lq5s6cqPCUjOVKPa8hyGCFADKzL8g==
X-Microsoft-Exchange-Diagnostics: 1;CO1PR14MB1063;31:BKLJakwHulcNA3Y0+F3LDhLDUsVDytzoivne6vxkKsFW2LLgHp/rTGQGdjZlwwKShX0E7Vb3VF4JCc366WDC9hGNRTOMSH4oBUZuVcyUqSnUdS7rWUEB04io0XY7XkVeuai4PhbkW+dHZgQnptPiWiEOpC8IkKvF424H2YexZ510WRW9gamG7N4QkqtuFFy5/rrC3p7O1tYoajo/E8gTIA==;4:5AXn39vUaKCEAyo4RcHjyA9r1b6yeTnFXS7RxpM95fSsCS9OyqsOJTZgccB3wZT8r5nNvOx42FcfmJcrkiAK5Y0WJ0ObuSE2VRJIogrMsCTLjc+AEB/OFy2LNT+8IiLFI8if253oZevBcJbVnExjTvvC+m7DCBc/aj3XqiLf7Ss3Yl8mDH4pptMZwToueDyrFBNlW8Wyagog9m+QezwlE/9rDckAMpzcGa2oXPHTn2oEUPxZz3NOfBW+lmFCvzvqcgep3JKtsxQ7cbKkVf/lKLDsGCYy2LipME1p018qMuqQVZzkU47inediSIOosMINSx2X4fsDX7d2qkVYxZMaw3QRjh5u33m/J9M52D0J7VcfNgpEP8JeE3QIb5EBhtRPeD3N1pCK0ELgRYlpTuWLYI7Yj7mxrA3QzuEK+bKZQXg=
X-Microsoft-Antispam-PRVS: <CO1PR14MB10636E9BBDC432081506FD54FD080@CO1PR14MB1063.namprd14.prod.outlook.com>
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041072)(6043046);SRVR:CO1PR14MB1063;BCL:0;PCL:0;RULEID:;SRVR:CO1PR14MB1063;
X-Forefront-PRVS: 000947967F
X-Forefront-Antispam-Report: SFV:SPM;SFS:(10009020)(4630300001)(6049001)(6009001)(7916002)(189002)(199003)(33656002)(77096005)(97736004)(105586002)(86362001)(81166006)(223583001)(9686002)(81156014)(4001450100002)(6200100001)(217423001)(551934003)(106356001)(7736002)(101416001)(586003)(50466002)(250100001)(229853001)(19580395003)(2906002)(43066003)(74316002)(2860700002)(7846002)(47776003)(54356999)(53256004)(23676002)(66066001)(3846002)(50986999)(305945005)(76576001)(110136002)(189998001)(42186005)(4001600100001)(6116002)(107886002)(53806999)(8746002)(8676002)(68736007)(8666005)(62346011);DIR:OUT;SFP:1501;SCL:5;SRVR:CO1PR14MB1063;H:[10.211.1.8];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:0;LANG:en;
Received-SPF: None (protection.outlook.com: szzar.net does not designate
permitted sender hosts)
X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDTzFQUjE0TUIxMDYzOzIzOnNJT2I2Y1BzdHI3MnQwQk05Sng1dDlEUWE4?=
=?utf-8?B?OW0wb3NRbHVkcWk4eUpseWkwZ1Fkczh5RHpuYWJTU21vUUdIZ1lxdW4xWDI2?=
=?utf-8?B?bkwvVVcxRjRRWDh6TXVhRHVjYytlb0VpRXdlQTk0VHo2WEE3UmdDNzNQQURn?=
=?utf-8?B?SXNtVDA1dmRNeXBLL04zVUtjZC9nR2pBZGJlNnNvcGZkRXZXODhHNGVWeWFD?=
=?utf-8?B?bXdxbzRpeTN0UHk0YUJLSjNSL0VvMkJjWWhJY2FtUWNUbDhKUXZTcGlnNC9Q?=
=?utf-8?B?R1FXMUdLMDhxQ3pEby9oOEJkVUFCY3RLT1BFK01VaFhMTnJnT2k4QWtjTVFn?=
=?utf-8?B?RWlaRWNaTEtkYzcybTBvYjFhU2RzQ2ZsL25WaDc3ZnIrdHN4SlVZVXRuY3p3?=
=?utf-8?B?MTMvZWlHV0JvcUYzSTZPeVBqRFBOcU1mL2dvRHBCQk5qK0QrU2hRUkd1VFU5?=
=?utf-8?B?bmZmbWZJbFV3RERvRndDNTNKRnh2Q0ZZRHVDYnJIMDE2eTN6MWwzZ04rR05X?=
=?utf-8?B?RTdpNGlJczJqSUVudlNaNTcrTXdJRS9WdVhQMVdlZVNlcHo0VXVmSDB5dXhF?=
=?utf-8?B?T2FvTWRNMTdqaHRLTXdnQjR1SXBVVG5Nd0oySEFzdkM0VE03STcxMnF0OGJS?=
=?utf-8?B?dzRCWVdqaTlubllqSEFYVlpEd3FZREhHRkR5THhWUGlURHVWVDRlNHY1YkFN?=
=?utf-8?B?bS90MXNMUzZ1MjBSak84RGswbVYreHl0ajNtVUlhWTJieFc4ZE9ZVXF1OGQ1?=
=?utf-8?B?Z2RtOVNUOG82em5GZXlKY0xsZTZxU2FMMEtnM05pSE10U2dvNXZtTTFlcmZ1?=
=?utf-8?B?a0wwTkZIRnY2eWQrTU5sWURTWG5oQ3ZmK2VsWUoyQVpaZDh6QU42dzJrQU9I?=
=?utf-8?B?bkFHYTNJeWpIMmdGbDV0RHB5TEcyYm1vaEYzZDNpb3ZBbkgzTCtLREZlbDdq?=
=?utf-8?B?cjVhaG5wTG1aRXpITCtORWJBRkQvQzNUeWlZMGNYamZiT0JIejJaSzI0RjVT?=
=?utf-8?B?dERHYkhlOWVDVEUwL1pzVWo4anBiMHBGekt2OEtuVzJWKytRZUFCN3Nma1Mz?=
=?utf-8?B?L1BMUVE1RGNOUVFHbVYrMFFvNTFLSG8xNWQxeTB4Q1RzRE5lNGJWSGx3ckNr?=
=?utf-8?B?VUludy9wbjVqaFpoNDZ0V2xZTjNFWFI0VjF2Q2ZKUFFQVFc3VHZ5NUczOFBN?=
=?utf-8?B?Qkw3eHh3UHhJQzdjOS9VakRNSkJwUkg5Q05tUytYTUMvNmZUQ3BjdDk0Ykgv?=
=?utf-8?B?UmJRSWFVbjQzVHJCaE8rOG1IbFZhYmVhUFI5LzFuRkpRSC9UZjVYWURKOUgv?=
=?utf-8?B?dmg1aGdXNklkUkg5bkFBYmE3RE5BRWlTMVRjV1FiL2ExckNCK2M2TzZuSURI?=
=?utf-8?B?cTB3d2FRK1pqWkM5bEhEclBqOENCamVMcTQxWXRoS1hQRzA5UXJydGVSTklN?=
=?utf-8?B?STduMzM3ZmxGUEhqL1lJazF6Z3I2VjFhYTg0VGVwaU05NnlwZ3FDYzFiWDJy?=
=?utf-8?B?Q1R4OXFRVTVpUFJpeWtpMlI2TTN2LzVLMVhrbSsxZU1OclpacDNtV2JFaWVx?=
=?utf-8?B?VDg0QXlWY29XV1F4RjhzelMxTk9ieDVFUTFySzJMZ1h4L3BxY0J4NUJCR3lR?=
=?utf-8?B?a25lOFBqcDBlbFhTVUdCQm9jY21FdWxzTXVGbzZZME9ianBUUEt0K29TQ1lD?=
=?utf-8?B?ZVdHTGhVUHVlQVo2d29nRERUV3o3akxGdVF0bW5BQnBRempJbzMvOHhveEl2?=
=?utf-8?B?NTZ0RUVvQzMwZU82Y0Z5OHJlQ2ZSMHB6YUxwcStxclFUSnE1UlVuZStxZ3F0?=
=?utf-8?B?YXhhTlNwN1ZiMFBlTEdNdzFjeDl3cDdyZDF1ZXh1SGU4T0E9PQ==?=
X-Microsoft-Exchange-Diagnostics: 1;CO1PR14MB1063;6:CIVjaSxoEwr5FPgvbJ3G+FMbQrjv9isVy91i+6m8tZw4Pu10mu4TxLIGt651awv1Nwt1HcyyEjTqtM//ATTHo4FeDBmM4rZjGWIbRnmi+wZCfTsGbOusUKMbQ/Q84hTmL4HFBUw5EPH+Tl12TMfI/GYywbqLIojgVNq9Id9194drL5c29kSw6X61txeBj6gsk/nngARZ73FsLMhEZ2IXxT4UN962YIJfqMq18uKytZ+QfFDE9IkLdkLoHEr6yVXxIHwmcCesLMBZKw3ZJm/LXX6vL6VNihW0/jmpZ4NRRqUc3SrdoUPY8/y4LETkWKBw;5:VFmcsSF7zfyUmQr2sQ6yC19iP3GDr8q5WX1IrXIfcH7kEfsoTCfYNsEbeLL50qJ80NY9R2mFPElamNwP1uiXMSQyEq2BtXk4UGUm84sG5CLNZ49O4zG/DuiT0j/co3rWDc55y2eL8MHkaQdy/2Oi9Q==;24:vibX2mMsg5iEp8dGZbyCtVo496dD0is5JQdX5V0SLZtpvJYqY0KQs0ynNQHmsZdZ0NG+wWXPXqywYNuiKDxhNw==;7:4iBMFqDGp/R92C91wcYaqCA4ozSAEvK0gtpLIhEDXU9MyvrIwPpOwqdXDgOTDcPpY0PHPR5ru5tTXThQFAELtsXlA90OUIW0AqTinzGgSuOlmrdRs/sNcSzBirBct16Avw1VcnAPum68qwpteU0nRZWD8xOGSksZoY5O+WdlvZUgldjHaLmIoc4h+QM716Fx9JGapfA/ewAULodOZLRR6He0fapfEDzKZWbM11KaX1dR1GU3uTbJuUK4jzHeYCz7
SpamDiagnosticOutput: 1:22
X-OriginatorOrg: szzar.net
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jul 2016 05:57:42.9256
(UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR14MB1063
X-Spam-Status: Yes, score=19.6
X-Spam-Score: 196
X-Spam-Bar: +++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Attention :E-mail ID Owner, Western Union Head Office wish
to inform you that the Federal Ministry of Finance approve and instructed
us to deposit your unclaimed fund worth of $3.5 Millions us Dollars with
our WESTERN UNION MONEY TRANSFER with payment file number KGU/8020182590,please
note $5000 has already been sent to you as first collection of which you
will be receiving per hour until the total sum of $3.5 millions USD is completely
transfer to you, [...]
Content analysis details: (19.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[104.47.36.225 listed in list.dnswl.org]
2.4 UNCLAIMED_MONEY BODY: People just leave money laying around
1.9 HK_SCAM_N2 BODY: HK_SCAM_N2
0.5 AXB_X_FF_SEZ_S Forefront sez this is spam
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
3.0 BAYES_95 BODY: Bayes spam probability is 95 to 99%
[score: 0.9791]
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 MONEY_BARRISTER Lots of money from a UK lawyer
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.0 FILL_THIS_FORM Fill in a form with personal information
2.9 FILL_THIS_FORM_LOAN Answer loan question(s)
0.5 MONEY_FORM Lots of money if you fill out a form
2.6 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.3 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
2.9 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** CONTACT WESTERN UNION OFFICE NOW FOR YOUR TRANSFER
Attention :E-mail ID Owner,
Western Union Head Office wish to inform you that the Federal Ministry of Finance approve and instructed us to deposit your unclaimed fund worth of $3.5 Millions us Dollars with our WESTERN UNION MONEY TRANSFER with payment file number KGU/8020182590,please note $5000 has already been sent to you as first collection of which you will be receiving per hour until the total sum of $3.5 millions USD is completely transfer to you,
This is the final notice you are going to receive from this office,do you get me? I hope you understand how many times this message has been sent to you.
Sender Information’s are stated below:
Sender name===========Michael Smith
Test question======== what color?
Test answer:==========blue
Amount================$5,000 00
MTCN==================414854****
Forward your below information to perfect the transfer under your name,
Receiver's full Name_______________
Address: ________________
Country: _____________
Phone Number: _____________
You need to send the activation fee $100,before then you will see the complete 10 Digit number to pick up the needed $5000 Which have been sent to you today. So please act fast by sending the $100 with the information below for the pick up of your $5000 without delay.
Important note there is one man call Mr James Adam who claim to be your representative who came to our office saying that you send him to pay the fee on your be half as the next of kin to claim the fund are you aware of this man ???
Call Director:Mr.Fred Roland
Tel: +2348065617523
HERE IS THE MONEY GRAM/WESTERN UNION INFORMATION TO SEND THE ACTIVATION FEE $100
Receiver's Name:....David Smith
Country:............Nigeria
City:...............Lagos
Amount:.............$100
Question:...........For What?
Answer:.............Release
MTCN # .................
Sender's name........
As result of the information we got I told them to wait until I hear from you today to know if you are still interested to receive this fund lets release your full MTCN of your $5000 installment once we confirm the activation fee. So if you are interested on your fund, Send the activation fee of $100 upon your response.
Call Mr.Fred Roland on phone Tel:+2348065617523 as soon as you send email to him because your call would facilitate the immediate attention to you due to his tight transaction schedule,
Yours sincerely
Barrister Don Philip
Information Agent
Envelope-to:
Delivery-date: Tue, 19 Jul 2016 22:32:07 -0700
Received: from mail-sn1nam02hn0225.outbound.protection.outlook.com ([104.47.36.225]:62138 helo=NAM02-SN1-obe.outbound.protection.outlook.com)
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1bPk71-0000N4-F5
for ; Tue, 19 Jul 2016 22:32:07 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=vfcdcxsx.onmicrosoft.com; s=selector1-szzar-net;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
bh=jdtOsyUzOHe3LZOL4tUS1+/OhFJy5m8Kwq0+v7FeMuA=;
b=g/MTYFgEpc6TOt7MoVGHTF8AmHJpVEcIRJLjoNJyhFgN2h50kV+mYuz1VkvtFKrgENxSKb4buAnafsa3Dohw5bqTOhrm4k0fz55fwKRo/FIXBnP6I4YwIT3ybn2vubljcDw07dgJ+tOgohwgAoUFJJXTAh1JE3gX/DCEU77Tm2M=
Authentication-Results: spf=none (sender IP is )
[email protected];
Received: from [10.211.1.8] (112.166.27.126) by
CO1PR14MB1063.namprd14.prod.outlook.com (10.166.29.27) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
15.1.544.10; Wed, 20 Jul 2016 05:57:42 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
To: Recipients <[email protected]>
From: Barrister.Don Philip <[email protected]>
Date: Wed, 20 Jul 2016 06:57:21 +0100
Reply-To: <[email protected]>
X-Originating-IP: [112.166.27.126]
X-ClientProxiedBy: KL1PR03CA0083.apcprd03.prod.outlook.com (10.165.174.179) To
CO1PR14MB1063.namprd14.prod.outlook.com (10.166.29.27)
Message-ID: <CO1PR14MB106398417C2CAB1FFCC5829DFD080@CO1PR14MB1063.namprd14.prod.outlook.com>
X-MS-Office365-Filtering-Correlation-Id: 561d0a0c-4ca8-49df-8921-08d3b062cd5b
X-Microsoft-Exchange-Diagnostics: 1;CO1PR14MB1063;2:QSdrOi0lZu1BV/KkJ/64ashKUC40GEmLPQqJuRVfUfwks9EilyYtZwpz2/Sd3ePKy+l9AtwvwKLTCr9rU8d1XCaeW+ZTvvRsJqGflQRYWUMKuXZYQLWBzLwX4MmKMyPlkDCxEIRa+vrBDuis3v9qALo0uSiRMn7306TQ1RMIrCYN5W8uArDLi5y6kUGkkfe2;3:osz+CU6sD8EQLkMwRbT66KHtonhriM4ExRjzo+jGsBHw43JEuTltyEdq+/k1YaTiuJjRX8A2cJdIEBNZAR+iul3DJV5i4o3C4xUCzhuNWhbLuAs4rwuPjsdYffToss5Y
X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CO1PR14MB1063;
X-Microsoft-Exchange-Diagnostics: 1;CO1PR14MB1063;25:3bMoiaRDhrEs4D6iKg3rW+AE5vlg2tUD2mbyXynSbOdzYAb8qAJbNA9uNryHn8O6ooihzh3F0C7y97Mb3HPXTjS3AsKfAv+VX8HT6wcs6gvvMCDO4HKSCN1U5IAosOcVROKVdUs64pHSkcoDKkKS4fCVkFbyVTsIQ6vYN/lljYQTqgiroYu+LCEPn0PY6sm2RS81GJNDHfMWO5ehoKt0WS7yUDR359uvw7M62253kscPI+njz5XzZ/5u+02dJdXudbPR8SaSo49GEq8rqipLPZXkANVW4nKWqZ/TqblmEoqP/pVaIsw1zNv2gehdceHnO8cXDSmSk7xQ7x0JhQRfhLkw37MJ/CIjrt09ENk+NTRlvyz+SaPYmWWo7mXO38xv27l7o9PlOjIT1Ex/TpFjql1mrcWnlt7yfrP1DmhKlwbj7Ie65BpJ/JT58E2+8+v+M/6k9NKUU0Hk9Toi+gSIU6ooefwUsc9tO3ZGdXo3iQTVvfSlSXpb7mnjo/DnfuugGo1z496iVt2i3wbBKxDVibmEKANkGN6Z2ReFihX4F0yD0eVw6mypyN3CcIhqOCGFLorKEBCXIDOkg4+oVfoRSOLMgFyLllRWqaz1zVGCof8qqUu03jNyg30rlJ2iPuJfsCzwFsq9DyKyWIW30BfYXP2tsi4dGa5d00zQqvIO+D52sNXOYRz/ujQRoDKR7dml5b+jjgMFFxVlQRpvLwkwHKPVYWLCuDlv35c4QneAdiqLbEL/Ix2x8VBc+lq5s6cqPCUjOVKPa8hyGCFADKzL8g==
X-Microsoft-Exchange-Diagnostics: 1;CO1PR14MB1063;31:BKLJakwHulcNA3Y0+F3LDhLDUsVDytzoivne6vxkKsFW2LLgHp/rTGQGdjZlwwKShX0E7Vb3VF4JCc366WDC9hGNRTOMSH4oBUZuVcyUqSnUdS7rWUEB04io0XY7XkVeuai4PhbkW+dHZgQnptPiWiEOpC8IkKvF424H2YexZ510WRW9gamG7N4QkqtuFFy5/rrC3p7O1tYoajo/E8gTIA==;4:5AXn39vUaKCEAyo4RcHjyA9r1b6yeTnFXS7RxpM95fSsCS9OyqsOJTZgccB3wZT8r5nNvOx42FcfmJcrkiAK5Y0WJ0ObuSE2VRJIogrMsCTLjc+AEB/OFy2LNT+8IiLFI8if253oZevBcJbVnExjTvvC+m7DCBc/aj3XqiLf7Ss3Yl8mDH4pptMZwToueDyrFBNlW8Wyagog9m+QezwlE/9rDckAMpzcGa2oXPHTn2oEUPxZz3NOfBW+lmFCvzvqcgep3JKtsxQ7cbKkVf/lKLDsGCYy2LipME1p018qMuqQVZzkU47inediSIOosMINSx2X4fsDX7d2qkVYxZMaw3QRjh5u33m/J9M52D0J7VcfNgpEP8JeE3QIb5EBhtRPeD3N1pCK0ELgRYlpTuWLYI7Yj7mxrA3QzuEK+bKZQXg=
X-Microsoft-Antispam-PRVS: <CO1PR14MB10636E9BBDC432081506FD54FD080@CO1PR14MB1063.namprd14.prod.outlook.com>
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041072)(6043046);SRVR:CO1PR14MB1063;BCL:0;PCL:0;RULEID:;SRVR:CO1PR14MB1063;
X-Forefront-PRVS: 000947967F
X-Forefront-Antispam-Report: SFV:SPM;SFS:(10009020)(4630300001)(6049001)(6009001)(7916002)(189002)(199003)(33656002)(77096005)(97736004)(105586002)(86362001)(81166006)(223583001)(9686002)(81156014)(4001450100002)(6200100001)(217423001)(551934003)(106356001)(7736002)(101416001)(586003)(50466002)(250100001)(229853001)(19580395003)(2906002)(43066003)(74316002)(2860700002)(7846002)(47776003)(54356999)(53256004)(23676002)(66066001)(3846002)(50986999)(305945005)(76576001)(110136002)(189998001)(42186005)(4001600100001)(6116002)(107886002)(53806999)(8746002)(8676002)(68736007)(8666005)(62346011);DIR:OUT;SFP:1501;SCL:5;SRVR:CO1PR14MB1063;H:[10.211.1.8];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:0;LANG:en;
Received-SPF: None (protection.outlook.com: szzar.net does not designate
permitted sender hosts)
X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDTzFQUjE0TUIxMDYzOzIzOnNJT2I2Y1BzdHI3MnQwQk05Sng1dDlEUWE4?=
=?utf-8?B?OW0wb3NRbHVkcWk4eUpseWkwZ1Fkczh5RHpuYWJTU21vUUdIZ1lxdW4xWDI2?=
=?utf-8?B?bkwvVVcxRjRRWDh6TXVhRHVjYytlb0VpRXdlQTk0VHo2WEE3UmdDNzNQQURn?=
=?utf-8?B?SXNtVDA1dmRNeXBLL04zVUtjZC9nR2pBZGJlNnNvcGZkRXZXODhHNGVWeWFD?=
=?utf-8?B?bXdxbzRpeTN0UHk0YUJLSjNSL0VvMkJjWWhJY2FtUWNUbDhKUXZTcGlnNC9Q?=
=?utf-8?B?R1FXMUdLMDhxQ3pEby9oOEJkVUFCY3RLT1BFK01VaFhMTnJnT2k4QWtjTVFn?=
=?utf-8?B?RWlaRWNaTEtkYzcybTBvYjFhU2RzQ2ZsL25WaDc3ZnIrdHN4SlVZVXRuY3p3?=
=?utf-8?B?MTMvZWlHV0JvcUYzSTZPeVBqRFBOcU1mL2dvRHBCQk5qK0QrU2hRUkd1VFU5?=
=?utf-8?B?bmZmbWZJbFV3RERvRndDNTNKRnh2Q0ZZRHVDYnJIMDE2eTN6MWwzZ04rR05X?=
=?utf-8?B?RTdpNGlJczJqSUVudlNaNTcrTXdJRS9WdVhQMVdlZVNlcHo0VXVmSDB5dXhF?=
=?utf-8?B?T2FvTWRNMTdqaHRLTXdnQjR1SXBVVG5Nd0oySEFzdkM0VE03STcxMnF0OGJS?=
=?utf-8?B?dzRCWVdqaTlubllqSEFYVlpEd3FZREhHRkR5THhWUGlURHVWVDRlNHY1YkFN?=
=?utf-8?B?bS90MXNMUzZ1MjBSak84RGswbVYreHl0ajNtVUlhWTJieFc4ZE9ZVXF1OGQ1?=
=?utf-8?B?Z2RtOVNUOG82em5GZXlKY0xsZTZxU2FMMEtnM05pSE10U2dvNXZtTTFlcmZ1?=
=?utf-8?B?a0wwTkZIRnY2eWQrTU5sWURTWG5oQ3ZmK2VsWUoyQVpaZDh6QU42dzJrQU9I?=
=?utf-8?B?bkFHYTNJeWpIMmdGbDV0RHB5TEcyYm1vaEYzZDNpb3ZBbkgzTCtLREZlbDdq?=
=?utf-8?B?cjVhaG5wTG1aRXpITCtORWJBRkQvQzNUeWlZMGNYamZiT0JIejJaSzI0RjVT?=
=?utf-8?B?dERHYkhlOWVDVEUwL1pzVWo4anBiMHBGekt2OEtuVzJWKytRZUFCN3Nma1Mz?=
=?utf-8?B?L1BMUVE1RGNOUVFHbVYrMFFvNTFLSG8xNWQxeTB4Q1RzRE5lNGJWSGx3ckNr?=
=?utf-8?B?VUludy9wbjVqaFpoNDZ0V2xZTjNFWFI0VjF2Q2ZKUFFQVFc3VHZ5NUczOFBN?=
=?utf-8?B?Qkw3eHh3UHhJQzdjOS9VakRNSkJwUkg5Q05tUytYTUMvNmZUQ3BjdDk0Ykgv?=
=?utf-8?B?UmJRSWFVbjQzVHJCaE8rOG1IbFZhYmVhUFI5LzFuRkpRSC9UZjVYWURKOUgv?=
=?utf-8?B?dmg1aGdXNklkUkg5bkFBYmE3RE5BRWlTMVRjV1FiL2ExckNCK2M2TzZuSURI?=
=?utf-8?B?cTB3d2FRK1pqWkM5bEhEclBqOENCamVMcTQxWXRoS1hQRzA5UXJydGVSTklN?=
=?utf-8?B?STduMzM3ZmxGUEhqL1lJazF6Z3I2VjFhYTg0VGVwaU05NnlwZ3FDYzFiWDJy?=
=?utf-8?B?Q1R4OXFRVTVpUFJpeWtpMlI2TTN2LzVLMVhrbSsxZU1OclpacDNtV2JFaWVx?=
=?utf-8?B?VDg0QXlWY29XV1F4RjhzelMxTk9ieDVFUTFySzJMZ1h4L3BxY0J4NUJCR3lR?=
=?utf-8?B?a25lOFBqcDBlbFhTVUdCQm9jY21FdWxzTXVGbzZZME9ianBUUEt0K29TQ1lD?=
=?utf-8?B?ZVdHTGhVUHVlQVo2d29nRERUV3o3akxGdVF0bW5BQnBRempJbzMvOHhveEl2?=
=?utf-8?B?NTZ0RUVvQzMwZU82Y0Z5OHJlQ2ZSMHB6YUxwcStxclFUSnE1UlVuZStxZ3F0?=
=?utf-8?B?YXhhTlNwN1ZiMFBlTEdNdzFjeDl3cDdyZDF1ZXh1SGU4T0E9PQ==?=
X-Microsoft-Exchange-Diagnostics: 1;CO1PR14MB1063;6:CIVjaSxoEwr5FPgvbJ3G+FMbQrjv9isVy91i+6m8tZw4Pu10mu4TxLIGt651awv1Nwt1HcyyEjTqtM//ATTHo4FeDBmM4rZjGWIbRnmi+wZCfTsGbOusUKMbQ/Q84hTmL4HFBUw5EPH+Tl12TMfI/GYywbqLIojgVNq9Id9194drL5c29kSw6X61txeBj6gsk/nngARZ73FsLMhEZ2IXxT4UN962YIJfqMq18uKytZ+QfFDE9IkLdkLoHEr6yVXxIHwmcCesLMBZKw3ZJm/LXX6vL6VNihW0/jmpZ4NRRqUc3SrdoUPY8/y4LETkWKBw;5:VFmcsSF7zfyUmQr2sQ6yC19iP3GDr8q5WX1IrXIfcH7kEfsoTCfYNsEbeLL50qJ80NY9R2mFPElamNwP1uiXMSQyEq2BtXk4UGUm84sG5CLNZ49O4zG/DuiT0j/co3rWDc55y2eL8MHkaQdy/2Oi9Q==;24:vibX2mMsg5iEp8dGZbyCtVo496dD0is5JQdX5V0SLZtpvJYqY0KQs0ynNQHmsZdZ0NG+wWXPXqywYNuiKDxhNw==;7:4iBMFqDGp/R92C91wcYaqCA4ozSAEvK0gtpLIhEDXU9MyvrIwPpOwqdXDgOTDcPpY0PHPR5ru5tTXThQFAELtsXlA90OUIW0AqTinzGgSuOlmrdRs/sNcSzBirBct16Avw1VcnAPum68qwpteU0nRZWD8xOGSksZoY5O+WdlvZUgldjHaLmIoc4h+QM716Fx9JGapfA/ewAULodOZLRR6He0fapfEDzKZWbM11KaX1dR1GU3uTbJuUK4jzHeYCz7
SpamDiagnosticOutput: 1:22
X-OriginatorOrg: szzar.net
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jul 2016 05:57:42.9256
(UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR14MB1063
X-Spam-Status: Yes, score=19.6
X-Spam-Score: 196
X-Spam-Bar: +++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Attention :E-mail ID Owner, Western Union Head Office wish
to inform you that the Federal Ministry of Finance approve and instructed
us to deposit your unclaimed fund worth of $3.5 Millions us Dollars with
our WESTERN UNION MONEY TRANSFER with payment file number KGU/8020182590,please
note $5000 has already been sent to you as first collection of which you
will be receiving per hour until the total sum of $3.5 millions USD is completely
transfer to you, [...]
Content analysis details: (19.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[104.47.36.225 listed in list.dnswl.org]
2.4 UNCLAIMED_MONEY BODY: People just leave money laying around
1.9 HK_SCAM_N2 BODY: HK_SCAM_N2
0.5 AXB_X_FF_SEZ_S Forefront sez this is spam
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
3.0 BAYES_95 BODY: Bayes spam probability is 95 to 99%
[score: 0.9791]
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 MONEY_BARRISTER Lots of money from a UK lawyer
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.0 FILL_THIS_FORM Fill in a form with personal information
2.9 FILL_THIS_FORM_LOAN Answer loan question(s)
0.5 MONEY_FORM Lots of money if you fill out a form
2.6 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.3 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
2.9 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** CONTACT WESTERN UNION OFFICE NOW FOR YOUR TRANSFER
Attention :E-mail ID Owner,
Western Union Head Office wish to inform you that the Federal Ministry of Finance approve and instructed us to deposit your unclaimed fund worth of $3.5 Millions us Dollars with our WESTERN UNION MONEY TRANSFER with payment file number KGU/8020182590,please note $5000 has already been sent to you as first collection of which you will be receiving per hour until the total sum of $3.5 millions USD is completely transfer to you,
This is the final notice you are going to receive from this office,do you get me? I hope you understand how many times this message has been sent to you.
Sender Information’s are stated below:
Sender name===========Michael Smith
Test question======== what color?
Test answer:==========blue
Amount================$5,000 00
MTCN==================414854****
Forward your below information to perfect the transfer under your name,
Receiver's full Name_______________
Address: ________________
Country: _____________
Phone Number: _____________
You need to send the activation fee $100,before then you will see the complete 10 Digit number to pick up the needed $5000 Which have been sent to you today. So please act fast by sending the $100 with the information below for the pick up of your $5000 without delay.
Important note there is one man call Mr James Adam who claim to be your representative who came to our office saying that you send him to pay the fee on your be half as the next of kin to claim the fund are you aware of this man ???
Call Director:Mr.Fred Roland
Tel: +2348065617523
HERE IS THE MONEY GRAM/WESTERN UNION INFORMATION TO SEND THE ACTIVATION FEE $100
Receiver's Name:....David Smith
Country:............Nigeria
City:...............Lagos
Amount:.............$100
Question:...........For What?
Answer:.............Release
MTCN # .................
Sender's name........
As result of the information we got I told them to wait until I hear from you today to know if you are still interested to receive this fund lets release your full MTCN of your $5000 installment once we confirm the activation fee. So if you are interested on your fund, Send the activation fee of $100 upon your response.
Call Mr.Fred Roland on phone Tel:+2348065617523 as soon as you send email to him because your call would facilitate the immediate attention to you due to his tight transaction schedule,
Yours sincerely
Barrister Don Philip
Information Agent
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces