RSS

Nigerian Business Scam – “Wendy”

29 Nov

Business Proposal –  419 Scam – Nigerian Scammer

EMAIL: Hi there is a business opporunity you really want to handle with me please do kinldy get back to me for more info Regards

Wendy
 
HEADER:
Return-Path: <peter.emery@maine.edu>
X-YahooFilteredBulk: 130.111.32.94
Received-SPF: pass (domain of maine.edu designates 130.111.32.94 as permitted sender)
X-YMailISG: GG3IbX0WLDtfaBoi15UngS974JOEoxQDbkZU_Z6HSs5EZIo6 P3H4A6t.cRc3jegYH.DN5J347ZwqFkdurbrBsQMjIrTSGnk40emzudzBF8Wd CYw7AT6tHwoR4yfUZOL9hsRiD1GDwCI1TDsNcU1Y1jfId2eXQLYx21FDqeju zABeus04bEg76pb..BmXeEqJQBCdYklZe7afUtt9V_YyWLpNgDr3IFtB21_c NpVqYmsejLMtlT8JblGx374ZWzs6KxuwiNvzBvVauz3H7kIrQ_SsuqU30Z1_ V20j7pTUrH_78upMaWtTpv2MkAlYOjArI3MbdubRcX8aB_dgxWV.MMukdNUu ta0gV0gPbvWSvNgCxNQMHA5toX04WEUDPxe0Khz_8jZcv_Nk9a6gsOf5SagZ NkuAzxWTh_2fTXyVjz2VyOwoWQgYupKq57NajhlK6taHGhqC1uBoekuWf14c mZeN.MsiSp1v_9LZTxkx3duB.JqnRN8R1I3ErQSoMP1Gxozbi_VlKDqo3vV7 aYA5DoDX7s47ifM6L06dzJBtrfTSm2IYhoy8aoPiN_hYDEoVO3QjuMM2Hmvh o7gCWlu_zWgENYMZsiPpX1arii4KWC3ODoe2VIqSPTZICaiUWH9MtG24sgzT 6g_Zqwv5XfI78IHg9rd2S5vfqfNSKujnvDVXoKGJn6jx_SW.dQt6t5iu4Qeq 6N7nofeY9GDovHRnqi7gBuFg_XfTV3o7tSxgJwBpz9ZK6KdHG6weUDIBlDE_ iahcLkGsQyg_.hRIaVk52o4vGReZUfyunFpJfHcLEGhxmZwbOyAzAr76Qe4l z2YTA7b7of5q8zJR3qbMGyBdvgaH5UinFpcv2DVQmL49a27xT4zQdlHI2L9g n7ppjZ7xYz6_jzkN8hl.RYMM9ekyHcf7kBAB5tT4x4_QzApFM84I2Z7ElCyV PwGRlqYgZLpKZ2d4TZdCIZXKCoOJ0I3serlQkB21T6l.DLArnni4wdWJl7DL UyUtbMubnWNqLkSkQ6GwS7rzj84NfkuuO1faY2V2khBwno6sXh_KKn257Jxb cKX5_3XY8HnsDuGpNJOkJ.4iZlDM0HuD1nbzwrPkqjcM4aUILJWgLeU7T8nn zAg4fyjA4f4hTwKq9PuboBL.9u6BxjvxKqU8NuBmvRiFzVM.l3.Sn4kcnYTi u2ErJthQBdh6SEOANpabSozTHBtaMWHiWWN3gpVxq_aP4KhcT64srmfYH6qD riuDlOQ5y7m3w8AnKYdCSVp4p5kfITvgmFrZDms_KMyE4GJTNpxJTivIwl5u 0LmzopmkPRtgEyGTlpLP8.paWX3JMjnVRLyBgtA.bVJKKGHdTZDdDK2oqFWF S3F01BquTAMsnAy1IEYGbChppgMCb6suUn8d.NMXc8OO7ISuzo1_pKmlgXZt jhAzTfvYjxkfsswzZhm_18112vWF1FKXdQqZAgpPAsZt3kQYJQyej2mRNQao M9YzlsebIwh87acAp9aS6q8eMkw7PpiTZMYsL2EumTcG_7b42mGUUCPS9IY2 C8bKGv5MPyomwMIyOO0-
X-Originating-IP: [130.111.32.94]
Authentication-Results: mta1485.mail.mud.yahoo.com from=maine.edu; domainkeys=neutral (no sig); from=maine.edu; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO beryl.its.maine.edu) (130.111.32.94) by mta1485.mail.mud.yahoo.com with SMTP; Wed, 28 Nov 2012 00:40:44 -0800
Received: from [172.162.109.136] (ACA26D88.ipt.aol.com [172.162.109.136]) (authenticated bits=0) by beryl.its.maine.edu (8.13.8/8.13.8) with ESMTP id qAS8OAJw017124 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 28 Nov 2012 03:31:35 -0500
Message-Id: <201211280831.qAS8OAJw017124@beryl.its.maine.edu>
Content-Type: text/plain; charset=”iso-8859-1″
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Great Oppportunity,
To: Recipients <peter.emery@maine.edu>
From:
“Mrs. Wendy” <peter.emery@maine.edu>
Date: Wed, 28 Nov 2012 08:30:48 -0800
Reply-To: mrs.wendy_wong@e-mail.ua
X-DCC–Metrics: beryl.its.maine.edu; whitelist
X-MailScanner-Information: Please contact the ISP for more information
X-UmaineSystem-MailScanner-ID: qAS8OAJw017124
X-MailScanner: spam detected
X-MailScanner-From: peter.emery@maine.edu
X-UmaineSystem-MailScanner-Watermark: 1354696308.24131@1kLhTD2+2mKYNx+1chJ8iQ
Content-Length: 130
From: Mrs. Wendy – peter.emery@maine.edu – peter.emery@maine.edu – beryl.its.maine.edu; whitelist – mrs.wendy_wong@e-mail.ua – peter.emery@maine.edu

 

 

Project Honey Pot has detected behavior from the IP address consistent with that of a mail server and dictionary attacker. Below we’ve reported some other data associated with this IP. This interrelated data helps map spammers’ networks and aids in law enforcement efforts.

Example Messages Sent From 130.111.32.94
From: “Louis” <jingjasji58anrewn@msn.com>
Subject: {SPAM?} =?GB2312?B?M0QvMkQgQW5pbWF0aW9uIHNlcnZpY2V 
From: “Louis” <liasyasn72chiaisn@msn.com>
Subject: {SPAM?} =?GB2312?B?M0QvMkQgQW5pbWF0aW9uIHNlcnZpY2V 
From: “Rick” <jingjasji58anrewn@msn.com>
Subject: {SPAM?} =?GB2312?B?RGlnaXRhbCBQaG90byBFZGl0aW5nIFN 
From: “Rick” <liasyasn72chiaisn@msn.com>
Subject: {SPAM?} =?GB2312?B?RGlnaXRhbCBQaG90byBFZGl0aW5nIFN 
From: “Louis” <jingjasji58anrewn@msn.com>
Subject: {SPAM?} =?GB2312?B?QW5pbWF0ZWQgTW92aWUvVFYgU2VyaWV 
From: Becky Fortunato <bfortunato@msad54.org>
Subject: viimeinen ilmoitus 
From: “Mr.Manabu” <james.francis@umit.maine.edu>
Subject: Legal Matter, 
From: “Mr Manabu” <daniel.c.johnson@umit.maine.edu>
Subject: Legal matter, 
Associated Harvesters
115.124.113.133 | HS
207.150.196.55 | HS
74.208.154.143 | HS
69.77.186.118 | H
66.235.180.7 | HS
207.150.196.48 | HS
207.150.196.50 | HS
115.124.113.132 | HS
207.150.196.49 | HS
66.232.123.38 | HS
207.150.196.53 | HS
75.125.34.66 | H
58.208.115.103 | H
117.80.205.3 | H
221.6.75.146 | H
117.83.38.6 | H
112.81.29.28 | H
221.6.75.168 | H
117.81.121.215 | H
122.193.50.155 | H
221.6.75.187 | HS
121.228.10.146 | HR
81.43.158.144 | H
 
 

Tags: , , , , , , , , , , , , , ,

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: