Will the PRA enable me to say this is a forgery?
Because this spam will very likely get through most per-user Bayesian (unless
names such as "Olusegun Obasanjo" are used on future spam runs), and there
isn't a url in the e-mail to correlate.
Doing domain reputation of "sina.com" (or change it to "hotmail.com"
hypothetically) could cause many false positives, and this would apply even if
Return-Path == From.
The only ways I see to possibly catch a spam like this without causing false
positives is to use a much higher degree of cross-correlation (I will not
elaborate).
P.S. the recipient is me personally so no privacy has been compromised by
publishing this spam
X-Persona: <Earthlink>
Status: U
Return-Path: <ruoeoypvnz(_at_)sina(_dot_)com>
Received: from sina.com ([195.166.233.55])
by bunting (EarthLink SMTP Server) with SMTP id 1c1f5B2cD3NZFmR0
for <coolpage(_at_)earthlink(_dot_)net>; Sat, 28 Aug 2004 19:06:33
-0700 (PDT)
From: V M U <vinukpo(_at_)excite(_dot_)com>
To: coolpage <coolpage(_at_)earthlink(_dot_)net>
Subject: Trapped Money
X-Priority: 3
X-MSMail-Priority: Normal
Reply-To: V M U <vinukpo(_at_)excite(_dot_)com>
mime-version: 1.0
content-type: multipart/mixed;
boundary="qzsoft_directmail_seperator"
Message-Id: <200408281906(_dot_)1c1f5B2cD3NZFmR0(_at_)bunting>
Date: Sat, 28 Aug 2004 19:06:33 -0700 (PDT)
X-ELNK-AV: 0
Sir,
We are top officials of the Federal Government Contract Review Panel who are
interested in importation of goods into our country with money that are
presently trapped in my country. In order to commence this business, we
solicit your assistance to enable us transfer into your account the sum of
31,320,000.00 (Thirty-One Million, Three Hundred and Twenty thousand
American Hard Currency) which is presently trapped in the apex bank of my
country.
The source of the fund is as follows: During the regime of the last Military
transitional government officials set up companies and awarded themselves
contracts which were grossly over invoiced in various ministries.
The present democratic government of President Olusegun Obasanjo set up the
Contract Review Panel and we have identified a lot of inflated contract
money that are presently floating within the apex bank ready for payment.
However, by virtue of our position as civil servants and members of this
panel, we cannot acquire this money in our names. I have therefore been
delegated by my colleagues in the panel, to look for an oversea partner into
whose account we would transfer the trapped money which we hope to use in
purchasing Agro Allied equipment, and to enable us to own properties and
invest in the stable economy of your country. Hence, we are sending you this
email message. We have agreed to share the money thus:
1. 20% for the account owner (you)
2. 70% for us (the officials of the CRP)
3. 10% to be used in settling taxation and all local and foreign expenses.
Please acknowledge receipt of this message for proper briefing on the safe
modality for the execution by sending us the following:
FULL NAME, COMPANY NAME, OFFICE AND HOME ADDRESSES, PRIVATE TEL/FAX NUMBERS.
These information's we shall use to commence the transfer of the money into
your account. Upon your positive response we shall provide you with our
contact Tel/Fax numbers.
Yours faithfully
CHIEF. VINCENT UKP