2 October 2012

Spam assasin

This is the most aggressive scam i received until now.
Similar to this report.
From: Hakeem Mohammad [Hakeem@killer.pk]
Sent: monday 1 october 2012 16:55
To: Recipients
Subject: Reply Me Immediately

To your attention

I want you to read this message very carefully and that you keep the secret until further notice. You do not need to know or who I am or where I come from. I was paid an advance of $50,000 to eliminate you. My sponsors one of which is what we can call a friend gave me the reasons I noted. I am more than ten days and now I know that you are innocent of what you are accused. Do not try to warn or send this message to the FBI or the police because I know that I'll have to do the job for which I was paid. Note that this is the first time that I betrayed my employer.

Look, I'll do everything I can so that we can meet before but I need $20,000. You have nothing to afraid of me, I can come see you in your office or home, it is up to you to decide. Never attempt recording or filming our upcoming meeting. It will pay $20,000 to the account I will tell you, this before our first meeting. Once payment is made, I will give you the file that contains the names and queries sponsors. This is a good evidence that can be used to sue if you wish. The balance of the payment will be settled later. For the moment this is not the trouble I give you my phone number because you will cooperate. I have your picture and other important information about you. I was involved with my team in the Yemen
Arab Republic. You must not ask me any questions.

Quickly confirm for your good.


  1. Where did the header information say the email originated?

  2. > Here it is, commented out our receiving server
    Received: from mail.cusat.ac.in ( by mail.xx.xx
    ( with Microsoft SMTP Server id; Mon, 1 Oct 2012
    21:55:03 +0200
    Received: from localhost (localhost.localdomain []) by
    mail.cusat.ac.in (Postfix) with ESMTP id C251DCA2557; Mon, 1 Oct 2012
    20:22:29 +0530 (IST)
    X-Virus-Scanned: amavisd-new at cusat.ac.in
    Received: from mail.cusat.ac.in ([]) by localhost (mail.cusat.ac.in
    []) (amavisd-new, port 10024) with ESMTP id P1TLkMed9ogu; Mon, 1
    Oct 2012 20:22:29 +0530 (IST)
    Received: from [] (unknown []) by mail.cusat.ac.in
    (Postfix) with ESMTPSA id 0159ECA2355; Mon, 1 Oct 2012 20:21:37 +0530 (IST)
    Content-Type: text/plain; charset="iso-8859-1"
    MIME-Version: 1.0
    Content-Transfer-Encoding: quoted-printable
    Content-Description: Mail message body
    Subject: Reply Me Immediately
    To: Recipients
    From: Hakeem Mohammad
    Date: Mon, 1 Oct 2012 08:55:40 -0600
    Reply-To: hmohammadkill@yahoo.com
    X-Antivirus: avast! (VPS 121001-0, 10/01/2012), Outbound message
    X-Antivirus-Status: Clean
    Message-ID: <20121001145140.0159ECA2355@mail.cusat.ac.in>
    Return-Path: Hakeem@killer.pk
    X-MS-Exchange-Organization-PRD: killer.pk
    Received-SPF: Fail (mail2.xx.xx: domain of Hakeem@killer.pk does not
    designate as permitted sender) receiver=mail2.xx.xx;
    client-ip=; helo=mail.cusat.ac.in;
    X-MS-Exchange-Organization-PCL: 2
    X-MS-Exchange-Organization-Antispam-Report: DV:3.3.11801.452;SV:3.3.9010.377;SID:SenderIDStatus
    X-MS-Exchange-Organization-SCL: 7
    X-MS-Exchange-Organization-SenderIdResult: FAIL