#325898 by buried under 419s
Sat Apr 22, 2017 1:05 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 22 Apr 2017 09:07:03 -0700
Received: from [111.89.179.159] (port=54126 helo=www.myfood.jp)
by with esmtp (Exim 4.88)
(envelope-from <[email protected]>)
id 1d1xYr-0003pK-FX
for ; Sat, 22 Apr 2017 09:07:03 -0700
Received: from User (unknown [197.220.169.139])
by www.myfood.jp (Postfix) with ESMTP id 5CCF55147CD;
Sat, 22 Apr 2017 00:24:38 +0900 (JST)
Reply-To: <[email protected]>
From: "Mr. Robert Wilson"<[email protected]>
Date: Fri, 21 Apr 2017 13:25:05 -0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: Avast (VPS 170420-10, 04/20/2017), Outbound message
X-Antivirus-Status: Clean
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Status: Yes, score=33.1
X-Spam-Score: 331
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear Friend My name is Mr. Robert Wilson, I am one of the
branch manager of foreign remittance of my Bank. I am writing to seek your
cooperation over this business deal.Please, no matter how strange or surprising
this business might seem to you as we have not met personally or had any
dealings before ,the aim of this letter is business that will benefit the
both of us. This fund is the excess of what my branch in which I am work made
as profit during the year in my Head Office and they will never know of this
Excess. [...]
Content analysis details: (33.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(irene.1714[at]outlook.com)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[111.89.179.159 listed in bl.score.senderscore.com]
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[111.89.179.159 listed in bb.barracudacentral.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[111.89.179.159 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?197.220.169.139>]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[197.220.169.139 listed in zen.spamhaus.org]
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (irene.1714[at]outlook.com)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(willbert1417[at]yahoo.com)
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[111.89.179.159 listed in dnsbl.sorbs.net]
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 FROM_MISSP_USER From misspaced, from "User"
2.6 MSOE_MID_WRONG_CASE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_MONEY_PERCENT X% of a lot of money for you
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
X-Spam-Flag: YES
Subject: ***SPAM*** Legit Source
Dear Friend
My name is Mr. Robert Wilson, I am one of the branch manager of foreign remittance
of my Bank. I am writing to seek your cooperation over this business deal.Please, no
matter how strange or surprising this business might seem to you as we have not met
personally or had any dealings before ,the aim of this letter is business that will
benefit the both of us. This fund is the excess of what my branch in which I am work
made as profit during the year in my Head Office and they will never know of this
Excess.
I have since then, placed this amount of US$7,500,000.00 (Seven Million Five hundred
Thousand United States Dollars) on a SUSPENSE ACCOUNT without a beneficiary.As an
officer of the bank, I cannot be directly connected to this money thus I request for
your assistance to receive this money into your bank account.
I intend to part 30% of this fund to you while 70% shall be for me. It is going to
be a bank-to-bank Wire transfer to your nominated bank account anywhere you feel
safer.All I need from you is to stand as the original depositor of this fund.
With regards,
Mr. Robert Wilson
Envelope-to:
Delivery-date: Sat, 22 Apr 2017 09:07:03 -0700
Received: from [111.89.179.159] (port=54126 helo=www.myfood.jp)
by with esmtp (Exim 4.88)
(envelope-from <[email protected]>)
id 1d1xYr-0003pK-FX
for ; Sat, 22 Apr 2017 09:07:03 -0700
Received: from User (unknown [197.220.169.139])
by www.myfood.jp (Postfix) with ESMTP id 5CCF55147CD;
Sat, 22 Apr 2017 00:24:38 +0900 (JST)
Reply-To: <[email protected]>
From: "Mr. Robert Wilson"<[email protected]>
Date: Fri, 21 Apr 2017 13:25:05 -0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: Avast (VPS 170420-10, 04/20/2017), Outbound message
X-Antivirus-Status: Clean
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Status: Yes, score=33.1
X-Spam-Score: 331
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear Friend My name is Mr. Robert Wilson, I am one of the
branch manager of foreign remittance of my Bank. I am writing to seek your
cooperation over this business deal.Please, no matter how strange or surprising
this business might seem to you as we have not met personally or had any
dealings before ,the aim of this letter is business that will benefit the
both of us. This fund is the excess of what my branch in which I am work made
as profit during the year in my Head Office and they will never know of this
Excess. [...]
Content analysis details: (33.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(irene.1714[at]outlook.com)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[111.89.179.159 listed in bl.score.senderscore.com]
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[111.89.179.159 listed in bb.barracudacentral.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[111.89.179.159 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?197.220.169.139>]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[197.220.169.139 listed in zen.spamhaus.org]
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (irene.1714[at]outlook.com)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(willbert1417[at]yahoo.com)
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[111.89.179.159 listed in dnsbl.sorbs.net]
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 FROM_MISSP_USER From misspaced, from "User"
2.6 MSOE_MID_WRONG_CASE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_MONEY_PERCENT X% of a lot of money for you
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
X-Spam-Flag: YES
Subject: ***SPAM*** Legit Source
Dear Friend
My name is Mr. Robert Wilson, I am one of the branch manager of foreign remittance
of my Bank. I am writing to seek your cooperation over this business deal.Please, no
matter how strange or surprising this business might seem to you as we have not met
personally or had any dealings before ,the aim of this letter is business that will
benefit the both of us. This fund is the excess of what my branch in which I am work
made as profit during the year in my Head Office and they will never know of this
Excess.
I have since then, placed this amount of US$7,500,000.00 (Seven Million Five hundred
Thousand United States Dollars) on a SUSPENSE ACCOUNT without a beneficiary.As an
officer of the bank, I cannot be directly connected to this money thus I request for
your assistance to receive this money into your bank account.
I intend to part 30% of this fund to you while 70% shall be for me. It is going to
be a bank-to-bank Wire transfer to your nominated bank account anywhere you feel
safer.All I need from you is to stand as the original depositor of this fund.
With regards,
Mr. Robert Wilson
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces