#337401 by buried under 419s
Wed Aug 23, 2017 9:52 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by (Dovecot) with LMTP id Qa6cJJiFnVnBUQAAjbubUg
for <>; Wed, 23 Aug 2017 06:39:36 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 23 Aug 2017 06:39:36 -0700
Received: from [218.56.49.2] (port=42297 helo=mail.sdbb.gov.cn)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1dkVsY-0005QL-Nd
for ; Wed, 23 Aug 2017 06:39:36 -0700
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.sdbb.gov.cn (QZEOS V3.0) with ESMTP id 0A7882C0B3C;
Wed, 23 Aug 2017 21:21:35 +0800 (CST)
X-Virus-Scanned: amavisd-new at sdbb.gov.cn
X-Spam-Level: *******
Received: from mail.sdbb.gov.cn ([127.0.0.1])
by localhost (mail.sdbb.gov.cn [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id Q1q70jH6cl7j; Wed, 23 Aug 2017 21:21:34 +0800 (CST)
Received: from User (unknown [149.255.36.227])
by mail.sdbb.gov.cn (QZEOS V3.0) with ESMTPA id 34DA32C0166;
Wed, 23 Aug 2017 21:21:23 +0800 (CST)
Reply-To: <[email protected]>
From: "Federal Bureau of Investigation"<[email protected]>
Date: Wed, 23 Aug 2017 06:38:41 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Status: Yes, score=30.4
X-Spam-Score: 304
X-Spam-Bar: ++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: FEDERAL BUREAU OF INVESTIGATION 26 Federal Plaza, New York,
NY 10278, [...]
Content analysis details: (30.4 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
1.5 SUBJ_ALL_CAPS Subject is all capitals
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[218.56.49.2 listed in bb.barracudacentral.org]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[149.255.36.227 listed in zen.spamhaus.org]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[218.56.49.2 listed in psbl.surriel.com]
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
0.0 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.6 MSOE_MID_WRONG_CASE No description available.
2.0 FBI_SPOOF Claims to be FBI, but not from FBI domain
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FBI_MONEY The FBI wants to give you lots of money?
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** FROM OFFICE OF THE FBI
FEDERAL BUREAU OF INVESTIGATION
26 Federal Plaza,
New York, NY 10278,
United States of America.
It has come to the Notice of the authority of Federal Bureau of Investigation and
Money Laundering Monitoring Unit, Through our Intelligence Monitoring Network, That
you have an abandon cheque valued $12, 200,000.00 (Twelve Million, Two Hundred
Thousand United States Dollars) which was sent to you from the bank of Africa
through DHL Courier service. THE SAID CHEQUE, After due investigation was carried
out contrary to Article 102,Section 36,Sub-Section IV of the 1995 Financial and
Allied Decree 20,guiding money shipment.
With full apology, we wish to remind you of the consequences of shipping such amount
of money into the country without complying with the provisions of the financial
regulations and decree 20 of 2001 which stipulates that an amount of such magnitude
must be cleared of Money Laundering and Drug Clearance which will duly guarantee and
cover the money as being legitimately acquired. This cheque is now pending to be
release to your destination on the receipt of the above document.
By virtue of the powers conferred on us, in our capacity as the accredited agency to
fight crime we therefore wish that you are advised to bring to this office
Drug/Money Laundering Clearance Certificate immediately for the release of your
CHEQUE.
You are required to bring the sum of $250 to our office to be sent to the
appropriate office in charge of issuing the clearance in Africa if you do not have
it and failure to comply within 24 hours will result in have your cheque confiscated
and also charge you for money laundering.
Your immediate response and cooperation is highly anticipated.
J. Britt Johnson
Special Agent in Charge
New York.
Delivered-To:
Received: from
by (Dovecot) with LMTP id Qa6cJJiFnVnBUQAAjbubUg
for <>; Wed, 23 Aug 2017 06:39:36 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 23 Aug 2017 06:39:36 -0700
Received: from [218.56.49.2] (port=42297 helo=mail.sdbb.gov.cn)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1dkVsY-0005QL-Nd
for ; Wed, 23 Aug 2017 06:39:36 -0700
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.sdbb.gov.cn (QZEOS V3.0) with ESMTP id 0A7882C0B3C;
Wed, 23 Aug 2017 21:21:35 +0800 (CST)
X-Virus-Scanned: amavisd-new at sdbb.gov.cn
X-Spam-Level: *******
Received: from mail.sdbb.gov.cn ([127.0.0.1])
by localhost (mail.sdbb.gov.cn [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id Q1q70jH6cl7j; Wed, 23 Aug 2017 21:21:34 +0800 (CST)
Received: from User (unknown [149.255.36.227])
by mail.sdbb.gov.cn (QZEOS V3.0) with ESMTPA id 34DA32C0166;
Wed, 23 Aug 2017 21:21:23 +0800 (CST)
Reply-To: <[email protected]>
From: "Federal Bureau of Investigation"<[email protected]>
Date: Wed, 23 Aug 2017 06:38:41 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Status: Yes, score=30.4
X-Spam-Score: 304
X-Spam-Bar: ++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: FEDERAL BUREAU OF INVESTIGATION 26 Federal Plaza, New York,
NY 10278, [...]
Content analysis details: (30.4 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
1.5 SUBJ_ALL_CAPS Subject is all capitals
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[218.56.49.2 listed in bb.barracudacentral.org]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[149.255.36.227 listed in zen.spamhaus.org]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[218.56.49.2 listed in psbl.surriel.com]
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
0.0 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.6 MSOE_MID_WRONG_CASE No description available.
2.0 FBI_SPOOF Claims to be FBI, but not from FBI domain
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FBI_MONEY The FBI wants to give you lots of money?
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** FROM OFFICE OF THE FBI
FEDERAL BUREAU OF INVESTIGATION
26 Federal Plaza,
New York, NY 10278,
United States of America.
It has come to the Notice of the authority of Federal Bureau of Investigation and
Money Laundering Monitoring Unit, Through our Intelligence Monitoring Network, That
you have an abandon cheque valued $12, 200,000.00 (Twelve Million, Two Hundred
Thousand United States Dollars) which was sent to you from the bank of Africa
through DHL Courier service. THE SAID CHEQUE, After due investigation was carried
out contrary to Article 102,Section 36,Sub-Section IV of the 1995 Financial and
Allied Decree 20,guiding money shipment.
With full apology, we wish to remind you of the consequences of shipping such amount
of money into the country without complying with the provisions of the financial
regulations and decree 20 of 2001 which stipulates that an amount of such magnitude
must be cleared of Money Laundering and Drug Clearance which will duly guarantee and
cover the money as being legitimately acquired. This cheque is now pending to be
release to your destination on the receipt of the above document.
By virtue of the powers conferred on us, in our capacity as the accredited agency to
fight crime we therefore wish that you are advised to bring to this office
Drug/Money Laundering Clearance Certificate immediately for the release of your
CHEQUE.
You are required to bring the sum of $250 to our office to be sent to the
appropriate office in charge of issuing the clearance in Africa if you do not have
it and failure to comply within 24 hours will result in have your cheque confiscated
and also charge you for money laundering.
Your immediate response and cooperation is highly anticipated.
J. Britt Johnson
Special Agent in Charge
New York.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces