#345689 by buried under 419s
Sat Nov 18, 2017 11:47 am
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 18 Nov 2017 03:33:38 -0800
Received: from web1.irtel.ru ([195.46.105.233]:49390)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1eG1NN-0005av-Da
for ; Sat, 18 Nov 2017 03:33:38 -0800
Received: from 220-130-60-137.hinet-ip.hinet.net ([220.130.60.137] helo=User)
by web1.irtel.ru with esmtpa (Exim 4.75 (FreeBSD))
(envelope-from <[email protected]>)
id 1eG0RG-000FFV-0P; Sat, 18 Nov 2017 18:33:30 +0800
Reply-To: <[email protected]>
From: "Ahmad Azzim"<[email protected]>
Date: Sat, 18 Nov 2017 19:27:58 +0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=23.5
X-Spam-Score: 235
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Hello Friend I am Mr.Ahmad Azzim , the Head of Accounting
Audit Committee Department of CIMB Bank Berhad Malaysia. This is about a business
proposal that will be of an immense benefit for both of us. [...]
Content analysis details: (23.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 HK_SCAM_N2 BODY: No description available.
0.0 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[195.46.105.233 listed in bb.barracudacentral.org]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[195.46.105.233 listed in dnsbl.sorbs.net]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[195.46.105.233 listed in list.dnswl.org]
1.0 MISSING_HEADERS Missing To: header
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.6 MSOE_MID_WRONG_CASE No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.0 FROM_MISSPACED From: missing whitespace
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 T_MONEY_PERCENT X% of a lot of money for you
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Business proposal
Hello Friend
I am Mr.Ahmad Azzim , the Head of Accounting Audit Committee Department of CIMB Bank
Berhad Malaysia. This is about a business proposal that will be of an immense
benefit for both of us.
In my department, I discovered an abandoned sum of $15.6 Million US Dollars in an
account that belongs to one of our late foreign customer Mr Robert Lawton, an
Australian businessman and who was one of the victim of Malaysia Airlines Flight 370
(MH370/MAS370) which crashed in the south of the Indian Ocean on March 8, 2014 from
Kuala Lumpur International Airport to Beijing Capital International Airport killing
all on board including his wife Mrs Lawton Catherine
Mr Robert Lawton and Mrs. Lawton Catherine are number 64/65 on the list; see the
link below manifest of the flight:
https://drive.google.com/file/d/0B-LI9d ... Dg/preview
Since their death, our bank has been waiting for the next of kin to come for the
claim of their money and goods valued the sum of $15.6 Million US Dollars. But
nobody has done so, I personally have failed in the search for her relatives, I seek
your consent to present you to the bank as the next of kin of the deceased so that
the proceeds of this account valued at $15.6 Million US Dollars. Can be paid to you.
The deal will be divided in this ratio: 50% for me and 50% for you. I have in my
possession all the necessary and important documents that can be used in this
business. I need your honest Co-operation, Confidentiality and Trust to enable us
sees this transaction through.
I guarantee you 100% success in this business; you can be rest assured that this
transaction is executed under a legitimate arrangement that will protect you from
any breach of the law both here and in your country.
If you are handling this deal, kindly provide me with the following details so that
I could upload them here in our bank's database as the rightful beneficiary to this
fund:
1, your first full name:
2, your private telephone numbers (office and mobile)
3, private fax number:
4, your full address:
5, Your Age / Gender:
6, your job / profession:
7, Private / alternative e-mail address:
8, Nationality:
Having gone through a methodical search, I decided to contact you, hoping that you
will find this proposal interesting, please on your confirmation of this message and
indicating your interest I will provide you with more information.
Please let me know your decision rather than keep me waiting. Note: Do not forget
that this business requires absolute secrecy and has to be done as quickly as
possible.
Best regards,
e-mail: [email protected]
Mr. Ahmad Azzim
Envelope-to:
Delivery-date: Sat, 18 Nov 2017 03:33:38 -0800
Received: from web1.irtel.ru ([195.46.105.233]:49390)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1eG1NN-0005av-Da
for ; Sat, 18 Nov 2017 03:33:38 -0800
Received: from 220-130-60-137.hinet-ip.hinet.net ([220.130.60.137] helo=User)
by web1.irtel.ru with esmtpa (Exim 4.75 (FreeBSD))
(envelope-from <[email protected]>)
id 1eG0RG-000FFV-0P; Sat, 18 Nov 2017 18:33:30 +0800
Reply-To: <[email protected]>
From: "Ahmad Azzim"<[email protected]>
Date: Sat, 18 Nov 2017 19:27:58 +0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=23.5
X-Spam-Score: 235
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Hello Friend I am Mr.Ahmad Azzim , the Head of Accounting
Audit Committee Department of CIMB Bank Berhad Malaysia. This is about a business
proposal that will be of an immense benefit for both of us. [...]
Content analysis details: (23.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 HK_SCAM_N2 BODY: No description available.
0.0 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[195.46.105.233 listed in bb.barracudacentral.org]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[195.46.105.233 listed in dnsbl.sorbs.net]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[195.46.105.233 listed in list.dnswl.org]
1.0 MISSING_HEADERS Missing To: header
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.6 MSOE_MID_WRONG_CASE No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.0 FROM_MISSPACED From: missing whitespace
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 T_MONEY_PERCENT X% of a lot of money for you
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Business proposal
Hello Friend
I am Mr.Ahmad Azzim , the Head of Accounting Audit Committee Department of CIMB Bank
Berhad Malaysia. This is about a business proposal that will be of an immense
benefit for both of us.
In my department, I discovered an abandoned sum of $15.6 Million US Dollars in an
account that belongs to one of our late foreign customer Mr Robert Lawton, an
Australian businessman and who was one of the victim of Malaysia Airlines Flight 370
(MH370/MAS370) which crashed in the south of the Indian Ocean on March 8, 2014 from
Kuala Lumpur International Airport to Beijing Capital International Airport killing
all on board including his wife Mrs Lawton Catherine
Mr Robert Lawton and Mrs. Lawton Catherine are number 64/65 on the list; see the
link below manifest of the flight:
https://drive.google.com/file/d/0B-LI9d ... Dg/preview
Since their death, our bank has been waiting for the next of kin to come for the
claim of their money and goods valued the sum of $15.6 Million US Dollars. But
nobody has done so, I personally have failed in the search for her relatives, I seek
your consent to present you to the bank as the next of kin of the deceased so that
the proceeds of this account valued at $15.6 Million US Dollars. Can be paid to you.
The deal will be divided in this ratio: 50% for me and 50% for you. I have in my
possession all the necessary and important documents that can be used in this
business. I need your honest Co-operation, Confidentiality and Trust to enable us
sees this transaction through.
I guarantee you 100% success in this business; you can be rest assured that this
transaction is executed under a legitimate arrangement that will protect you from
any breach of the law both here and in your country.
If you are handling this deal, kindly provide me with the following details so that
I could upload them here in our bank's database as the rightful beneficiary to this
fund:
1, your first full name:
2, your private telephone numbers (office and mobile)
3, private fax number:
4, your full address:
5, Your Age / Gender:
6, your job / profession:
7, Private / alternative e-mail address:
8, Nationality:
Having gone through a methodical search, I decided to contact you, hoping that you
will find this proposal interesting, please on your confirmation of this message and
indicating your interest I will provide you with more information.
Please let me know your decision rather than keep me waiting. Note: Do not forget
that this business requires absolute secrecy and has to be done as quickly as
possible.
Best regards,
e-mail: [email protected]
Mr. Ahmad Azzim
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces