#375114 by buried under 419s
Sun Oct 21, 2018 2:07 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sun, 21 Oct 2018 10:59:36 -0700
Received: from [202.158.114.78] (port=44781 helo=cpanel.wellcommshop.com)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1gEI0j-00076G-Ck
for ; Sun, 21 Oct 2018 10:59:36 -0700
Received: from [197.174.192.49] (port=61247 helo=User)
by cpanel.wellcommshop.com with esmtpa (Exim 4.87)
(envelope-from <[email protected]>)
id 1gEHzM-0004Qg-1d; Mon, 22 Oct 2018 00:58:08 +0700
Reply-To: <[email protected]>
From: "Ibrahim Adamu"<[email protected]>
Date: Sun, 21 Oct 2018 19:58:08 +0200
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: Avast (VPS 181021-2, 10/21/2018), Outbound message
X-Antivirus-Status: Clean
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cpanel.wellcommshop.com
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - net-c.com
X-Get-Message-Sender-Via: cpanel.wellcommshop.com: authenticated_id: [email protected]
X-Authenticated-Sender: cpanel.wellcommshop.com: [email protected]
X-Spam-Status: Yes, score=35.3
X-Spam-Score: 353
X-Spam-Bar: +++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Good Day, With due respect, I am HON. (DR.) Ibrahim Adamu,
the Account Officer with the Nigerian National Petroleum Cooperation,(NNPC)
It is with trust that I wish to contact you on this matter concerning payment
schedule for last fiscal year, which involves the name of Late Mr.Xie Zhenfeng
who was among the Dana Plane Crash Victims on Sunday June 3rd, 2012, on his
way back to Lagos from Abuja the Nigerian Capital and he died with no next
of kin to account for his estate here in Nigeria. You can read more of this
issue on the links below (usa.chinadaily.com.cn/world/2012-06/05/content_15473262.htm)
[...]
Content analysis details: (35.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
3.1 HK_SCAM_N2 BODY: No description available.
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[202.158.114.78 listed in bl.score.senderscore.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(ibhrahimadamu1803[at]aol.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 MISSING_HEADERS Missing To: header
2.0 MILLION_USD BODY: Talks about millions of dollars
1.4 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.6 MISSING_MID Missing Message-Id: header
2.5 KAM_NIGERIAN Nigerian Scam and Variants
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
2.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
0.0 T_REMOTE_IMAGE Message contains an external image
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.4 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.3 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Pay Attention
Good Day,
With due respect, I am HON. (DR.) Ibrahim Adamu, the Account Officer with the
Nigerian National Petroleum Cooperation,(NNPC) It is with trust that I wish to
contact you on this matter concerning payment schedule for last fiscal year, which
involves the name of Late Mr.Xie Zhenfeng who was among the Dana Plane Crash Victims
on Sunday June 3rd, 2012, on his way back to Lagos from Abuja the Nigerian Capital
and he died with no next of kin to account for his estate here in Nigeria. You can
read more of this issue on the links below
(usa.chinadaily.com.cn/world/2012-06/05/content_15473262.htm)
Sometime ago, a contract was executed by Mr.Xie Zhenfeng which was awarded to him by
(NNPC) of turn Around Maintenance and Rehabilitation Work. I write to solicit for
your partnership to claim his contract payment of $78M (Seventy Eight Million United
States Dollars only) that is now due/listed for payment.
As soon as I receive your agreement on this I will forward to you the payment
schedule where his name and amount was enlisted for payment.. PLEASE DIRECT YOUR
IMMEDIATE RESPONSE TO MY PRIVATE EMAIL ( [email protected] ) FOR QUICK
ATTENTION.
Waiting to hear from you,
Ibrahim Adamu
Mobile Tel: +234-8118225713
Envelope-to:
Delivery-date: Sun, 21 Oct 2018 10:59:36 -0700
Received: from [202.158.114.78] (port=44781 helo=cpanel.wellcommshop.com)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1gEI0j-00076G-Ck
for ; Sun, 21 Oct 2018 10:59:36 -0700
Received: from [197.174.192.49] (port=61247 helo=User)
by cpanel.wellcommshop.com with esmtpa (Exim 4.87)
(envelope-from <[email protected]>)
id 1gEHzM-0004Qg-1d; Mon, 22 Oct 2018 00:58:08 +0700
Reply-To: <[email protected]>
From: "Ibrahim Adamu"<[email protected]>
Date: Sun, 21 Oct 2018 19:58:08 +0200
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: Avast (VPS 181021-2, 10/21/2018), Outbound message
X-Antivirus-Status: Clean
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cpanel.wellcommshop.com
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - net-c.com
X-Get-Message-Sender-Via: cpanel.wellcommshop.com: authenticated_id: [email protected]
X-Authenticated-Sender: cpanel.wellcommshop.com: [email protected]
X-Spam-Status: Yes, score=35.3
X-Spam-Score: 353
X-Spam-Bar: +++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Good Day, With due respect, I am HON. (DR.) Ibrahim Adamu,
the Account Officer with the Nigerian National Petroleum Cooperation,(NNPC)
It is with trust that I wish to contact you on this matter concerning payment
schedule for last fiscal year, which involves the name of Late Mr.Xie Zhenfeng
who was among the Dana Plane Crash Victims on Sunday June 3rd, 2012, on his
way back to Lagos from Abuja the Nigerian Capital and he died with no next
of kin to account for his estate here in Nigeria. You can read more of this
issue on the links below (usa.chinadaily.com.cn/world/2012-06/05/content_15473262.htm)
[...]
Content analysis details: (35.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
3.1 HK_SCAM_N2 BODY: No description available.
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[202.158.114.78 listed in bl.score.senderscore.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(ibhrahimadamu1803[at]aol.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 MISSING_HEADERS Missing To: header
2.0 MILLION_USD BODY: Talks about millions of dollars
1.4 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.6 MISSING_MID Missing Message-Id: header
2.5 KAM_NIGERIAN Nigerian Scam and Variants
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
2.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
0.0 T_REMOTE_IMAGE Message contains an external image
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.4 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.3 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Pay Attention
Good Day,
With due respect, I am HON. (DR.) Ibrahim Adamu, the Account Officer with the
Nigerian National Petroleum Cooperation,(NNPC) It is with trust that I wish to
contact you on this matter concerning payment schedule for last fiscal year, which
involves the name of Late Mr.Xie Zhenfeng who was among the Dana Plane Crash Victims
on Sunday June 3rd, 2012, on his way back to Lagos from Abuja the Nigerian Capital
and he died with no next of kin to account for his estate here in Nigeria. You can
read more of this issue on the links below
(usa.chinadaily.com.cn/world/2012-06/05/content_15473262.htm)
Sometime ago, a contract was executed by Mr.Xie Zhenfeng which was awarded to him by
(NNPC) of turn Around Maintenance and Rehabilitation Work. I write to solicit for
your partnership to claim his contract payment of $78M (Seventy Eight Million United
States Dollars only) that is now due/listed for payment.
As soon as I receive your agreement on this I will forward to you the payment
schedule where his name and amount was enlisted for payment.. PLEASE DIRECT YOUR
IMMEDIATE RESPONSE TO MY PRIVATE EMAIL ( [email protected] ) FOR QUICK
ATTENTION.
Waiting to hear from you,
Ibrahim Adamu
Mobile Tel: +234-8118225713
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces