Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#394779 by buried under 419s Mon Aug 19, 2019 8:33 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id UD0uAyVpWl0WUgAAjbubUg
for <>; Mon, 19 Aug 2019 02:17:25 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 19 Aug 2019 02:17:25 -0700
Received: from mail-qt1-f193.google.com ([209.85.160.193]:34651)
by with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hzdmx-0005Rg-Fz
for ; Mon, 19 Aug 2019 02:17:24 -0700
Received: by mail-qt1-f193.google.com with SMTP id q4so1123867qtp.1
for <>; Mon, 19 Aug 2019 02:16:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:from:date:message-id:subject:to;
bh=kJPrbvHd1b87k8mRdKNVXjl6vcwb10XbOlLtubJLjzo=;
b=g5XlQVqytE2LLl3fg1BzINUJ93CxxuSG/aTkRL3yRjjzsjst0WdfTYmNALUFOeIUwE
9HehfpTt1uC11gwZ8GckogvHYT87OVgtpQd800YbXqHW9TIA3AaLuD0B00Np0nP5QekX
q7MyQlTjCTx6BJuv5E34XM0RpQn0xh2/WOQwqUZszb0d+bSZ9T16wjyocykgD8bpe2Gj
duXOM/E6Ns7WeAJAMZoNqE4yna3iTVHc/+kzWEqJb6VLB4mLpKfftXBi24gakhiStZob
ESEPdYiJh2v8lYyEatztxB6sAtMjmL4AUF88YlmO8RihOUgQ0qXGQNvqjoU4WfuBPR6y
9NwQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=kJPrbvHd1b87k8mRdKNVXjl6vcwb10XbOlLtubJLjzo=;
b=TlxUkgTv4itV0+wB/QFSfTNUxQOBzM1cjolyX9MPtdsdCfb8zWyH6C991GjLSe+9s8
Ru6ReiW0WwSvjuVVE9qYmxScr/oOZWoxA+07od4hBEj/a9XPKcs1NfZZFeqtEjtKnsOu
9rginKY4uu1ysulYA7isdF6Q5TFKneW+4s5281U0mPmPRIypFWDrKNrkjD3eHisfSmp2
R23QkHJUsY3uMfGzWaRuQtarr6Dpsyd0Taw4Djw5X3Ljcp+9qrJ0bZQCqs8gufNWGRTI
HHaML3Bma3wQQZXpM4w+FlhwBDCTDCqeJMSP301VueAiTwOLywIzHjdC5gBPjAdRl7oa
zQ4Q==
X-Gm-Message-State: APjAAAXA7K98juVU5xWeqGY9lZCWpFqzjZKwnFUBKoiHyDeHWryLeRV9
oekkjl5vgTePcHbcvn4ywjlBKn+b95NZUjSu2TE=
X-Google-Smtp-Source: APXvYqxyc6UVh6IAW8SwSfVYahbXEIlcr4B7TE+kvOJzFC3FTmMWBVk9hi/Dhzqd1U7gIe+NGMFuTBO24PmWldp0cns=
X-Received: by 2002:ac8:548c:: with SMTP id h12mr19623130qtq.273.1566206198145;
Mon, 19 Aug 2019 02:16:38 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:aed:24a8:0:0:0:0:0 with HTTP; Mon, 19 Aug 2019 02:16:37
-0700 (PDT)
From: ROGER WILLIAMS <[email protected]>
Date: Mon, 19 Aug 2019 02:16:37 -0700
Message-ID: <CAPOVSdN72zXHMBpH1ob=CsWirsp2cGxGZberAVn=Rvkkqhk32A@mail.gmail.com>
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc:
X-Spam-Status: Yes, score=8.3
X-Spam-Score: 83
X-Spam-Bar: ++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: Dear, With due respect sir, Be inform that an arrangement
has been concluded to move your payment in cash to your country or a closer
country to your Country. While the need of bringing it to a closer country
to your country is being included in this arrangement is because if we can
not secure a Diplomatic land pass to your country we will secure it from
a closer country to your country to enable you meet our delivery officers
for delivery. [...]

Content analysis details: (8.3 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
trust
[209.85.160.193 listed in list.dnswl.org]
0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.193 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(rogerwillams5050[at]gmail.com)
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (rogerwillams5050[at]gmail.com)
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
2.2 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** Dear Beneficial


Dear,

With due respect sir, Be inform that an arrangement has been concluded
to move your payment in cash to your country or a closer country to
your Country. While the need of bringing it to a closer country to
your country is being included in this arrangement is because if we
can not secure a Diplomatic land pass to your country we will secure
it from a closer country to your country to enable you meet our
delivery officers for delivery.

However, it will be nice if you can visit our delivery center in INDIA
for delivery. Note that there is no upfront charges in this
regard till you see your fund with your two naked eyes, and from there
you and our delivery officer will discuss way out to actualize your
payment in your favour.

As soon as I receive your positive response to proceed for the
actualization of this payment in your favour, I shall furnish you with
all the procedure for this payment.
Regards,

Roger Williams
Diplomat from Office of Foreign Payment Unit.

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
Advertisement

Who is online

Users browsing this forum: No registered users and 70 guests