#320078 by buried under 419s
Tue Feb 21, 2017 5:10 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by (Dovecot) with LMTP id SaoEHb/nq1iWPQAAjbubUg
for <>; Mon, 20 Feb 2017 23:09:51 -0800
Return-path: <[email protected]>
Envelope-to: m
Delivery-date: Mon, 20 Feb 2017 23:09:51 -0800
Received: from [115.124.94.101] (port=41489 helo=surabayapagi.surabayapagi.com)
by with esmtp (Exim 4.87)
(envelope-from <[email protected]>)
id 1cg4a5-00045p-2a
for ; Mon, 20 Feb 2017 23:09:51 -0800
Received: from User (unknown [177.66.30.49])
by surabayapagi.surabayapagi.com (Postfix) with SMTP id 19B1136E97D;
Tue, 21 Feb 2017 12:06:59 +0700 (WIB)
Reply-To: <[email protected]>
From: "General Welile Nhlapo"<[email protected]>
To: [email protected]
Date: Tue, 21 Feb 2017 02:07:18 -0300
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=26.7
X-Spam-Score: 267
X-Spam-Bar: ++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Hi, I am the new National Security Adviser General Welile
Nhlapo to the President Jacob Zuma of South Africa. I am delighted to inform
in pretoria just released your name among inheritance to benefit from the
Diplomatic Immunity Payment. This Panel was primarily delegated to investigate
manipulated contract claims, contracts and over-invoiced payment as the effect
has eaten deep into the economy of our dear country. [...]
Content analysis details: (26.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 HK_SCAM_N2 BODY: No description available.
2.4 UNCLAIMED_MONEY BODY: People just leave money laying around
0.6 URG_BIZ BODY: Contains urgent matter
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 HK_RANDOM_FROM From username looks random
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
0.0 NSL_RCVD_FROM_USER Received from User
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[115.124.94.101 listed in bb.barracudacentral.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(generwalnhbgdfdbfd[at]outlook.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_USER From misspaced, from "User"
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.6 MISSING_MID Missing Message-Id: header
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Your boxes are schedule to live as soon as we hear from you.
Hi,
However, we wish to bring to your notice that your Inheritance Next of
Kin/Inheritance profile is still reflecting in our central computer as unpaid while
auditing was going on. Your Inheritance file was forwarded to my office by the
auditors as unclaimed fund, we wish to use this medium to inform you that for the
time being Federal Government of South Africa have stopped further payment through
bank to bank transfer due to Inheritance numerous petitions to United Nations
against on wrong payment and diversion of Next of Kin/Inheritance funds to different
account.
In this regards we are going to send your Next of Kin/Inheritance part payment of
10.5Million USD to you via our accredited shipping company and I have secured every
needed documents to cover the money. Note: The money is coming on security proof
box. The boxes are sealed with synthetic nylon seal and padded with machine and be
advised that the only fee you will pay is the sum of $325 for the AIRWAY BILL fee.
Therefore, Below you will find the information to send the fee through Money Gram
and respond back with the payment information.
Receivers Name: Miss Cleredene B. Randall
Address: Johannesburg,South Africa
Tex Question: Very
Answer: Important
MTCN....
Please you don't have to worry for anything, as the transaction is 100% risk free.
The boxes are coming with a Diplomatic agent who will accompany the boxes to your
house address. All you need to do now is to reconfirm to me your
Full Name.....
House address... .
Your identity such as, international Passport or drivers license
Your mobile phone and telephone number,
The Diplomat will attach it on his travel documents. He will call you immediately he
arrives in your country's airport. I hope you understand me.
Note: The diplomat does not know the original contents of the boxes. What l declared
to them as the contents is Sensitive Photographic Film Materials for security
reasons. I did not declare money to them please. If they call you and ask you the
contents please tell them the same thing Ok, call me on my direct phone
(+27633804574) or Fax: (+27633804576) and I will let you know how far I have gone
with the arrangement. Please I need urgent reply because the boxes are schedule to
live as soon as we hear from you. You Call me immediately.
Congratulations.
Best Regards,
General Welile Nhlapo.
National Security Adviser to the President
South Africa.
Direct Tel: +27633804574
Email: [email protected]
Delivered-To:
Received: from
by (Dovecot) with LMTP id SaoEHb/nq1iWPQAAjbubUg
for <>; Mon, 20 Feb 2017 23:09:51 -0800
Return-path: <[email protected]>
Envelope-to: m
Delivery-date: Mon, 20 Feb 2017 23:09:51 -0800
Received: from [115.124.94.101] (port=41489 helo=surabayapagi.surabayapagi.com)
by with esmtp (Exim 4.87)
(envelope-from <[email protected]>)
id 1cg4a5-00045p-2a
for ; Mon, 20 Feb 2017 23:09:51 -0800
Received: from User (unknown [177.66.30.49])
by surabayapagi.surabayapagi.com (Postfix) with SMTP id 19B1136E97D;
Tue, 21 Feb 2017 12:06:59 +0700 (WIB)
Reply-To: <[email protected]>
From: "General Welile Nhlapo"<[email protected]>
To: [email protected]
Date: Tue, 21 Feb 2017 02:07:18 -0300
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=26.7
X-Spam-Score: 267
X-Spam-Bar: ++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Hi, I am the new National Security Adviser General Welile
Nhlapo to the President Jacob Zuma of South Africa. I am delighted to inform
in pretoria just released your name among inheritance to benefit from the
Diplomatic Immunity Payment. This Panel was primarily delegated to investigate
manipulated contract claims, contracts and over-invoiced payment as the effect
has eaten deep into the economy of our dear country. [...]
Content analysis details: (26.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 HK_SCAM_N2 BODY: No description available.
2.4 UNCLAIMED_MONEY BODY: People just leave money laying around
0.6 URG_BIZ BODY: Contains urgent matter
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 HK_RANDOM_FROM From username looks random
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
0.0 NSL_RCVD_FROM_USER Received from User
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[115.124.94.101 listed in bb.barracudacentral.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(generwalnhbgdfdbfd[at]outlook.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_USER From misspaced, from "User"
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.6 MISSING_MID Missing Message-Id: header
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Your boxes are schedule to live as soon as we hear from you.
Hi,
However, we wish to bring to your notice that your Inheritance Next of
Kin/Inheritance profile is still reflecting in our central computer as unpaid while
auditing was going on. Your Inheritance file was forwarded to my office by the
auditors as unclaimed fund, we wish to use this medium to inform you that for the
time being Federal Government of South Africa have stopped further payment through
bank to bank transfer due to Inheritance numerous petitions to United Nations
against on wrong payment and diversion of Next of Kin/Inheritance funds to different
account.
In this regards we are going to send your Next of Kin/Inheritance part payment of
10.5Million USD to you via our accredited shipping company and I have secured every
needed documents to cover the money. Note: The money is coming on security proof
box. The boxes are sealed with synthetic nylon seal and padded with machine and be
advised that the only fee you will pay is the sum of $325 for the AIRWAY BILL fee.
Therefore, Below you will find the information to send the fee through Money Gram
and respond back with the payment information.
Receivers Name: Miss Cleredene B. Randall
Address: Johannesburg,South Africa
Tex Question: Very
Answer: Important
MTCN....
Please you don't have to worry for anything, as the transaction is 100% risk free.
The boxes are coming with a Diplomatic agent who will accompany the boxes to your
house address. All you need to do now is to reconfirm to me your
Full Name.....
House address... .
Your identity such as, international Passport or drivers license
Your mobile phone and telephone number,
The Diplomat will attach it on his travel documents. He will call you immediately he
arrives in your country's airport. I hope you understand me.
Note: The diplomat does not know the original contents of the boxes. What l declared
to them as the contents is Sensitive Photographic Film Materials for security
reasons. I did not declare money to them please. If they call you and ask you the
contents please tell them the same thing Ok, call me on my direct phone
(+27633804574) or Fax: (+27633804576) and I will let you know how far I have gone
with the arrangement. Please I need urgent reply because the boxes are schedule to
live as soon as we hear from you. You Call me immediately.
Congratulations.
Best Regards,
General Welile Nhlapo.
National Security Adviser to the President
South Africa.
Direct Tel: +27633804574
Email: [email protected]
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces