#334547 by buried under 419s
Thu Jul 20, 2017 8:28 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 20 Jul 2017 13:57:36 -0700
Received: from [47.90.2.98] (port=35914 helo=mail.yzshop.com.tw)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1dYIVr-0000h3-13
for ; Thu, 20 Jul 2017 13:57:36 -0700
Received: from User (unknown [37.49.224.215])
by mail.yzshop.com.tw (Postfix) with SMTP id E8D665E602A;
Fri, 21 Jul 2017 04:56:36 +0800 (CST)
Reply-To: <[email protected]>
From: "Robert Philip"<[email protected]>
To: [email protected]
Date: Thu, 20 Jul 2017 22:55:38 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=30.9
X-Spam-Score: 309
X-Spam-Bar: ++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: To your attention: My client is looking for lucrative Investment
Opportunities in your Country or in any Country that may be advised by you.
Therefore, the proposed Investments Amount by my client will be made available
to you in a clean and clear terms should you find this offer interesting.
[...]
Content analysis details: (30.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[47.90.2.98 listed in bb.barracudacentral.org]
2.6 RCVD_IN_SORBS_SMTP RBL: SORBS: sender is open SMTP relay
[47.90.2.98 listed in dnsbl.sorbs.net]
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[47.90.2.98 listed in bl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(phillip_esq1[at]aol.com)
1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 MISSING_MID Missing Message-Id: header
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** I Await For Your Response.
To your attention:
My client is looking for lucrative Investment Opportunities in your Country or in
any Country that may be advised by you. Therefore, the proposed Investments Amount
by my client will be made available to you in a clean and clear terms should you
find this offer interesting.
I am a Legal Practitioner/Financial Advisor based in the Republic of Ghana West
Africa and will provide full details and road map by which this transaction could be
executed without hitches should you indicate your interest and readiness to work
with me. Your benefits and entitlements will also be made available to you as well
Envelope-to:
Delivery-date: Thu, 20 Jul 2017 13:57:36 -0700
Received: from [47.90.2.98] (port=35914 helo=mail.yzshop.com.tw)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1dYIVr-0000h3-13
for ; Thu, 20 Jul 2017 13:57:36 -0700
Received: from User (unknown [37.49.224.215])
by mail.yzshop.com.tw (Postfix) with SMTP id E8D665E602A;
Fri, 21 Jul 2017 04:56:36 +0800 (CST)
Reply-To: <[email protected]>
From: "Robert Philip"<[email protected]>
To: [email protected]
Date: Thu, 20 Jul 2017 22:55:38 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=30.9
X-Spam-Score: 309
X-Spam-Bar: ++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: To your attention: My client is looking for lucrative Investment
Opportunities in your Country or in any Country that may be advised by you.
Therefore, the proposed Investments Amount by my client will be made available
to you in a clean and clear terms should you find this offer interesting.
[...]
Content analysis details: (30.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[47.90.2.98 listed in bb.barracudacentral.org]
2.6 RCVD_IN_SORBS_SMTP RBL: SORBS: sender is open SMTP relay
[47.90.2.98 listed in dnsbl.sorbs.net]
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[47.90.2.98 listed in bl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(phillip_esq1[at]aol.com)
1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 MISSING_MID Missing Message-Id: header
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** I Await For Your Response.
To your attention:
My client is looking for lucrative Investment Opportunities in your Country or in
any Country that may be advised by you. Therefore, the proposed Investments Amount
by my client will be made available to you in a clean and clear terms should you
find this offer interesting.
I am a Legal Practitioner/Financial Advisor based in the Republic of Ghana West
Africa and will provide full details and road map by which this transaction could be
executed without hitches should you indicate your interest and readiness to work
with me. Your benefits and entitlements will also be made available to you as well
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces