#339885 by buried under 419s
Thu Sep 21, 2017 9:57 am
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 21 Sep 2017 04:01:26 -0700
Received: from [213.63.128.37] (port=38492 helo=leo.link.local)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1duzES-0006zt-In
for ; Thu, 21 Sep 2017 04:01:26 -0700
Received: from User (unknown [37.49.226.17])
by leo.link.local (Postfix) with ESMTPA id 6023B33FF12;
Thu, 21 Sep 2017 10:45:53 +0100 (WEST)
Reply-To: <[email protected]>
From: "Cosmila Jason"<[email protected]>
Date: Thu, 21 Sep 2017 11:44:06 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=25.2
X-Spam-Score: 252
X-Spam-Bar: +++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attn: The Owner of this E-mail ID, Your Name And Your Contact
Details Was Given To This Office In Respect Of Your Total inherited/Compensation
Sum Owed To You Which You Have [...]
Content analysis details: (25.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[213.63.128.37 listed in bb.barracudacentral.org]
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(video[at]yandex.ru)
1.0 MISSING_HEADERS Missing To: header
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_USER From misspaced, from "User"
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 MISSING_MID Missing Message-Id: header
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_3 Fill a form and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Attn: The Owner of this E-mail ID,
Attn: The Owner of this E-mail ID,
Your Name And Your Contact Details Was Given To This Office In Respect
Of Your Total inherited/Compensation Sum Owed To You Which You Have
Failed To Claim Because Of Either Non-Compliance Of Official Processes
Or Because Of Your Unbelief Of The Reality Of Your Genuine Payment.
We Wish To Bring To You The Solution To This Problem. Right Now We Have
Arranged Your Payment Through Our Swift Card Payment Centers, That Is
The Latest Instruction From Economic Community Of West African States
(ECOWAS) This UBA ATM payment Center Will Send To You An ATM VISA Card
Which You Will Use To Withdraw Your Money In Any ATM Machine In Any Part
Of The World, So If You Like To Receive Your Fund In This Way, Please
Let Us Know Buy Contacting Us Back on the following information:
CONTACT: Mr.Morgan Chambers.
E-mail: [email protected]
And Also Send The Following Information As Listed Below.
1. Full Name
2. Phone And Fax Number
3. Delivery address
4.ATTACH COPY OF YOUR IDENTIFICATION/ If any available
We Have Been Mandated By The ECOWAS Parliament To Issue Out $7.5million
USD in your favor This fiscal year. Also For YourInformation, You Have
To Stop Any Further Communication With Any Other Person (S) Or Office(S)
To Avoid Any Hitches In Receiving Your Payment.
Note That Because Of Impostors,We Hereby Issued You Our Code Of Conduct,
Which Is (ATM-202) So You Have To Indicate This Code When Contacting The
Card Center By Using It As Your Subject.
AS SOON AS I CONFIRM THE REQUIRED INFORMATION I WILL DIRECT YOU ON HOW
TO PROCEED ON IMMEDIATE DISPATCHING OF YOUR ATM CARD PAYMENT
Envelope-to:
Delivery-date: Thu, 21 Sep 2017 04:01:26 -0700
Received: from [213.63.128.37] (port=38492 helo=leo.link.local)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1duzES-0006zt-In
for ; Thu, 21 Sep 2017 04:01:26 -0700
Received: from User (unknown [37.49.226.17])
by leo.link.local (Postfix) with ESMTPA id 6023B33FF12;
Thu, 21 Sep 2017 10:45:53 +0100 (WEST)
Reply-To: <[email protected]>
From: "Cosmila Jason"<[email protected]>
Date: Thu, 21 Sep 2017 11:44:06 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=25.2
X-Spam-Score: 252
X-Spam-Bar: +++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attn: The Owner of this E-mail ID, Your Name And Your Contact
Details Was Given To This Office In Respect Of Your Total inherited/Compensation
Sum Owed To You Which You Have [...]
Content analysis details: (25.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[213.63.128.37 listed in bb.barracudacentral.org]
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(video[at]yandex.ru)
1.0 MISSING_HEADERS Missing To: header
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_USER From misspaced, from "User"
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 MISSING_MID Missing Message-Id: header
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_3 Fill a form and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Attn: The Owner of this E-mail ID,
Attn: The Owner of this E-mail ID,
Your Name And Your Contact Details Was Given To This Office In Respect
Of Your Total inherited/Compensation Sum Owed To You Which You Have
Failed To Claim Because Of Either Non-Compliance Of Official Processes
Or Because Of Your Unbelief Of The Reality Of Your Genuine Payment.
We Wish To Bring To You The Solution To This Problem. Right Now We Have
Arranged Your Payment Through Our Swift Card Payment Centers, That Is
The Latest Instruction From Economic Community Of West African States
(ECOWAS) This UBA ATM payment Center Will Send To You An ATM VISA Card
Which You Will Use To Withdraw Your Money In Any ATM Machine In Any Part
Of The World, So If You Like To Receive Your Fund In This Way, Please
Let Us Know Buy Contacting Us Back on the following information:
CONTACT: Mr.Morgan Chambers.
E-mail: [email protected]
And Also Send The Following Information As Listed Below.
1. Full Name
2. Phone And Fax Number
3. Delivery address
4.ATTACH COPY OF YOUR IDENTIFICATION/ If any available
We Have Been Mandated By The ECOWAS Parliament To Issue Out $7.5million
USD in your favor This fiscal year. Also For YourInformation, You Have
To Stop Any Further Communication With Any Other Person (S) Or Office(S)
To Avoid Any Hitches In Receiving Your Payment.
Note That Because Of Impostors,We Hereby Issued You Our Code Of Conduct,
Which Is (ATM-202) So You Have To Indicate This Code When Contacting The
Card Center By Using It As Your Subject.
AS SOON AS I CONFIRM THE REQUIRED INFORMATION I WILL DIRECT YOU ON HOW
TO PROCEED ON IMMEDIATE DISPATCHING OF YOUR ATM CARD PAYMENT
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces