#342205 by buried under 419s
Wed Oct 18, 2017 8:33 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 18 Oct 2017 16:39:42 -0700
Received: from c-73-44-48-117.hsd1.il.comcast.net ([73.44.48.117]:61194 helo=vip.163.com)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1e4xw2-0004YP-Ag
for ; Wed, 18 Oct 2017 16:39:42 -0700
Reply-To: [email protected]
From: "Director of Payment" <[email protected]>
To:
Date: 18 Oct 2017 18:38:44 -0500
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: Yes, score=42.8
X-Spam-Score: 428
X-Spam-Bar: ++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: ATTENTION: BENEFICIARY, Dear Sir THIS IS TO INFORM YOU THAT
THE FEDERAL MINISTRY OF FINANCE HAS SHORT LISTED YOUR EMAIL ADDRESS AND NAME
FOR THE PAYMENT OF USD $15.5 MILLION. THIS DOUBLES AS YOUR NOTICE OF APPROVAL
AND LETTER OF DEFINITE ASSURANCE. THIS PAYMENT APPROVAL IS IRREVOCABLE AS
IT IS ALREADY ISSUED OUT. [...]
Content analysis details: (42.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.6 URG_BIZ BODY: Contains urgent matter
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
2.1 TVD_APPROVED BODY: Body states that the recipient has been approved
0.7 FROM_STARTS_WITH_NUMS From: starts with several numbers
4.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[73.44.48.117 listed in dnsbl.sorbs.net]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[73.44.48.117 listed in psbl.surriel.com]
3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[73.44.48.117 listed in zen.spamhaus.org]
4.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?73.44.48.117>]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(054cgfi[at]vip.163.com)
4.0 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=0 ... 63.com;ip=]
4.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=vip.163.com;ip=]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 LOTTO_AGENT Claims Agent
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Your Urgent Reply Needed.
ATTENTION: BENEFICIARY,
Dear Sir
THIS IS TO INFORM YOU THAT THE FEDERAL MINISTRY OF FINANCE HAS SHORT LISTED YOUR
EMAIL ADDRESS AND NAME FOR THE PAYMENT OF USD $15.5 MILLION. THIS DOUBLES AS YOUR
NOTICE OF APPROVAL AND LETTER OF DEFINITE ASSURANCE. THIS PAYMENT APPROVAL IS
IRREVOCABLE AS IT IS ALREADY ISSUED OUT.
DR KALU .E. KALU IS APPOINTED TO HANDLE THE PAYMENT TO YOU. YOU ARE HEREBY ADVISED
TO COME FORWARD FOR THIS PAYMENT. TO COLLECT THE PAYMENT YOU WOULD BE REQUIRED TO
RECONFIRM THE BELOW INFORMATION IN LINE WITH THE APPROVAL LAW. YOU ARE TO THEN
SUBMIT A RECEIVING ACCOUNT TO RECEIVE THE PAYMENT. AS YOU GO THROUGH THIS NOTICE,
PLEASE CONTACT YOUR PAYMENT OFFICER WITH THE DETAILS BELOW:
PAYMENT OFFICER:
DR. KALU .E. KALU
EXECUTIVE DIRECTOR INHERITANCE
Phone: +234 902 535 7171
Email: [email protected]
PLEASE YOU PROVIDE YOUR FULL INFORMATION SUCH AS STATED BELOW,
[1] NAME:
[2] ADDRESS:
[3] AGE: [4] SEX:
[5] TELEPHONE & FAX:
[6] YOUR COMPANY’S NAME AND ADDRESS
[7] BANKING INFORMATION:
[8] OCCUPATION STATUS:
YOU ARE APPROVED AND ASKED TO APPLY FOR THIS PAYMENT BECAUSE THE FEDERAL MINISTRY OF
FINANCE PAYMENT COMPUTER AUTHENTICATED YOUR EMAIL DATA AS THE RIGHT PAYMENT CODE TO
PULL THE FUND UNDER INHERITANCE/CONTRACT PAYMENT! PLEASE CONSIDER THIS NOTE AS AN
ITEM OF HIGH SECURITY VALUE AND A MATTER OF HIGH IMPORTANCE TO ACT AND FOLLOW IT
THROUGH IMMEDIATELY FOR THE PAYMENT IS TIME BOUND.
EVERY YEAR DUE TO INTERNATIONAL TRADE OBLIGATIONS, THE BOARD OF THE FEDERAL MINISTRY
OF FINANCE REVISITS OLD CONTRACT FILES BY USING RANDOM EMAIL CODES TO UNBLOCK
SUSPENDED PAYMENTS IN THE CENTRAL COMPUTER SYSTEM.
CONGRATULATIONS!
MR BENARD HARRISON (PA)
FOR: EXECUTIVE DIRECTOR FMF.
Envelope-to:
Delivery-date: Wed, 18 Oct 2017 16:39:42 -0700
Received: from c-73-44-48-117.hsd1.il.comcast.net ([73.44.48.117]:61194 helo=vip.163.com)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1e4xw2-0004YP-Ag
for ; Wed, 18 Oct 2017 16:39:42 -0700
Reply-To: [email protected]
From: "Director of Payment" <[email protected]>
To:
Date: 18 Oct 2017 18:38:44 -0500
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: Yes, score=42.8
X-Spam-Score: 428
X-Spam-Bar: ++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: ATTENTION: BENEFICIARY, Dear Sir THIS IS TO INFORM YOU THAT
THE FEDERAL MINISTRY OF FINANCE HAS SHORT LISTED YOUR EMAIL ADDRESS AND NAME
FOR THE PAYMENT OF USD $15.5 MILLION. THIS DOUBLES AS YOUR NOTICE OF APPROVAL
AND LETTER OF DEFINITE ASSURANCE. THIS PAYMENT APPROVAL IS IRREVOCABLE AS
IT IS ALREADY ISSUED OUT. [...]
Content analysis details: (42.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.6 URG_BIZ BODY: Contains urgent matter
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
2.1 TVD_APPROVED BODY: Body states that the recipient has been approved
0.7 FROM_STARTS_WITH_NUMS From: starts with several numbers
4.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[73.44.48.117 listed in dnsbl.sorbs.net]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[73.44.48.117 listed in psbl.surriel.com]
3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[73.44.48.117 listed in zen.spamhaus.org]
4.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?73.44.48.117>]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(054cgfi[at]vip.163.com)
4.0 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=0 ... 63.com;ip=]
4.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=vip.163.com;ip=]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 LOTTO_AGENT Claims Agent
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Your Urgent Reply Needed.
ATTENTION: BENEFICIARY,
Dear Sir
THIS IS TO INFORM YOU THAT THE FEDERAL MINISTRY OF FINANCE HAS SHORT LISTED YOUR
EMAIL ADDRESS AND NAME FOR THE PAYMENT OF USD $15.5 MILLION. THIS DOUBLES AS YOUR
NOTICE OF APPROVAL AND LETTER OF DEFINITE ASSURANCE. THIS PAYMENT APPROVAL IS
IRREVOCABLE AS IT IS ALREADY ISSUED OUT.
DR KALU .E. KALU IS APPOINTED TO HANDLE THE PAYMENT TO YOU. YOU ARE HEREBY ADVISED
TO COME FORWARD FOR THIS PAYMENT. TO COLLECT THE PAYMENT YOU WOULD BE REQUIRED TO
RECONFIRM THE BELOW INFORMATION IN LINE WITH THE APPROVAL LAW. YOU ARE TO THEN
SUBMIT A RECEIVING ACCOUNT TO RECEIVE THE PAYMENT. AS YOU GO THROUGH THIS NOTICE,
PLEASE CONTACT YOUR PAYMENT OFFICER WITH THE DETAILS BELOW:
PAYMENT OFFICER:
DR. KALU .E. KALU
EXECUTIVE DIRECTOR INHERITANCE
Phone: +234 902 535 7171
Email: [email protected]
PLEASE YOU PROVIDE YOUR FULL INFORMATION SUCH AS STATED BELOW,
[1] NAME:
[2] ADDRESS:
[3] AGE: [4] SEX:
[5] TELEPHONE & FAX:
[6] YOUR COMPANY’S NAME AND ADDRESS
[7] BANKING INFORMATION:
[8] OCCUPATION STATUS:
YOU ARE APPROVED AND ASKED TO APPLY FOR THIS PAYMENT BECAUSE THE FEDERAL MINISTRY OF
FINANCE PAYMENT COMPUTER AUTHENTICATED YOUR EMAIL DATA AS THE RIGHT PAYMENT CODE TO
PULL THE FUND UNDER INHERITANCE/CONTRACT PAYMENT! PLEASE CONSIDER THIS NOTE AS AN
ITEM OF HIGH SECURITY VALUE AND A MATTER OF HIGH IMPORTANCE TO ACT AND FOLLOW IT
THROUGH IMMEDIATELY FOR THE PAYMENT IS TIME BOUND.
EVERY YEAR DUE TO INTERNATIONAL TRADE OBLIGATIONS, THE BOARD OF THE FEDERAL MINISTRY
OF FINANCE REVISITS OLD CONTRACT FILES BY USING RANDOM EMAIL CODES TO UNBLOCK
SUSPENDED PAYMENTS IN THE CENTRAL COMPUTER SYSTEM.
CONGRATULATIONS!
MR BENARD HARRISON (PA)
FOR: EXECUTIVE DIRECTOR FMF.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces