#345395 by buried under 419s
Thu Nov 16, 2017 12:14 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id 2J4rKzfCDFr3GAAAjbubUg
for <>; Wed, 15 Nov 2017 14:39:51 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 15 Nov 2017 14:39:51 -0800
Received: from mail-oi0-f66.google.com ([209.85.218.66]:50975)
by with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1eF6LT-0001em-DJ
for ; Wed, 15 Nov 2017 14:39:51 -0800
Received: by mail-oi0-f66.google.com with SMTP id l138so7059659oib.7
for <>; Wed, 15 Nov 2017 14:39:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=0qVmN3Tf2cZPywbZF2uUTzyvU59XeJni5Qp9KDyk4Wk=;
b=vWVAKFpebtHXgo/lRMTsRUnjsTgy4stGfwIxrNxc3jZD/3miFvK704B2JNhniNLTYh
NzH6//AhaHwBbrhPeMe5xvXNZsCehRO9ddFq1PF+PmS3QT7uucq+k+hRGiCVc92cbvf5
ovVeP0UAMxWFsAVw46xlsoh9335GIEqpFnR7CJC8rEluzhYUTUGRqUSSWsQZQIYr6Q1u
KJkXH9bIH+CYz1XApJo8uN1zMET9rIdyPL0lHx74ULy6uNMIzkQNSRPWIJugXLDob8Zv
sD+vMTTS7DJ+W3AUFOXgn9luv0xrEksk1dnEQIZeb+1BdL+ZQSN0jmQRerHX++qiAgsI
FDtw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=0qVmN3Tf2cZPywbZF2uUTzyvU59XeJni5Qp9KDyk4Wk=;
b=LbVLTakz9vZqPcasChFam25+occlPpq3SMpSYZR0N2vzhRM6qS7bnLhqE0k1b+wU4W
AfMxhSQj6RxPdFN/1C5ehE7xooqf0xYUcd5eZ+kw7yz5Hk3R1ouSXD/EuhRgwBAKpqyj
IqTpQSTyXDwWtkSvI2sE9SrrSfvAHd+akHZr7b+fyhW79dW1NKJekHn1ajrc4d/Lfmtp
zihum9zxK8RmFF9KNnIIUeDZLjZ2A7zh1KkYTa4FO4DV+nb8mtoxi6HTZRi+FIdH/Kqq
MsGGyBQtbbaMNROpuvKV4bm6c/2rKMivXXA8num9qqYD4rokVyYsG3rsdD/bK9rAUMjn
kFvw==
X-Gm-Message-State: AJaThX7NMbT5LisXaHUUAY6AwIMhYCpOdMRGx+m+VclWnDaq6zmanuTk
fByMOrPjtL/7QOpWEv8P3xBxNiGP0kqGR/cb9eA=
X-Google-Smtp-Source: AGs4zMaBxRFMRfwdq8zNeFO07bpD9CCyjb5PIdxHssPKgsskFMK5cmt6XFfZlmUzNsI9zdkQ1jLKtBOigmb8vRs7DPs=
X-Received: by 10.202.73.144 with SMTP id w138mr8093564oia.213.1510785546895;
Wed, 15 Nov 2017 14:39:06 -0800 (PST)
MIME-Version: 1.0
Received: by 10.157.41.197 with HTTP; Wed, 15 Nov 2017 14:39:06 -0800 (PST)
Reply-To: [email protected]
From: =?UTF-8?Q?From_The_Western_Union=C2=AECashier_Transfer?= <[email protected]>
Date: Wed, 15 Nov 2017 23:39:06 +0100
Message-ID: <CAJVM88e4W3Cpk5q2V=R7TrfoU_RMxLOD4QRPbQe0UdkTr=3goQ@mail.gmail.com>
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc:
X-Spam-Status: Yes, score=9.6
X-Spam-Score: 96
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: ATTENTION CUSTOMER, DEAR SIR/MADAM. THERE IS AN ISSUE INVOLVING
$5.900M WHICH WAS CALLED TO OUR BANK (ECO-BANK) FROM THE FEDERAL MINISTRY
OF FINANCE CONCERNING YOUR COMPENSATION OF $5.900M HAS BEEN FORWARDED TO
WESTERN UNION MONEY TRANSFER AND AN INSTRUCTION HAS COME DIRECTLY FROM MR
YEMI OSINBAJO. OF MINISTRY OF FINANCE. [...]
Content analysis details: (9.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(fubaraezekiel[at]gmail.com)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.66 listed in list.dnswl.org]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[209.85.218.66 listed in dnsbl.sorbs.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(officemail6556[at]gmail.com)
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.66 listed in wl.mailspike.net]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 T_HK_NAME_FM_FROM No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** From The Western Union(R)Cashier Transfer
ATTENTION CUSTOMER,
DEAR SIR/MADAM.
THERE IS AN ISSUE INVOLVING $5.900M WHICH WAS CALLED TO OUR BANK
(ECO-BANK) FROM THE FEDERAL MINISTRY OF FINANCE CONCERNING YOUR
COMPENSATION OF $5.900M HAS BEEN FORWARDED TO WESTERN UNION MONEY
TRANSFER AND AN INSTRUCTION HAS COME DIRECTLY FROM MR YEMI OSINBAJO.
OF MINISTRY OF FINANCE.
HE ASKED US TO START SENDING YOUR FUND INSTALL MENTALLY $4000 PER A
DAY THROUGH WESTERN UNION MONEY TRANSFER. THIS TYPE OF TRANSFER MEANS
YOU WILL BE RECEIVING $4000 EVERY DAY THROUGH WESTERN UNION UNTIL THE
TOTAL OF $5.900M IS COMPLETELY TRANSFERRED TO YOU.
TODAY, OUR BANK HAS EFFECTED YOUR FIRST PAYMENT OF $4000 THROUGH
WESTERN UNION.NOW YOU HAVE TO CONTACT REV PAUL O.JAMES ON HIS CONTACT
BELOW AS HE IS THE PERSON UNCHARGED OF YOUR PAYMENT.
THE WESTERN UNION AGENT IS:
NAME: REV PAUL O.JAMES
EMAIL: [email protected]
TEL +234-8085886579,
MONEY SENT THROUGH PETER JOE, AMOUNT SENT $4,000.00 TO YOU TODAY. SO
CONTACT REV PAUL O.JAMES ON ABOVE EMAIL ADDRESS AND TELL HIM TO GIVE
YOU NEEDED INFORMATION AND ALSO FOR HIM TO HELP YOU PICK THE
$4,000.00.
RECONFIRM YOUR ADDRESS
(1) YOUR FULL NAME: ................
(2)YOUR PHONE NUMBER: ...................
(3)YOUR CONTACT ADDRESS: ..................
(4)YOUR COUNTRY:.......................
CONTACT REV PAUL O.JAMES ASAP ON HOW TO GET THE PAYMENT INFORMATION,
YOURS IN SERVICE.
FEDERAL MINISTRY OF FINANCE
MR YEMI OSINBAJO.
Delivered-To:
Received: from
by with LMTP id 2J4rKzfCDFr3GAAAjbubUg
for <>; Wed, 15 Nov 2017 14:39:51 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 15 Nov 2017 14:39:51 -0800
Received: from mail-oi0-f66.google.com ([209.85.218.66]:50975)
by with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1eF6LT-0001em-DJ
for ; Wed, 15 Nov 2017 14:39:51 -0800
Received: by mail-oi0-f66.google.com with SMTP id l138so7059659oib.7
for <>; Wed, 15 Nov 2017 14:39:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=0qVmN3Tf2cZPywbZF2uUTzyvU59XeJni5Qp9KDyk4Wk=;
b=vWVAKFpebtHXgo/lRMTsRUnjsTgy4stGfwIxrNxc3jZD/3miFvK704B2JNhniNLTYh
NzH6//AhaHwBbrhPeMe5xvXNZsCehRO9ddFq1PF+PmS3QT7uucq+k+hRGiCVc92cbvf5
ovVeP0UAMxWFsAVw46xlsoh9335GIEqpFnR7CJC8rEluzhYUTUGRqUSSWsQZQIYr6Q1u
KJkXH9bIH+CYz1XApJo8uN1zMET9rIdyPL0lHx74ULy6uNMIzkQNSRPWIJugXLDob8Zv
sD+vMTTS7DJ+W3AUFOXgn9luv0xrEksk1dnEQIZeb+1BdL+ZQSN0jmQRerHX++qiAgsI
FDtw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=0qVmN3Tf2cZPywbZF2uUTzyvU59XeJni5Qp9KDyk4Wk=;
b=LbVLTakz9vZqPcasChFam25+occlPpq3SMpSYZR0N2vzhRM6qS7bnLhqE0k1b+wU4W
AfMxhSQj6RxPdFN/1C5ehE7xooqf0xYUcd5eZ+kw7yz5Hk3R1ouSXD/EuhRgwBAKpqyj
IqTpQSTyXDwWtkSvI2sE9SrrSfvAHd+akHZr7b+fyhW79dW1NKJekHn1ajrc4d/Lfmtp
zihum9zxK8RmFF9KNnIIUeDZLjZ2A7zh1KkYTa4FO4DV+nb8mtoxi6HTZRi+FIdH/Kqq
MsGGyBQtbbaMNROpuvKV4bm6c/2rKMivXXA8num9qqYD4rokVyYsG3rsdD/bK9rAUMjn
kFvw==
X-Gm-Message-State: AJaThX7NMbT5LisXaHUUAY6AwIMhYCpOdMRGx+m+VclWnDaq6zmanuTk
fByMOrPjtL/7QOpWEv8P3xBxNiGP0kqGR/cb9eA=
X-Google-Smtp-Source: AGs4zMaBxRFMRfwdq8zNeFO07bpD9CCyjb5PIdxHssPKgsskFMK5cmt6XFfZlmUzNsI9zdkQ1jLKtBOigmb8vRs7DPs=
X-Received: by 10.202.73.144 with SMTP id w138mr8093564oia.213.1510785546895;
Wed, 15 Nov 2017 14:39:06 -0800 (PST)
MIME-Version: 1.0
Received: by 10.157.41.197 with HTTP; Wed, 15 Nov 2017 14:39:06 -0800 (PST)
Reply-To: [email protected]
From: =?UTF-8?Q?From_The_Western_Union=C2=AECashier_Transfer?= <[email protected]>
Date: Wed, 15 Nov 2017 23:39:06 +0100
Message-ID: <CAJVM88e4W3Cpk5q2V=R7TrfoU_RMxLOD4QRPbQe0UdkTr=3goQ@mail.gmail.com>
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc:
X-Spam-Status: Yes, score=9.6
X-Spam-Score: 96
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: ATTENTION CUSTOMER, DEAR SIR/MADAM. THERE IS AN ISSUE INVOLVING
$5.900M WHICH WAS CALLED TO OUR BANK (ECO-BANK) FROM THE FEDERAL MINISTRY
OF FINANCE CONCERNING YOUR COMPENSATION OF $5.900M HAS BEEN FORWARDED TO
WESTERN UNION MONEY TRANSFER AND AN INSTRUCTION HAS COME DIRECTLY FROM MR
YEMI OSINBAJO. OF MINISTRY OF FINANCE. [...]
Content analysis details: (9.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(fubaraezekiel[at]gmail.com)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.66 listed in list.dnswl.org]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[209.85.218.66 listed in dnsbl.sorbs.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(officemail6556[at]gmail.com)
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.66 listed in wl.mailspike.net]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 T_HK_NAME_FM_FROM No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** From The Western Union(R)Cashier Transfer
ATTENTION CUSTOMER,
DEAR SIR/MADAM.
THERE IS AN ISSUE INVOLVING $5.900M WHICH WAS CALLED TO OUR BANK
(ECO-BANK) FROM THE FEDERAL MINISTRY OF FINANCE CONCERNING YOUR
COMPENSATION OF $5.900M HAS BEEN FORWARDED TO WESTERN UNION MONEY
TRANSFER AND AN INSTRUCTION HAS COME DIRECTLY FROM MR YEMI OSINBAJO.
OF MINISTRY OF FINANCE.
HE ASKED US TO START SENDING YOUR FUND INSTALL MENTALLY $4000 PER A
DAY THROUGH WESTERN UNION MONEY TRANSFER. THIS TYPE OF TRANSFER MEANS
YOU WILL BE RECEIVING $4000 EVERY DAY THROUGH WESTERN UNION UNTIL THE
TOTAL OF $5.900M IS COMPLETELY TRANSFERRED TO YOU.
TODAY, OUR BANK HAS EFFECTED YOUR FIRST PAYMENT OF $4000 THROUGH
WESTERN UNION.NOW YOU HAVE TO CONTACT REV PAUL O.JAMES ON HIS CONTACT
BELOW AS HE IS THE PERSON UNCHARGED OF YOUR PAYMENT.
THE WESTERN UNION AGENT IS:
NAME: REV PAUL O.JAMES
EMAIL: [email protected]
TEL +234-8085886579,
MONEY SENT THROUGH PETER JOE, AMOUNT SENT $4,000.00 TO YOU TODAY. SO
CONTACT REV PAUL O.JAMES ON ABOVE EMAIL ADDRESS AND TELL HIM TO GIVE
YOU NEEDED INFORMATION AND ALSO FOR HIM TO HELP YOU PICK THE
$4,000.00.
RECONFIRM YOUR ADDRESS
(1) YOUR FULL NAME: ................
(2)YOUR PHONE NUMBER: ...................
(3)YOUR CONTACT ADDRESS: ..................
(4)YOUR COUNTRY:.......................
CONTACT REV PAUL O.JAMES ASAP ON HOW TO GET THE PAYMENT INFORMATION,
YOURS IN SERVICE.
FEDERAL MINISTRY OF FINANCE
MR YEMI OSINBAJO.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces