by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id CNTeCNzQC1tvNgAAjbubUg
for <>; Mon, 28 May 2018 02:50:20 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 28 May 2018 02:50:20 -0700
Received: from ricky.heliohost.org ([64.62.211.134]:48114)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fNEnC-0003cD-RW
for ; Mon, 28 May 2018 02:50:19 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=officent.heliohost.org; s=default; h=Content-Transfer-Encoding:MIME-Version
:Content-Description:Content-Type:Reply-to:Subject:To:From:Message-ID:Date:
Sender:Cc:Content-ID:Resent-Date:Resent-From:Resent-Sender:Resent-To:
Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:
List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
bh=1jMnMvSI+KV5cs+Vgr2Rww2i3/Z1ll7YYgm0orxh9hg=; b=Td4XQ9lLH+06vWcyGoHvW4LDix
b8EaUpD1wynfsAuiRLNBCa/DgYP7N8je0hsYhKhFHa0Xi2+sdYChwFiiBuGCVrR2c08Cov3VbaI2+
MuV6UntNqX02oNg1ip3j6jgeYNsuiCjRAlP1iPvOilNCgaL5FD2kiS3ZyzZGzxjvw0ZthbnJ0eMMz
bwSMw+cJIfq7jzg28UdcAAifbbEtv22bG5hpkA0zWdmM3MpS+JeZJ/Th5qmwg1et1N9l1IY/yymxn
hgnELVJuim6WN4BWcz9zrz6L0LonRCLeEpKXYB496T/iIzWaeECBr+Kajq2MAwFOX0pOvDQTKRVNE
nCMxoUtQ==;
Received: from [::1] (port=60428 helo=ricky.heliohost.org)
by ricky.heliohost.org with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fNEm1-000BnQ-I5; Mon, 28 May 2018 02:49:05 -0700
Received: from 209.95.56.51 ([209.95.56.51]) by officent.heliohost.org
(Horde Framework) with HTTPS; Mon, 28 May 2018 09:48:59 +0000
Date: Mon, 28 May 2018 09:48:59 +0000
Message-ID: <20180528094859.Horde.QTreI5LBe68YXCWMK0g-yRX@officent.heliohost.org>
From: Payment Office <[email protected]>
To:
Reply-to: [email protected]
User-Agent: Horde Application Framework 5
Content-Type: text/html; charset=utf-8
Content-Description: HTML Message
MIME-Version: 1.0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ricky.heliohost.org
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - officent.heliohost.org
X-Get-Message-Sender-Via: ricky.heliohost.org: authenticated_id: [email protected]
X-Authenticated-Sender: ricky.heliohost.org: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam-Status: Yes, score=19.8
X-Spam-Score: 198
X-Spam-Bar: +++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: National Cyber Security Centre 70 Whitehall, London, SW1A
2AS Tel//Fax : +44-(0)20-7147-4521 Ref : GCHQ/CERT-UK/NCSC/FRAUD/NZ— CESG
HMG [...]
Content analysis details: (19.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.7 MILLION_USD BODY: Talks about millions of dollars
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[64.62.211.134 listed in psbl.surriel.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.2 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.5 KAM_LOTTO1 Likely to be an e-Lotto Scam Email
0.0 LOTS_OF_MONEY Huge... sums of money
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.5 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Are You Aware of This ??
National Cyber Security Centre
70 Whitehall, London, SW1A 2AS
Tel//Fax : +44-(0)20-7147-4521
Ref : GCHQ/CERT-UK/NCSC/FRAUD/NZ— CESG HMG
Attn:
It has come to the Notice of the National Cyber Security Centre of your illegal
dealings with fraudster/Scammers whom has been contacting you on the telephone and
email over the time with the false claim of releasing a certain payment to you
ranging from False Lottery Winning, Wire Transfers, Compensation Payment, ATM-Card
delivery, Cash delivery, Diplomatic Cash Delivery and Check Payment and all what
have you .
You have been found over the years patronising these criminals, irrespective of all
the various warning given to you by all the concerned Security Agencies both in
Africa, Asia, Europe and America . You defiled all security warning and still
continued patronising fraudsters from this part of the Word . This illegal dealings
with these hoodlums has placed your name in the "Watch List of this agency as well
as in the "Watch List of the EU and FBI, Agency" . This has placed a "RED FLAG" to
your incoming Payment remittance approved to you by the Nigerian Government,
Benin.Ghana, and UK .
Your name has been placed on the "Watch List" and has been sent to all the various
paying banks and other Ministries and Financial Institutions this is the simple
reasons why you have not received any of the approved incoming International
Remittance as your payment has been placed "on-hold" till your name is cleared by
this office, this order has been transmitted to all concerned authorities with
effect from the 23rd of May, 2018 .
The Federal Ministry of Finance Nigeria has been Ordered to suspend further
transaction on your payment file until your name is cleared from the "Watch List "
. This notice is coming to you as a final warning to STOP with immediate effect any
further dealing with with any bank of office as regards to the release of your long
awaited payment till your name is cleared off the list .
We have been monitoring your activities over the time in our effort to combat the
activities of these fraudsters and to punish any of you found to be patronising them
. We have conducted a thorough investigation with all the various banks here in
United Kingdom and in Africa, Europe and Asia . You have only one genuine and
outstanding payment and that is coming to you from the Nigerian Government Federal
Ministry of Finance through the IMF . In fact as I write to you now the First
National Bank of Minnesota is paying all the submitted names to them under the
direct supervision of the IMF and Finance Ministry who are duly represented, and a
thorough investigation reveals that the above sum of US$10.5 (Ten Million Five
Hundred Thousand United States dollars) will be released to your account pending
the clearance of your name from the "Watch List" .
For further details on how to clear your name from the "International Security Watch
List" ) to further allow receive your payment release .
Thanks for your Corporation .
Cabinet Office
National Cyber Security Centre
Delivered-To:
Received: from
by with LMTP id CNTeCNzQC1tvNgAAjbubUg
for <>; Mon, 28 May 2018 02:50:20 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 28 May 2018 02:50:20 -0700
Received: from ricky.heliohost.org ([64.62.211.134]:48114)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fNEnC-0003cD-RW
for ; Mon, 28 May 2018 02:50:19 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=officent.heliohost.org; s=default; h=Content-Transfer-Encoding:MIME-Version
:Content-Description:Content-Type:Reply-to:Subject:To:From:Message-ID:Date:
Sender:Cc:Content-ID:Resent-Date:Resent-From:Resent-Sender:Resent-To:
Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:
List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
bh=1jMnMvSI+KV5cs+Vgr2Rww2i3/Z1ll7YYgm0orxh9hg=; b=Td4XQ9lLH+06vWcyGoHvW4LDix
b8EaUpD1wynfsAuiRLNBCa/DgYP7N8je0hsYhKhFHa0Xi2+sdYChwFiiBuGCVrR2c08Cov3VbaI2+
MuV6UntNqX02oNg1ip3j6jgeYNsuiCjRAlP1iPvOilNCgaL5FD2kiS3ZyzZGzxjvw0ZthbnJ0eMMz
bwSMw+cJIfq7jzg28UdcAAifbbEtv22bG5hpkA0zWdmM3MpS+JeZJ/Th5qmwg1et1N9l1IY/yymxn
hgnELVJuim6WN4BWcz9zrz6L0LonRCLeEpKXYB496T/iIzWaeECBr+Kajq2MAwFOX0pOvDQTKRVNE
nCMxoUtQ==;
Received: from [::1] (port=60428 helo=ricky.heliohost.org)
by ricky.heliohost.org with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fNEm1-000BnQ-I5; Mon, 28 May 2018 02:49:05 -0700
Received: from 209.95.56.51 ([209.95.56.51]) by officent.heliohost.org
(Horde Framework) with HTTPS; Mon, 28 May 2018 09:48:59 +0000
Date: Mon, 28 May 2018 09:48:59 +0000
Message-ID: <20180528094859.Horde.QTreI5LBe68YXCWMK0g-yRX@officent.heliohost.org>
From: Payment Office <[email protected]>
To:
Reply-to: [email protected]
User-Agent: Horde Application Framework 5
Content-Type: text/html; charset=utf-8
Content-Description: HTML Message
MIME-Version: 1.0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ricky.heliohost.org
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - officent.heliohost.org
X-Get-Message-Sender-Via: ricky.heliohost.org: authenticated_id: [email protected]
X-Authenticated-Sender: ricky.heliohost.org: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam-Status: Yes, score=19.8
X-Spam-Score: 198
X-Spam-Bar: +++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: National Cyber Security Centre 70 Whitehall, London, SW1A
2AS Tel//Fax : +44-(0)20-7147-4521 Ref : GCHQ/CERT-UK/NCSC/FRAUD/NZ— CESG
HMG [...]
Content analysis details: (19.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.7 MILLION_USD BODY: Talks about millions of dollars
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[64.62.211.134 listed in psbl.surriel.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.2 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.5 KAM_LOTTO1 Likely to be an e-Lotto Scam Email
0.0 LOTS_OF_MONEY Huge... sums of money
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.5 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Are You Aware of This ??
National Cyber Security Centre
70 Whitehall, London, SW1A 2AS
Tel//Fax : +44-(0)20-7147-4521
Ref : GCHQ/CERT-UK/NCSC/FRAUD/NZ— CESG HMG
Attn:
It has come to the Notice of the National Cyber Security Centre of your illegal
dealings with fraudster/Scammers whom has been contacting you on the telephone and
email over the time with the false claim of releasing a certain payment to you
ranging from False Lottery Winning, Wire Transfers, Compensation Payment, ATM-Card
delivery, Cash delivery, Diplomatic Cash Delivery and Check Payment and all what
have you .
You have been found over the years patronising these criminals, irrespective of all
the various warning given to you by all the concerned Security Agencies both in
Africa, Asia, Europe and America . You defiled all security warning and still
continued patronising fraudsters from this part of the Word . This illegal dealings
with these hoodlums has placed your name in the "Watch List of this agency as well
as in the "Watch List of the EU and FBI, Agency" . This has placed a "RED FLAG" to
your incoming Payment remittance approved to you by the Nigerian Government,
Benin.Ghana, and UK .
Your name has been placed on the "Watch List" and has been sent to all the various
paying banks and other Ministries and Financial Institutions this is the simple
reasons why you have not received any of the approved incoming International
Remittance as your payment has been placed "on-hold" till your name is cleared by
this office, this order has been transmitted to all concerned authorities with
effect from the 23rd of May, 2018 .
The Federal Ministry of Finance Nigeria has been Ordered to suspend further
transaction on your payment file until your name is cleared from the "Watch List "
. This notice is coming to you as a final warning to STOP with immediate effect any
further dealing with with any bank of office as regards to the release of your long
awaited payment till your name is cleared off the list .
We have been monitoring your activities over the time in our effort to combat the
activities of these fraudsters and to punish any of you found to be patronising them
. We have conducted a thorough investigation with all the various banks here in
United Kingdom and in Africa, Europe and Asia . You have only one genuine and
outstanding payment and that is coming to you from the Nigerian Government Federal
Ministry of Finance through the IMF . In fact as I write to you now the First
National Bank of Minnesota is paying all the submitted names to them under the
direct supervision of the IMF and Finance Ministry who are duly represented, and a
thorough investigation reveals that the above sum of US$10.5 (Ten Million Five
Hundred Thousand United States dollars) will be released to your account pending
the clearance of your name from the "Watch List" .
For further details on how to clear your name from the "International Security Watch
List" ) to further allow receive your payment release .
Thanks for your Corporation .
Cabinet Office
National Cyber Security Centre
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
