by buried under 419s
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 22 Dec 2016 19:59:56 -0800
Received: from nm43-vm6.bullet.mail.ne1.yahoo.com ([98.138.120.230]:40657)
by with esmtps (TLSv1:ECDHE-RSA-AES128-SHA:128)
(Exim 4.87)
(envelope-from <[email protected]>)
id 1cKH15-0006Ir-0T
for ; Thu, 22 Dec 2016 19:59:56 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1482465533; bh=sHEhBCb7GH60il6nhfyf2DHaA5j6KI3SlH8/gOhh92I=; h=Date:From:Reply-To:Subject:References:From:Subject; b=RJCaNWJPOREZZTW2tajMEx4/onpHBAr5AAT4Vh3ZfE0RvCsYuIWuC1acc/SptW8q2ukjNh5JMOOa8fvbqu6jiLYZNDZ8WXqOuqHO6ZglMZdQNp22IDCCo6vmPY7xWN3P1+eBPx+JFuXUd8PnqMg/N8Z7ZbG3HJkHRZoFpZ9njYEYbcXOZs34mID3wmv7O3CN24u3IQH62cGMNwdK3kX/NcbDiE5UKZvK8iE2lQwSgLm5o/JRiVBeyKZdBL9I3vdxCtGtjbvh4FpwOExEQAjmzpqHKktJd1eitxaSTckE3zf0LocfgejtVAdZ9zFzAXHaLvdu1dZAKa4TT+9XDcEKaw==
Received: from [127.0.0.1] by nm43.bullet.mail.ne1.yahoo.com with NNFMP; 23 Dec 2016 03:58:53 -0000
Received: from [98.138.100.117] by nm43.bullet.mail.ne1.yahoo.com with NNFMP; 23 Dec 2016 03:56:02 -0000
Received: from [98.138.86.156] by tm108.bullet.mail.ne1.yahoo.com with NNFMP; 23 Dec 2016 03:54:02 -0000
Received: from [127.0.0.1] by omp1014.mail.ne1.yahoo.com with NNFMP; 23 Dec 2016 03:54:02 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
X-YMail-OSG: U12i46AVM1kXE.DaqvDnMPLzoXLX1hzK.p.lmBaG3xm7FdSwNqAn1mToMScRJOu
.xyzdNWWfUvJT8GP6Ks7yngujgaA5ZKYelPK3zEduMdynntoL0F.NUrHhWRKveZIPigxoqETscyu
Fpk9CTCaglqSt3x12xv1BkOMLaAbupPCNr1Wgc6P_EXd6DKYpEHUJCxhkalDlSE2essJ8g6T0KNp
YwZsEsh.GSLYSxTgM_.etwbxjS.J4lPnFRvGFxJAiJ_oKX0MNWGPymbgKyX.WAk_JEJlcENZkZe7
wGNegU8QWu2ZnLC5TtquYpQMJkCM0v3McWsuwI.k5txcsoTRUptyfnd05rKo2cJQkpYXay3_gm8c
L8wEKHqM.W.gZ4iHXLOAem0Je6kIOn_4Nf5YoMOl81z7IBjOjk9y_5qA1lgnMAffqcqibkmyia.S
t0Vh2_vM_txyitLs.FptCX0dePGhdguBrZEhiUHqIqw._3TaIMKEQ3gx6pzFl0_W96Pv90l0Qjt7
tssSO_.fCJaA62ZyTHtKogHp1mXcp0FIpPinOYZSJkv4Slptdh2ucldRYnJKVi_gH3an3zGqcavo-
Received: from jws200079.mail.ne1.yahoo.com by sendmailws125.mail.ne1.yahoo.com; Fri, 23 Dec 2016 03:54:01 +0000; 1482465241.754
Date: Fri, 23 Dec 2016 03:54:01 +0000 (UTC)
From: chinelo adams <[email protected]>
Reply-To: chinelo adams <[email protected]>
Message-ID: <[email protected]>
Subject: REF NUMBER:2015
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
References: <[email protected]>
Content-Length: 1108
X-Spam-Status: No, score=5.2
X-Spam-Score: 52
X-Spam-Bar: +++++
X-Ham-Report: Spam detection software, running on the system "",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attention: Honorable Beneficiary, The International Monetary
Funds, IMF has authorized my Office to settle all the Foreign Debts owed
by the Benin Republic Government.The IMF Foreign Policy and Currency Regulation
offered loan of $23 billion to Benin Republic Government based on the Agreement
$2 billion was mapped out for the Foreign Debts and your name was among those
Beneficiaries to be paid through my Office. [...]
Content analysis details: (5.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
trust
[98.138.120.230 listed in list.dnswl.org]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(chineloadams44[at]gmail.com)
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(carold34[at]yahoo.com)
-3.1 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (carold34[at]yahoo.com)
1.0 MISSING_HEADERS Missing To: header
3.0 BAYES_95 BODY: Bayes spam probability is 95 to 99%
[score: 0.9616]
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[98.138.120.230 listed in wl.mailspike.net]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[98.138.120.230 listed in dnsbl.sorbs.net]
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
X-Spam-Flag: NO
Attention: Honorable Beneficiary,
The International Monetary Funds, IMF has authorized my Office to settle all the Foreign Debts owed by the Benin Republic Government.The
IMF Foreign Policy and Currency Regulation offered loan of $23 billion
to Benin Republic Government based on the Agreement $2 billion was
mapped out for the Foreign Debts and your name was among those
Beneficiaries to be paid through my Office.
Based on these all the money you have had spent in the course of
getting this money in the past must be included as no money will be
lost. Therefore, you are directed to state categorically the total
amount you had spent before and forward it to my Office now before the
total payment will be made on your behalf.
Your payment this time will be taken place immediately and under 72
Hours the payment of $15m was approved on your behalf and will be
transferred to you immediately. You are requested to reply with your
full information such as:
Your Names
Your Address
Your Phone
Your personal ID
Contact
Chinelo Adams, email [email protected]
Kindly reply now.
Yours,
Carol Dries
Envelope-to:
Delivery-date: Thu, 22 Dec 2016 19:59:56 -0800
Received: from nm43-vm6.bullet.mail.ne1.yahoo.com ([98.138.120.230]:40657)
by with esmtps (TLSv1:ECDHE-RSA-AES128-SHA:128)
(Exim 4.87)
(envelope-from <[email protected]>)
id 1cKH15-0006Ir-0T
for ; Thu, 22 Dec 2016 19:59:56 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1482465533; bh=sHEhBCb7GH60il6nhfyf2DHaA5j6KI3SlH8/gOhh92I=; h=Date:From:Reply-To:Subject:References:From:Subject; b=RJCaNWJPOREZZTW2tajMEx4/onpHBAr5AAT4Vh3ZfE0RvCsYuIWuC1acc/SptW8q2ukjNh5JMOOa8fvbqu6jiLYZNDZ8WXqOuqHO6ZglMZdQNp22IDCCo6vmPY7xWN3P1+eBPx+JFuXUd8PnqMg/N8Z7ZbG3HJkHRZoFpZ9njYEYbcXOZs34mID3wmv7O3CN24u3IQH62cGMNwdK3kX/NcbDiE5UKZvK8iE2lQwSgLm5o/JRiVBeyKZdBL9I3vdxCtGtjbvh4FpwOExEQAjmzpqHKktJd1eitxaSTckE3zf0LocfgejtVAdZ9zFzAXHaLvdu1dZAKa4TT+9XDcEKaw==
Received: from [127.0.0.1] by nm43.bullet.mail.ne1.yahoo.com with NNFMP; 23 Dec 2016 03:58:53 -0000
Received: from [98.138.100.117] by nm43.bullet.mail.ne1.yahoo.com with NNFMP; 23 Dec 2016 03:56:02 -0000
Received: from [98.138.86.156] by tm108.bullet.mail.ne1.yahoo.com with NNFMP; 23 Dec 2016 03:54:02 -0000
Received: from [127.0.0.1] by omp1014.mail.ne1.yahoo.com with NNFMP; 23 Dec 2016 03:54:02 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
X-YMail-OSG: U12i46AVM1kXE.DaqvDnMPLzoXLX1hzK.p.lmBaG3xm7FdSwNqAn1mToMScRJOu
.xyzdNWWfUvJT8GP6Ks7yngujgaA5ZKYelPK3zEduMdynntoL0F.NUrHhWRKveZIPigxoqETscyu
Fpk9CTCaglqSt3x12xv1BkOMLaAbupPCNr1Wgc6P_EXd6DKYpEHUJCxhkalDlSE2essJ8g6T0KNp
YwZsEsh.GSLYSxTgM_.etwbxjS.J4lPnFRvGFxJAiJ_oKX0MNWGPymbgKyX.WAk_JEJlcENZkZe7
wGNegU8QWu2ZnLC5TtquYpQMJkCM0v3McWsuwI.k5txcsoTRUptyfnd05rKo2cJQkpYXay3_gm8c
L8wEKHqM.W.gZ4iHXLOAem0Je6kIOn_4Nf5YoMOl81z7IBjOjk9y_5qA1lgnMAffqcqibkmyia.S
t0Vh2_vM_txyitLs.FptCX0dePGhdguBrZEhiUHqIqw._3TaIMKEQ3gx6pzFl0_W96Pv90l0Qjt7
tssSO_.fCJaA62ZyTHtKogHp1mXcp0FIpPinOYZSJkv4Slptdh2ucldRYnJKVi_gH3an3zGqcavo-
Received: from jws200079.mail.ne1.yahoo.com by sendmailws125.mail.ne1.yahoo.com; Fri, 23 Dec 2016 03:54:01 +0000; 1482465241.754
Date: Fri, 23 Dec 2016 03:54:01 +0000 (UTC)
From: chinelo adams <[email protected]>
Reply-To: chinelo adams <[email protected]>
Message-ID: <[email protected]>
Subject: REF NUMBER:2015
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
References: <[email protected]>
Content-Length: 1108
X-Spam-Status: No, score=5.2
X-Spam-Score: 52
X-Spam-Bar: +++++
X-Ham-Report: Spam detection software, running on the system "",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attention: Honorable Beneficiary, The International Monetary
Funds, IMF has authorized my Office to settle all the Foreign Debts owed
by the Benin Republic Government.The IMF Foreign Policy and Currency Regulation
offered loan of $23 billion to Benin Republic Government based on the Agreement
$2 billion was mapped out for the Foreign Debts and your name was among those
Beneficiaries to be paid through my Office. [...]
Content analysis details: (5.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
trust
[98.138.120.230 listed in list.dnswl.org]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(chineloadams44[at]gmail.com)
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(carold34[at]yahoo.com)
-3.1 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (carold34[at]yahoo.com)
1.0 MISSING_HEADERS Missing To: header
3.0 BAYES_95 BODY: Bayes spam probability is 95 to 99%
[score: 0.9616]
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[98.138.120.230 listed in wl.mailspike.net]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[98.138.120.230 listed in dnsbl.sorbs.net]
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
X-Spam-Flag: NO
Attention: Honorable Beneficiary,
The International Monetary Funds, IMF has authorized my Office to settle all the Foreign Debts owed by the Benin Republic Government.The
IMF Foreign Policy and Currency Regulation offered loan of $23 billion
to Benin Republic Government based on the Agreement $2 billion was
mapped out for the Foreign Debts and your name was among those
Beneficiaries to be paid through my Office.
Based on these all the money you have had spent in the course of
getting this money in the past must be included as no money will be
lost. Therefore, you are directed to state categorically the total
amount you had spent before and forward it to my Office now before the
total payment will be made on your behalf.
Your payment this time will be taken place immediately and under 72
Hours the payment of $15m was approved on your behalf and will be
transferred to you immediately. You are requested to reply with your
full information such as:
Your Names
Your Address
Your Phone
Your personal ID
Contact
Chinelo Adams, email [email protected]
Kindly reply now.
Yours,
Carol Dries
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
4010:c07::22d])
message-id:subject:to;