by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by (Dovecot) with LMTP id omMrGX+FqVj/RAAAjbubUg
for <; Sun, 19 Feb 2017 03:46:07 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sun, 19 Feb 2017 03:46:07 -0800
Received: from [61.208.202.20] (port=54919 helo=mail.micbb.jp)
by with esmtp (Exim 4.87)
(envelope-from <[email protected]>)
id 1cfPwI-0004aa-IB
for ; Sun, 19 Feb 2017 03:46:07 -0800
Received: from User (unknown [197.210.25.5])
by mail.micbb.jp (Postfix) with ESMTPA id DCC0E7DA4E7;
Sun, 19 Feb 2017 18:10:26 +0900 (JST)
Reply-To: <[email protected]>
From: "OFFICE"<[email protected]>
Date: Sun, 19 Feb 2017 10:11:13 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=33.7
X-Spam-Score: 337
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: FEDERAL BUREAU OF INVESTIGATION FBI.WASHINGTON DC. WASHINGTON
D.C ROOM, 7367 J. EDGAR HOOVER FBI BUILDING 935 PENNSYLVANIA AVENUE, NW WASHINGTON,
DC 20535, 0001. FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP THE INTERNET
[...]
Content analysis details: (33.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.3 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.0 MISSING_HEADERS Missing To: header
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[61.208.202.20 listed in bb.barracudacentral.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(mrgodwin.emefiele1978[at]gmail.com)
1.5 SUBJ_ALL_CAPS Subject is all capitals
2.0 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.7 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 MISSING_MID Missing Message-Id: header
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
0.0 FROM_MISSP_USER From misspaced, from "User"
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.2 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.5 KAM_NIGERIAN Nigerian Scam and Variants
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.7 FBI_SPOOF Claims to be FBI, but not from FBI domain
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.1 FBI_MONEY The FBI wants to give you lots of money?
0.2 XFER_LOTSA_MONEY Transfer a lot of money
0.0 FROM_MISSPACED From: missing whitespace
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.5 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
2.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** RE. FBI INVESTIGATIONS
FEDERAL BUREAU OF INVESTIGATION FBI.WASHINGTON DC.
WASHINGTON D.C ROOM, 7367
J. EDGAR HOOVER FBI BUILDING
935 PENNSYLVANIA AVENUE,
NW WASHINGTON, DC 20535, 0001.
FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP THE
INTERNET
We sincerely apologize for sending you this sensitive information via e-mail instead
of a certified mail, phone call or a face-to-face conversation, it is due to the
urgency and importance of the security information involved. In the quest to cushion
the effect of the global financial crisis, American government through the Federal
Bureau of Investigation (FBI) Washington, DC and the Internet Crime Complaint Center
(ic3) has signed an agreement with Nigeria for an immediate release of all overdue
funds presently logged in their treasury and ensure it is disbursed to the rightful
beneficiaries in any part of the world. If you the beneficiary would adhere to this
notification it will help stabilize the various economies of the world and reduce
the effect of this depressing recession.
Prior to this agreement our team of security experts has swung into action for
transparency and accountability of this periodic project. The Federal Bureau of
Investigation (Global Intelligence, Cyber Division) saddled with the responsibility
of monitoring activities going on over the internet have discovered your name in the
list of unpaid contractors and it might interest you to know that we have conducted
a comprehensive investigation on this discovery as stipulated on our protocol of
operation and have confirmed that the inheritance fund was endorsed in your favor
and it is 100% genuine and hitch free from all facets. You have the lawful right to
contact the appropriate authority to claim your payment without further delay.
Further findings revealed that some corrupt ex- government officials are conniving
with some officials of Nigeria Federal Ministry of Finance to change your account
and transfer your inheritance funds to a strange account in Canada through a man by
the name Mr. Andrew Svenkeson who purported to be your cousin, he presented some
necessary documentations evidencing your claim purported to have been signed by you
for to the release of your contract fund valued USD $16,500,000.00 (Sixteen million
five hundred thousand United States dollars).
Mr. Andrew Svenkeson bank details:
Scotia Bank
314 Harwood ave. s unit
Hpo5 Ajax, ont. l1s 2ji, Canada.
Account Number: 321020072923
Account Name: Andrew Francis Svenkeson
As a matter of urgency, you are requested to contact the Central Bank of Nigeria to
confirm that Mr. Andrew Francis Svenkeson is your true representative, so that
Central Bank of Nigeria will disburse the inheritance fund to the bank account above
and update their payment record but if this Mr. Andrew Francis Svenkeson is not your
cousin/representative ensure you send a disclaimer to the executive governor of the
Central Bank of Nigeria and instruct him to remit your fund to you without delay via
an ATM digital card which is the most secured way to receive fund of such magnitude.
Below is the officially established email address of the Central Bank of Nigeria
(CBN).
Name: Godwin Emefiele
Office Address: Central Bank of Nigeria,
Tinubu Square, Lagos - Nigeria.
Email: [email protected]
We advise that you go ahead in dealing with the Central Bank of Nigeria with the
address above and be assured that we are monitoring all their activities as well as
your correspondence at all level. If you are presently dealing with any financial
institution(s) or person(s) claiming to have relevance to the payment of your
overdue funds out-side the above financial institution you are warned in your own
interest to stop further communication.
Be informed that any delay in reaction to this letter will be assumed that Mr.
Andrew Francis Svenkeson is your true representative and the funds will be remitted
into the nominated bank account that he has provided. The Central Bank of Nigeria
will not be held responsible for any wrong transfer made due to your inability to
furnish them with proper/correct information.Contact me directly here:
[email protected]
Yours Faithfully,
Agent Gilberto Greeves ,
Assistant Director, FBI Cyber Division.
Delivered-To:
Received: from
by (Dovecot) with LMTP id omMrGX+FqVj/RAAAjbubUg
for <; Sun, 19 Feb 2017 03:46:07 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sun, 19 Feb 2017 03:46:07 -0800
Received: from [61.208.202.20] (port=54919 helo=mail.micbb.jp)
by with esmtp (Exim 4.87)
(envelope-from <[email protected]>)
id 1cfPwI-0004aa-IB
for ; Sun, 19 Feb 2017 03:46:07 -0800
Received: from User (unknown [197.210.25.5])
by mail.micbb.jp (Postfix) with ESMTPA id DCC0E7DA4E7;
Sun, 19 Feb 2017 18:10:26 +0900 (JST)
Reply-To: <[email protected]>
From: "OFFICE"<[email protected]>
Date: Sun, 19 Feb 2017 10:11:13 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=33.7
X-Spam-Score: 337
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: FEDERAL BUREAU OF INVESTIGATION FBI.WASHINGTON DC. WASHINGTON
D.C ROOM, 7367 J. EDGAR HOOVER FBI BUILDING 935 PENNSYLVANIA AVENUE, NW WASHINGTON,
DC 20535, 0001. FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP THE INTERNET
[...]
Content analysis details: (33.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.3 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.0 MISSING_HEADERS Missing To: header
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[61.208.202.20 listed in bb.barracudacentral.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(mrgodwin.emefiele1978[at]gmail.com)
1.5 SUBJ_ALL_CAPS Subject is all capitals
2.0 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.7 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 MISSING_MID Missing Message-Id: header
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
0.0 FROM_MISSP_USER From misspaced, from "User"
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.2 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.5 KAM_NIGERIAN Nigerian Scam and Variants
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.7 FBI_SPOOF Claims to be FBI, but not from FBI domain
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.1 FBI_MONEY The FBI wants to give you lots of money?
0.2 XFER_LOTSA_MONEY Transfer a lot of money
0.0 FROM_MISSPACED From: missing whitespace
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.5 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
2.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** RE. FBI INVESTIGATIONS
FEDERAL BUREAU OF INVESTIGATION FBI.WASHINGTON DC.
WASHINGTON D.C ROOM, 7367
J. EDGAR HOOVER FBI BUILDING
935 PENNSYLVANIA AVENUE,
NW WASHINGTON, DC 20535, 0001.
FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP THE
INTERNET
We sincerely apologize for sending you this sensitive information via e-mail instead
of a certified mail, phone call or a face-to-face conversation, it is due to the
urgency and importance of the security information involved. In the quest to cushion
the effect of the global financial crisis, American government through the Federal
Bureau of Investigation (FBI) Washington, DC and the Internet Crime Complaint Center
(ic3) has signed an agreement with Nigeria for an immediate release of all overdue
funds presently logged in their treasury and ensure it is disbursed to the rightful
beneficiaries in any part of the world. If you the beneficiary would adhere to this
notification it will help stabilize the various economies of the world and reduce
the effect of this depressing recession.
Prior to this agreement our team of security experts has swung into action for
transparency and accountability of this periodic project. The Federal Bureau of
Investigation (Global Intelligence, Cyber Division) saddled with the responsibility
of monitoring activities going on over the internet have discovered your name in the
list of unpaid contractors and it might interest you to know that we have conducted
a comprehensive investigation on this discovery as stipulated on our protocol of
operation and have confirmed that the inheritance fund was endorsed in your favor
and it is 100% genuine and hitch free from all facets. You have the lawful right to
contact the appropriate authority to claim your payment without further delay.
Further findings revealed that some corrupt ex- government officials are conniving
with some officials of Nigeria Federal Ministry of Finance to change your account
and transfer your inheritance funds to a strange account in Canada through a man by
the name Mr. Andrew Svenkeson who purported to be your cousin, he presented some
necessary documentations evidencing your claim purported to have been signed by you
for to the release of your contract fund valued USD $16,500,000.00 (Sixteen million
five hundred thousand United States dollars).
Mr. Andrew Svenkeson bank details:
Scotia Bank
314 Harwood ave. s unit
Hpo5 Ajax, ont. l1s 2ji, Canada.
Account Number: 321020072923
Account Name: Andrew Francis Svenkeson
As a matter of urgency, you are requested to contact the Central Bank of Nigeria to
confirm that Mr. Andrew Francis Svenkeson is your true representative, so that
Central Bank of Nigeria will disburse the inheritance fund to the bank account above
and update their payment record but if this Mr. Andrew Francis Svenkeson is not your
cousin/representative ensure you send a disclaimer to the executive governor of the
Central Bank of Nigeria and instruct him to remit your fund to you without delay via
an ATM digital card which is the most secured way to receive fund of such magnitude.
Below is the officially established email address of the Central Bank of Nigeria
(CBN).
Name: Godwin Emefiele
Office Address: Central Bank of Nigeria,
Tinubu Square, Lagos - Nigeria.
Email: [email protected]
We advise that you go ahead in dealing with the Central Bank of Nigeria with the
address above and be assured that we are monitoring all their activities as well as
your correspondence at all level. If you are presently dealing with any financial
institution(s) or person(s) claiming to have relevance to the payment of your
overdue funds out-side the above financial institution you are warned in your own
interest to stop further communication.
Be informed that any delay in reaction to this letter will be assumed that Mr.
Andrew Francis Svenkeson is your true representative and the funds will be remitted
into the nominated bank account that he has provided. The Central Bank of Nigeria
will not be held responsible for any wrong transfer made due to your inability to
furnish them with proper/correct information.Contact me directly here:
[email protected]
Yours Faithfully,
Agent Gilberto Greeves ,
Assistant Director, FBI Cyber Division.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
