by buried under 419s
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 11 May 2017 03:16:57 -0700
Received: from hde405.net-web.co.jp ([210.225.199.25]:55908 helo=net-web.co.jp)
by with smtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1d8l9Q-0003qg-Mh
for ; Thu, 11 May 2017 03:16:57 -0700
Received: (qmail 15537 invoked from network); 11 May 2017 03:20:31 +0900
Received: from unknown (HELO User) ([email protected]@177.1.3.139)
by hde405.net-web.co.jp with SMTP; 11 May 2017 03:20:31 +0900
Reply-To: <[email protected]>
From: "Mrs Robin Sanders"<[email protected]>
Date: Wed, 10 May 2017 15:20:37 -0300
MIME-Version: 1.0
Content-Type: text/html;
charset="_iso-2022-jp$ESC"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Message-ID: <[email protected]>
X-Spam-Status: Yes, score=32.1
X-Spam-Score: 321
X-Spam-Bar: ++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attn; Fund Beneficiary I am Mrs Robin Sanders, Former U.S.A
Ambassador to Nigeria. With reference to your entitlement fund and inline
with the CHANGE OF BENEFICARY'S APPLICATION, signed by Mrs. Glenda F. Ward
with your purported authorization. This case has been carefully examined
and we have declined Mrs. Ward's application and reported to the security
department for appropriate action, as the application lacks regular signature.
But Did you ever instruct Mrs Glenda F. Ward to claim your fund worth US$7.000.000?
Below is the bank account information provided by Mrs Glenda F. Ward saying
that you authorized her to claim your fund that you are terminally ill. [...]
Content analysis details: (32.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_HELO_USER Received from HELO User
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[210.225.199.25 listed in bb.barracudacentral.org]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[210.225.199.25 listed in zen.spamhaus.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[210.225.199.25 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?210.225.199.25>]
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[210.225.199.25 listed in bl.mailspike.net]
1.0 MISSING_HEADERS Missing To: header
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
1.8 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 T_HK_NAME_MR_MRS No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_1ECD5 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.5 KAM_LOTTO1 Likely to be an e-Lotto Scam Email
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.6 REPLYTO_WITHOUT_TO_CC No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** TRANSFER NOTIFICATION OF FUNDS (US$7,000,000)
Attn; Fund Beneficiary
I am Mrs Robin Sanders, Former U.S.A Ambassador to Nigeria. With reference to your
entitlement fund and inline with the CHANGE OF BENEFICARY'S APPLICATION, signed by
Mrs. Glenda F. Ward with your purported authorization. This case has been carefully
examined and we have declined Mrs. Ward's application and reported to the security
department for appropriate action, as the application lacks regular signature. But
Did you ever instruct Mrs Glenda F. Ward to claim your fund worth US$7.000.000?
Below is the bank account information provided by Mrs Glenda F. Ward saying that you
authorized her to claim your fund that you are terminally ill.
1.BANK NAME: BANK OF AMERICA
2.ACCOUNT NAME: GLENDA WARD
3.BANK ADDRESS: Kerrville Texas 78028 USA
4.ACCOUNT #: 3202650
5.ROUTING #: 114922443
If you had not authorized the change of your bank account in respect to your
outstanding entitlement Payment, therefore notify me immediately as the notification
/ declaration was supported with a sworn affidavit from Lagos high court ref: ilk
/jj/202/k2015, dated 10/05/2017 and signed by Mrs. Glenda Ward who claim and stated
in the sworn declaration that you authorized her to claim the said fund on your
behalf to a different bank account in the U.S.A as stated above because you were
terminally ill and the Doctor who is incharge of your case stated that you will not
stay more than one Month before passing away.
This development has caused lots of discrepancies in your payment file that is why
we had to suspend your payment and prompted to contact you directly before
rejuvenating your payment. You have to be rest assured that I will do everything
within my capacity to successfully actualize the quick transfer of your fund to any
of your nominated bank account.
Kindly get back to me as soon as possible so that I will direct you on what to do.
Sincerely Yours
Mrs Robin Sanders
Envelope-to:
Delivery-date: Thu, 11 May 2017 03:16:57 -0700
Received: from hde405.net-web.co.jp ([210.225.199.25]:55908 helo=net-web.co.jp)
by with smtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1d8l9Q-0003qg-Mh
for ; Thu, 11 May 2017 03:16:57 -0700
Received: (qmail 15537 invoked from network); 11 May 2017 03:20:31 +0900
Received: from unknown (HELO User) ([email protected]@177.1.3.139)
by hde405.net-web.co.jp with SMTP; 11 May 2017 03:20:31 +0900
Reply-To: <[email protected]>
From: "Mrs Robin Sanders"<[email protected]>
Date: Wed, 10 May 2017 15:20:37 -0300
MIME-Version: 1.0
Content-Type: text/html;
charset="_iso-2022-jp$ESC"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Message-ID: <[email protected]>
X-Spam-Status: Yes, score=32.1
X-Spam-Score: 321
X-Spam-Bar: ++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attn; Fund Beneficiary I am Mrs Robin Sanders, Former U.S.A
Ambassador to Nigeria. With reference to your entitlement fund and inline
with the CHANGE OF BENEFICARY'S APPLICATION, signed by Mrs. Glenda F. Ward
with your purported authorization. This case has been carefully examined
and we have declined Mrs. Ward's application and reported to the security
department for appropriate action, as the application lacks regular signature.
But Did you ever instruct Mrs Glenda F. Ward to claim your fund worth US$7.000.000?
Below is the bank account information provided by Mrs Glenda F. Ward saying
that you authorized her to claim your fund that you are terminally ill. [...]
Content analysis details: (32.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_HELO_USER Received from HELO User
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[210.225.199.25 listed in bb.barracudacentral.org]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[210.225.199.25 listed in zen.spamhaus.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[210.225.199.25 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?210.225.199.25>]
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[210.225.199.25 listed in bl.mailspike.net]
1.0 MISSING_HEADERS Missing To: header
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
1.8 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 T_HK_NAME_MR_MRS No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_1ECD5 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.5 KAM_LOTTO1 Likely to be an e-Lotto Scam Email
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.6 REPLYTO_WITHOUT_TO_CC No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** TRANSFER NOTIFICATION OF FUNDS (US$7,000,000)
Attn; Fund Beneficiary
I am Mrs Robin Sanders, Former U.S.A Ambassador to Nigeria. With reference to your
entitlement fund and inline with the CHANGE OF BENEFICARY'S APPLICATION, signed by
Mrs. Glenda F. Ward with your purported authorization. This case has been carefully
examined and we have declined Mrs. Ward's application and reported to the security
department for appropriate action, as the application lacks regular signature. But
Did you ever instruct Mrs Glenda F. Ward to claim your fund worth US$7.000.000?
Below is the bank account information provided by Mrs Glenda F. Ward saying that you
authorized her to claim your fund that you are terminally ill.
1.BANK NAME: BANK OF AMERICA
2.ACCOUNT NAME: GLENDA WARD
3.BANK ADDRESS: Kerrville Texas 78028 USA
4.ACCOUNT #: 3202650
5.ROUTING #: 114922443
If you had not authorized the change of your bank account in respect to your
outstanding entitlement Payment, therefore notify me immediately as the notification
/ declaration was supported with a sworn affidavit from Lagos high court ref: ilk
/jj/202/k2015, dated 10/05/2017 and signed by Mrs. Glenda Ward who claim and stated
in the sworn declaration that you authorized her to claim the said fund on your
behalf to a different bank account in the U.S.A as stated above because you were
terminally ill and the Doctor who is incharge of your case stated that you will not
stay more than one Month before passing away.
This development has caused lots of discrepancies in your payment file that is why
we had to suspend your payment and prompted to contact you directly before
rejuvenating your payment. You have to be rest assured that I will do everything
within my capacity to successfully actualize the quick transfer of your fund to any
of your nominated bank account.
Kindly get back to me as soon as possible so that I will direct you on what to do.
Sincerely Yours
Mrs Robin Sanders
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
