by buried under 419s
Return-path: <"www."@honey.ocn.ne.jp>
Envelope-to:
Delivery-date: Tue, 13 Jun 2017 09:52:36 -0700
Received: from mbkd0136.ocn.ad.jp ([153.149.230.37]:36557)
by with esmtp (Exim 4.89)
(envelope-from <"www."@honey.ocn.ne.jp>)
id 1dKp3P-0005lI-0s
for ; Tue, 13 Jun 2017 09:52:36 -0700
Received: from mf-smf-ucb001.ocn.ad.jp (mf-smf-ucb001.ocn.ad.jp [153.149.227.3])
by mbkd0136.ocn.ad.jp (Postfix) with ESMTP id A1E68683624;
Wed, 14 Jun 2017 01:50:05 +0900 (JST)
Received: from mf-smf-ucb001.ocn.ad.jp (mf-smf-ucb001 [153.149.227.3])
by mf-smf-ucb001.ocn.ad.jp (Postfix) with ESMTP id 824F6205EB;
Wed, 14 Jun 2017 01:50:05 +0900 (JST)
Received: from ntt.pod01.mv-mta-ucb022 (mv-mta-ucb022.ocn.ad.jp [153.149.142.85])
by mf-smf-ucb001.ocn.ad.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id v5DGnlPb019964;
Wed, 14 Jun 2017 01:50:01 +0900
Received: from vcwebmail.ocn.ad.jp ([153.149.227.167])
by ntt.pod01.mv-mta-ucb022 with
id YGq01v0023dLKTM01Gq0Vd; Tue, 13 Jun 2017 16:50:01 +0000
Received: from mzkstore648.ocn.ad.jp (mz-ukg648p.ocn.ad.jp [153.149.139.2])
by vcwebmail.ocn.ad.jp (Postfix) with ESMTP;
Wed, 14 Jun 2017 01:50:00 +0900 (JST)
Date: Wed, 14 Jun 2017 01:50:00 +0900 (JST)
From: Nico Flower <"www."@honey.ocn.ne.jp>
Reply-To: "[email protected]" <[email protected]>
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit
X-Originating-IP: [197.234.219.41]
X-Spam-Status: Yes, score=27.9
X-Spam-Score: 279
X-Spam-Bar: +++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attention Customer, You have received this email because you
are a Customer of Western Union Money Transfer. I have been trying to get
in-touch with you on phone before I traveled. I have handed over your funds
of $ 2,500.000.00 USD to the new Director here Rev. Innocent Johnson. I have
remitted the first payment of $5,000 with the help of my working partner
Rev. Innocent Johnson to you and here is the information. [...]
Content analysis details: (27.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?197.234.219.41>]
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[153.149.230.37 listed in bb.barracudacentral.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[153.149.230.37 listed in psbl.surriel.com]
2.5 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)
[153.149.230.37 listed in bl.mailspike.net]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[153.149.230.37 listed in zen.spamhaus.org]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[197.234.219.41 listed in zen.spamhaus.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 MISSING_HEADERS Missing To: header
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(rev.innocentjohnson890[at]yahoo.com)
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
X-Spam-Flag: YES
Subject: ***SPAM*** M.T.C.N: 493-088-6481
Attention Customer,
You have received this email because you are a Customer of Western Union Money
Transfer.
I have been trying to get in-touch with you on phone before I traveled. I have
handed over your funds of $ 2,500.000.00 USD to the new Director here Rev. Innocent
Johnson. I have remitted the first payment of $5,000 with the help of my working
partner Rev. Innocent Johnson to you and here is the information.
LINK: https://www.westernunion.com/us/en/send ... cktransfer
Money Transfer Control Number M.T.C.N: 493-088-6481
Sender’s First Name: Paul
Sender’s Last Name: Larry
Text Question:.......RIGHT
Answer: .............NOW
I told him to keep sending you $ 5,000 USD daily until the payment of $ 2,500.000.00
USD is completed and again forward them your Telephone number,Full Name, Your
Country and address so that they will be ure.Please,contact: Rev. Innocent Johnson
with the below details:
Contact Person: Rev. Innocent Johnson
Phone: +229-68518408
Email Address: [email protected]
Noted: If there is any problem with the transfer, do contact Rev. Innocent Johnson
and he will solve it for you. The care of the funds is under his custody now.
Regards,
Nico Flower
Envelope-to:
Delivery-date: Tue, 13 Jun 2017 09:52:36 -0700
Received: from mbkd0136.ocn.ad.jp ([153.149.230.37]:36557)
by with esmtp (Exim 4.89)
(envelope-from <"www."@honey.ocn.ne.jp>)
id 1dKp3P-0005lI-0s
for ; Tue, 13 Jun 2017 09:52:36 -0700
Received: from mf-smf-ucb001.ocn.ad.jp (mf-smf-ucb001.ocn.ad.jp [153.149.227.3])
by mbkd0136.ocn.ad.jp (Postfix) with ESMTP id A1E68683624;
Wed, 14 Jun 2017 01:50:05 +0900 (JST)
Received: from mf-smf-ucb001.ocn.ad.jp (mf-smf-ucb001 [153.149.227.3])
by mf-smf-ucb001.ocn.ad.jp (Postfix) with ESMTP id 824F6205EB;
Wed, 14 Jun 2017 01:50:05 +0900 (JST)
Received: from ntt.pod01.mv-mta-ucb022 (mv-mta-ucb022.ocn.ad.jp [153.149.142.85])
by mf-smf-ucb001.ocn.ad.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id v5DGnlPb019964;
Wed, 14 Jun 2017 01:50:01 +0900
Received: from vcwebmail.ocn.ad.jp ([153.149.227.167])
by ntt.pod01.mv-mta-ucb022 with
id YGq01v0023dLKTM01Gq0Vd; Tue, 13 Jun 2017 16:50:01 +0000
Received: from mzkstore648.ocn.ad.jp (mz-ukg648p.ocn.ad.jp [153.149.139.2])
by vcwebmail.ocn.ad.jp (Postfix) with ESMTP;
Wed, 14 Jun 2017 01:50:00 +0900 (JST)
Date: Wed, 14 Jun 2017 01:50:00 +0900 (JST)
From: Nico Flower <"www."@honey.ocn.ne.jp>
Reply-To: "[email protected]" <[email protected]>
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit
X-Originating-IP: [197.234.219.41]
X-Spam-Status: Yes, score=27.9
X-Spam-Score: 279
X-Spam-Bar: +++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attention Customer, You have received this email because you
are a Customer of Western Union Money Transfer. I have been trying to get
in-touch with you on phone before I traveled. I have handed over your funds
of $ 2,500.000.00 USD to the new Director here Rev. Innocent Johnson. I have
remitted the first payment of $5,000 with the help of my working partner
Rev. Innocent Johnson to you and here is the information. [...]
Content analysis details: (27.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?197.234.219.41>]
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[153.149.230.37 listed in bb.barracudacentral.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[153.149.230.37 listed in psbl.surriel.com]
2.5 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)
[153.149.230.37 listed in bl.mailspike.net]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[153.149.230.37 listed in zen.spamhaus.org]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[197.234.219.41 listed in zen.spamhaus.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 MISSING_HEADERS Missing To: header
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(rev.innocentjohnson890[at]yahoo.com)
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
X-Spam-Flag: YES
Subject: ***SPAM*** M.T.C.N: 493-088-6481
Attention Customer,
You have received this email because you are a Customer of Western Union Money
Transfer.
I have been trying to get in-touch with you on phone before I traveled. I have
handed over your funds of $ 2,500.000.00 USD to the new Director here Rev. Innocent
Johnson. I have remitted the first payment of $5,000 with the help of my working
partner Rev. Innocent Johnson to you and here is the information.
LINK: https://www.westernunion.com/us/en/send ... cktransfer
Money Transfer Control Number M.T.C.N: 493-088-6481
Sender’s First Name: Paul
Sender’s Last Name: Larry
Text Question:.......RIGHT
Answer: .............NOW
I told him to keep sending you $ 5,000 USD daily until the payment of $ 2,500.000.00
USD is completed and again forward them your Telephone number,Full Name, Your
Country and address so that they will be ure.Please,contact: Rev. Innocent Johnson
with the below details:
Contact Person: Rev. Innocent Johnson
Phone: +229-68518408
Email Address: [email protected]
Noted: If there is any problem with the transfer, do contact Rev. Innocent Johnson
and he will solve it for you. The care of the funds is under his custody now.
Regards,
Nico Flower
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
