by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id oE78MpT8DFrHOQAAjbubUg
for <>; Wed, 15 Nov 2017 18:48:52 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 15 Nov 2017 18:48:52 -0800
Received: from mail-oln040092069048.outbound.protection.outlook.com ([40.92.69.48]:1730 helo=EUR02-VE1-obe.outbound.protection.outlook.com)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1eFAEU-0003q5-QJ
for ; Wed, 15 Nov 2017 18:48:52 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
bh=j+n1vit08ExWnMcf21hCiew6c/g1aR7qK0maLboOZwQ=;
b=SudMFF1ZhRT0InAdeKxWvyE5A99XxW6fnaSu6uZxFVuPvBSIfJN1GKDPODhJWXH/caQcG2WF4PCCQTSExC99KcU+hfq9S+W8QYjtHZhGU4E7VkXU/YkKYqSvKG2uHq8F0Gqds1T7VLzZFRzPuf1MQ276Uj6KUC0PKhrMQrMUQQXUJQ2L99izjUDED/zhX2PJpxH59MLS7NGoN7eRG3W7cISW9228tNCtH87+mgRVLwJeGzKCgbsa4s54DTDIaGrAsaFYDTc7qgyy5/O7kO018KgR1FCCsKx3ZcF4cCcWEWzaFHNvYLn8bOtxlgv8p/OrRg+pnWXwULj/nDuLI2Xv4w==
Received: from AM5EUR02FT020.eop-EUR02.prod.protection.outlook.com
(10.152.8.57) by AM5EUR02HT007.eop-EUR02.prod.protection.outlook.com
(10.152.8.174) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.197.9; Thu, 16
Nov 2017 02:48:05 +0000
Received: from AM3PR08MB0676.eurprd08.prod.outlook.com (10.152.8.52) by
AM5EUR02FT020.mail.protection.outlook.com (10.152.8.125) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.20.218.12 via Frontend Transport; Thu, 16 Nov 2017 02:48:05 +0000
Received: from AM3PR08MB0676.eurprd08.prod.outlook.com
([fe80:
44de
7ce1]) by AM3PR08MB0676.eurprd08.prod.outlook.com
([fe80:44de7ce1%14]) with mapi id 15.20.0239.005; Thu, 16 Nov
2017 02:48:05 +0000
From: Central Bank of Nigeria <[email protected]>
Thread-Topic: INFORMATION
Thread-Index: AQHTXoVT6Mx1FqjpekuV3rWQkQeGqw==
Date: Thu, 16 Nov 2017 02:48:04 +0000
Message-ID: <AM3PR08MB0676795D4DE3BEE2C328184EC82E0@AM3PR08MB0676.eurprd08.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: yahoo.com; dkim=none (message not signed)
header.d=none;yahoo.com; dmarc=none action=none header.from=outlook.com;
x-incomingtopheadermarker: OriginalChecksum:4D625AC72212387DF462F113C38D7A1F8F2516CA132DFD7AC83BC728321BCB49;UpperCasedChecksum:6E876DF3EEA09A5435FA803C6E9B8E61EAB808E6C8546CCDBF8B0017C389294D;SizeAsReceived:10672;Count:42
x-tmn: [yd45HQ/OqFuoK6cZvLojJf9ppVmuvA2/aPuZQe6EMcEGZI3uThc+74WFeTjWvnQl]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;AM5EUR02HT007;6:Bk2yRNKlgnCRXAaScTbKli13OelDAglucirqMEn+7bbd0ybq6Bi0yrmEltqkRPMj1EWVc/ZAAYgOTyOEg4lBoif+bzz8H2WxZQbcIWNg1sfXiqkrWNGO46J60HHqvKiX2KfyBQ2m61QzbeEVqF668oIy9knYKgFsE29/vk3bm9wExid52UpjWhJVCfd5DYWZDvgQY7MExXxZrkBOxHp0FmOiheoHb8nyywE2NDeTEgtd3n5PkJEEioq16wvnAbo3IuR2t5lJS81YFueH6KPxy67czYdYn9fy4Ugg347fcgZTwKN6qeo9anxeMri0RJ+lQUxyEwsYeGIbIvMd9rXvbchYpEu+dj+3aIuUeR7ieo8=;5:ufAXYZQlbHJhQ6pdj3hDbQqw6KS62SmhpRNkfS8ndRjyEwfPKYTi97ZzMc46BfWJOvh9vuf2xAIwoTxknbjIKj25VmZ2JdhOeGF046ra0ep9r5G4852OUAYyAdFpQID4eIhn6qqEN/akdsVt9QX4/SO6i/QdmUcvQ/FjFz6xpLg=;24:86Ml6VZXnkqva+ug8Rb2UH/WqJUZbhqjbelkq760q75RoTaqU1HNFXcPq6SisZ0+eFUrVioaXCgpqnedBStyRWm+6pu+vS+WtNUKsXEJnFA=;7:0coIKt5LsuuIIiHpEU172sXC1V/QZEpPx8Eno494e1PECDoZ8vcmSXTkryWFb5IFkyOSycghcwNKj4kJ9MXQn7+rwJYtwMfbBFdqWWT10GhIQKwx4UyL1t1/KeivH6LuQhLlMvZAX5vA8X/L6S37yquwh16Va7DmdWI7pW8cFe6CNwXLWerfWg+mf3nT4AkacxRTkly7yJD6hHhUWwBJTFPla0lpEuM1JmfPVm9ufihby72HFJBbHoBugIE/W1PC
x-incomingheadercount: 42
x-eopattributedmessage: 0
x-ms-office365-filtering-correlation-id: ed755bb2-e0da-4fc2-a371-08d52c9c761c
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201702061074)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(201702181274)(2017031322404)(1603101448)(1601125374)(1701031045);SRVR:AM5EUR02HT007;
x-ms-exchange-slblob-mailprops: 7B6i23oPIUhiIQLYIo/9e3/1bCVMoDE+eJrVpa6APH+CFlt48QPTxWzt9qxL6a53I9VoKSwtHTfqC1iV4gJce1AUBZRfkKsggbfkW1OUOXnjHXNwFVD9E7SFXnMA6tNRc3dplLk5cpotZgolVNqzoAqDx6ijV8EqbX7MmVAnEEZOalaKBuzZa6iAXEdaudleqCaKWBqrQk9awl9xUGH6arIUhVIbW5TrO9wsNUrQAJJooILXRRh7cJNyzamHVR/8R99Jc0ASyrGZ1HmxaLSch2kBE3LbhgFMkxAWjXBFVadDxVur3kXO+dOjcMNlkOMhgHpaidGZlel1Rg0zcE/oFS5Cd+1hqI/eFHCjfVoqGOjQ12+Fl/rjt7eNwmwTnnCPYw6oSiQXuX8IyYRxk/Ix4qBxsIsiBD/FbJEOYcKMTCE+X8YfZ3nfQcMWldUhCLYywRXq2XVtvODPGVJuJ7jlybhxC9VfRZGC0Oo+HQnHAlfGDalez3odzg0c1ZiP6sFQV3+3iPJXG0xrhys0YcXBfhiDUKxFd3VsSNOC+8fJ8gwS/I1EAGlq2kAhtrEGJFlXRQ33TyQrdoSCxD46jW1Xa9YBbkGmNtNnqCuHhC1BYwlSbiwvbI1WAA==
x-ms-traffictypediagnostic: AM5EUR02HT007:
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031);SRVR:AM5EUR02HT007;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:AM5EUR02HT007;
x-forefront-prvs: 0493852DA9
x-forefront-antispam-report: SFV:NSPM;SFS:(7070007)(98901004);DIR:OUT;SFP:1901;SCL:1;SRVR:AM5EUR02HT007;H:AM3PR08MB0676.eurprd08.prod.outlook.com;FPR:;SPF:None;LANG:;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
boundary="_000_AM3PR08MB0676795D4DE3BEE2C328184EC82E0AM3PR08MB0676eurp_"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ed755bb2-e0da-4fc2-a371-08d52c9c761c
X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Nov 2017 02:48:04.9808
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5EUR02HT007
X-Spam-Status: Yes, score=9.1
X-Spam-Score: 91
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear Sir/ Ma My name is Godwin Emefiele, Governor, Central
bank of Nigeria. We have just received a sworn affidavit from Mr.Jeorme F
Karlz of United States of America,that you are dead and that you signed a
deed agreement with him to re-route your overdue outstanding amount of $12.3
million to him as the Next of Kin. You are advise to get back to this office
immediately also re-confirm the following information. Thus: [...]
Content analysis details: (9.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.0 HK_SCAM_N2 BODY: No description available.
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
0.0 HK_RANDOM_FROM From username looks random
-2.8 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.92.69.48 listed in wl.mailspike.net]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.92.69.48 listed in list.dnswl.org]
-0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(centtbbnnggung[at]outlook.com)
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.0 MISSING_HEADERS Missing To: header
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 LOTS_OF_MONEY Huge... sums of money
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
X-Spam-Flag: YES
Subject: ***SPAM*** INFORMATION
Dear Sir/ Ma
My name is Godwin Emefiele, Governor, Central bank of Nigeria. We have just received
a sworn affidavit from Mr.Jeorme F Karlz of United States of America,that you are
dead and that you signed a deed agreement with him to re-route your overdue
outstanding amount of $12.3 million to him as the Next of Kin. You are advise to
get back to this office immediately also re-confirm the following information. Thus:
1. Your full name:
2. Your Contact address
3. Your contact cell phone number:
4. Your age:
5. Your sex:
6. Your occupations:
7. Your country and city:
I await your response
Regards
Godwin Emefiele
Governor, Central Bank of Nigeria
Delivered-To:
Received: from
by with LMTP id oE78MpT8DFrHOQAAjbubUg
for <>; Wed, 15 Nov 2017 18:48:52 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 15 Nov 2017 18:48:52 -0800
Received: from mail-oln040092069048.outbound.protection.outlook.com ([40.92.69.48]:1730 helo=EUR02-VE1-obe.outbound.protection.outlook.com)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1eFAEU-0003q5-QJ
for ; Wed, 15 Nov 2017 18:48:52 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
bh=j+n1vit08ExWnMcf21hCiew6c/g1aR7qK0maLboOZwQ=;
b=SudMFF1ZhRT0InAdeKxWvyE5A99XxW6fnaSu6uZxFVuPvBSIfJN1GKDPODhJWXH/caQcG2WF4PCCQTSExC99KcU+hfq9S+W8QYjtHZhGU4E7VkXU/YkKYqSvKG2uHq8F0Gqds1T7VLzZFRzPuf1MQ276Uj6KUC0PKhrMQrMUQQXUJQ2L99izjUDED/zhX2PJpxH59MLS7NGoN7eRG3W7cISW9228tNCtH87+mgRVLwJeGzKCgbsa4s54DTDIaGrAsaFYDTc7qgyy5/O7kO018KgR1FCCsKx3ZcF4cCcWEWzaFHNvYLn8bOtxlgv8p/OrRg+pnWXwULj/nDuLI2Xv4w==
Received: from AM5EUR02FT020.eop-EUR02.prod.protection.outlook.com
(10.152.8.57) by AM5EUR02HT007.eop-EUR02.prod.protection.outlook.com
(10.152.8.174) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.197.9; Thu, 16
Nov 2017 02:48:05 +0000
Received: from AM3PR08MB0676.eurprd08.prod.outlook.com (10.152.8.52) by
AM5EUR02FT020.mail.protection.outlook.com (10.152.8.125) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.20.218.12 via Frontend Transport; Thu, 16 Nov 2017 02:48:05 +0000
Received: from AM3PR08MB0676.eurprd08.prod.outlook.com
([fe80:
44de
7ce1]) by AM3PR08MB0676.eurprd08.prod.outlook.com([fe80:
44de7ce1%14]) with mapi id 15.20.0239.005; Thu, 16 Nov2017 02:48:05 +0000
From: Central Bank of Nigeria <[email protected]>
Thread-Topic: INFORMATION
Thread-Index: AQHTXoVT6Mx1FqjpekuV3rWQkQeGqw==
Date: Thu, 16 Nov 2017 02:48:04 +0000
Message-ID: <AM3PR08MB0676795D4DE3BEE2C328184EC82E0@AM3PR08MB0676.eurprd08.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: yahoo.com; dkim=none (message not signed)
header.d=none;yahoo.com; dmarc=none action=none header.from=outlook.com;
x-incomingtopheadermarker: OriginalChecksum:4D625AC72212387DF462F113C38D7A1F8F2516CA132DFD7AC83BC728321BCB49;UpperCasedChecksum:6E876DF3EEA09A5435FA803C6E9B8E61EAB808E6C8546CCDBF8B0017C389294D;SizeAsReceived:10672;Count:42
x-tmn: [yd45HQ/OqFuoK6cZvLojJf9ppVmuvA2/aPuZQe6EMcEGZI3uThc+74WFeTjWvnQl]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;AM5EUR02HT007;6:Bk2yRNKlgnCRXAaScTbKli13OelDAglucirqMEn+7bbd0ybq6Bi0yrmEltqkRPMj1EWVc/ZAAYgOTyOEg4lBoif+bzz8H2WxZQbcIWNg1sfXiqkrWNGO46J60HHqvKiX2KfyBQ2m61QzbeEVqF668oIy9knYKgFsE29/vk3bm9wExid52UpjWhJVCfd5DYWZDvgQY7MExXxZrkBOxHp0FmOiheoHb8nyywE2NDeTEgtd3n5PkJEEioq16wvnAbo3IuR2t5lJS81YFueH6KPxy67czYdYn9fy4Ugg347fcgZTwKN6qeo9anxeMri0RJ+lQUxyEwsYeGIbIvMd9rXvbchYpEu+dj+3aIuUeR7ieo8=;5:ufAXYZQlbHJhQ6pdj3hDbQqw6KS62SmhpRNkfS8ndRjyEwfPKYTi97ZzMc46BfWJOvh9vuf2xAIwoTxknbjIKj25VmZ2JdhOeGF046ra0ep9r5G4852OUAYyAdFpQID4eIhn6qqEN/akdsVt9QX4/SO6i/QdmUcvQ/FjFz6xpLg=;24:86Ml6VZXnkqva+ug8Rb2UH/WqJUZbhqjbelkq760q75RoTaqU1HNFXcPq6SisZ0+eFUrVioaXCgpqnedBStyRWm+6pu+vS+WtNUKsXEJnFA=;7:0coIKt5LsuuIIiHpEU172sXC1V/QZEpPx8Eno494e1PECDoZ8vcmSXTkryWFb5IFkyOSycghcwNKj4kJ9MXQn7+rwJYtwMfbBFdqWWT10GhIQKwx4UyL1t1/KeivH6LuQhLlMvZAX5vA8X/L6S37yquwh16Va7DmdWI7pW8cFe6CNwXLWerfWg+mf3nT4AkacxRTkly7yJD6hHhUWwBJTFPla0lpEuM1JmfPVm9ufihby72HFJBbHoBugIE/W1PC
x-incomingheadercount: 42
x-eopattributedmessage: 0
x-ms-office365-filtering-correlation-id: ed755bb2-e0da-4fc2-a371-08d52c9c761c
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201702061074)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(201702181274)(2017031322404)(1603101448)(1601125374)(1701031045);SRVR:AM5EUR02HT007;
x-ms-exchange-slblob-mailprops: 7B6i23oPIUhiIQLYIo/9e3/1bCVMoDE+eJrVpa6APH+CFlt48QPTxWzt9qxL6a53I9VoKSwtHTfqC1iV4gJce1AUBZRfkKsggbfkW1OUOXnjHXNwFVD9E7SFXnMA6tNRc3dplLk5cpotZgolVNqzoAqDx6ijV8EqbX7MmVAnEEZOalaKBuzZa6iAXEdaudleqCaKWBqrQk9awl9xUGH6arIUhVIbW5TrO9wsNUrQAJJooILXRRh7cJNyzamHVR/8R99Jc0ASyrGZ1HmxaLSch2kBE3LbhgFMkxAWjXBFVadDxVur3kXO+dOjcMNlkOMhgHpaidGZlel1Rg0zcE/oFS5Cd+1hqI/eFHCjfVoqGOjQ12+Fl/rjt7eNwmwTnnCPYw6oSiQXuX8IyYRxk/Ix4qBxsIsiBD/FbJEOYcKMTCE+X8YfZ3nfQcMWldUhCLYywRXq2XVtvODPGVJuJ7jlybhxC9VfRZGC0Oo+HQnHAlfGDalez3odzg0c1ZiP6sFQV3+3iPJXG0xrhys0YcXBfhiDUKxFd3VsSNOC+8fJ8gwS/I1EAGlq2kAhtrEGJFlXRQ33TyQrdoSCxD46jW1Xa9YBbkGmNtNnqCuHhC1BYwlSbiwvbI1WAA==
x-ms-traffictypediagnostic: AM5EUR02HT007:
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031);SRVR:AM5EUR02HT007;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:AM5EUR02HT007;
x-forefront-prvs: 0493852DA9
x-forefront-antispam-report: SFV:NSPM;SFS:(7070007)(98901004);DIR:OUT;SFP:1901;SCL:1;SRVR:AM5EUR02HT007;H:AM3PR08MB0676.eurprd08.prod.outlook.com;FPR:;SPF:None;LANG:;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
boundary="_000_AM3PR08MB0676795D4DE3BEE2C328184EC82E0AM3PR08MB0676eurp_"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ed755bb2-e0da-4fc2-a371-08d52c9c761c
X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Nov 2017 02:48:04.9808
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5EUR02HT007
X-Spam-Status: Yes, score=9.1
X-Spam-Score: 91
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear Sir/ Ma My name is Godwin Emefiele, Governor, Central
bank of Nigeria. We have just received a sworn affidavit from Mr.Jeorme F
Karlz of United States of America,that you are dead and that you signed a
deed agreement with him to re-route your overdue outstanding amount of $12.3
million to him as the Next of Kin. You are advise to get back to this office
immediately also re-confirm the following information. Thus: [...]
Content analysis details: (9.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.0 HK_SCAM_N2 BODY: No description available.
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
0.0 HK_RANDOM_FROM From username looks random
-2.8 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.92.69.48 listed in wl.mailspike.net]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.92.69.48 listed in list.dnswl.org]
-0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(centtbbnnggung[at]outlook.com)
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.0 MISSING_HEADERS Missing To: header
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 LOTS_OF_MONEY Huge... sums of money
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
X-Spam-Flag: YES
Subject: ***SPAM*** INFORMATION
Dear Sir/ Ma
My name is Godwin Emefiele, Governor, Central bank of Nigeria. We have just received
a sworn affidavit from Mr.Jeorme F Karlz of United States of America,that you are
dead and that you signed a deed agreement with him to re-route your overdue
outstanding amount of $12.3 million to him as the Next of Kin. You are advise to
get back to this office immediately also re-confirm the following information. Thus:
1. Your full name:
2. Your Contact address
3. Your contact cell phone number:
4. Your age:
5. Your sex:
6. Your occupations:
7. Your country and city:
I await your response
Regards
Godwin Emefiele
Governor, Central Bank of Nigeria
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
