by buried under 419s
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 27 Nov 2017 13:36:51 -0800
Received: from ns1.wnetsystem.com.br ([177.12.92.8]:43222 helo=srv01.wnetsystem.com.br)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1eJR54-0003fW-DE
for ; Mon, 27 Nov 2017 13:36:51 -0800
Received: from [197.211.58.5] (helo=User)
by srv01.wnetsystem.com.br with esmtpa (Exim 4.84_2)
(envelope-from <[email protected]>)
id 1eJQzf-0003NH-Nf; Mon, 27 Nov 2017 19:31:12 -0200
Reply-To: <[email protected]>
From: "Mr Christopher Adams"<[email protected]>
Date: Mon, 27 Nov 2017 22:31:11 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=33.4
X-Spam-Score: 334
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: IMF PENDING PAYMENT APPROVED From I.M.F.MONITORING TEAM International
Monetary Fund (I.M.F), [...]
Content analysis details: (33.4 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.7 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[177.12.92.8 listed in bb.barracudacentral.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?177.12.92.8>]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[177.12.92.8 listed in zen.spamhaus.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(christopheadams111[at]hotmail.com)
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.0 MISSING_HEADERS Missing To: header
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.0 HK_NAME_MR_MRS No description available.
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
1.0 FORM_FRAUD_3 Fill a form and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** IMF PENDING PAYMENT APPROVED
IMF PENDING PAYMENT APPROVED
From I.M.F.MONITORING TEAM
International Monetary Fund (I.M.F),
African Regional Department building
Subject: Re: Intercepted Transfer
Attention: Beneficiary,
It has come to our notice in our Headquarters building (I.M.F) that your impending
funds from Africa, which was intercepted,has not been released to you ,We noticed
that you made several attempt to transfer your funds but to no avail. Our
investigation continued to the African Department (I.M.F),The monitoring team gave
an unsatisfactory report to your transaction, hence the chairman is presently under
investigation for conspiracy with your representative with intention to divert your
funds.
You are advised to desist from contacting anyone including your agent or
representative in these regard, International Monetary Fund has taken full
responsibility to transfer your fund to you,respond to these mail by providing your
full below:
YOUR FULL NAME:
YOUR ADDRESS:
YOUR TELE/FAX NUMBER:
YOUR OCCUPATION:
YOUR INTERNATIONAL PASSPORT COPY OR DRIVERS LICENSE COPY ( SCAN ED COPY )
SEND REPLY TO THIS EMAIL: [email protected]
Regards,
Mr Christopher Adams
Envelope-to:
Delivery-date: Mon, 27 Nov 2017 13:36:51 -0800
Received: from ns1.wnetsystem.com.br ([177.12.92.8]:43222 helo=srv01.wnetsystem.com.br)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1eJR54-0003fW-DE
for ; Mon, 27 Nov 2017 13:36:51 -0800
Received: from [197.211.58.5] (helo=User)
by srv01.wnetsystem.com.br with esmtpa (Exim 4.84_2)
(envelope-from <[email protected]>)
id 1eJQzf-0003NH-Nf; Mon, 27 Nov 2017 19:31:12 -0200
Reply-To: <[email protected]>
From: "Mr Christopher Adams"<[email protected]>
Date: Mon, 27 Nov 2017 22:31:11 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=33.4
X-Spam-Score: 334
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: IMF PENDING PAYMENT APPROVED From I.M.F.MONITORING TEAM International
Monetary Fund (I.M.F), [...]
Content analysis details: (33.4 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.7 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[177.12.92.8 listed in bb.barracudacentral.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?177.12.92.8>]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[177.12.92.8 listed in zen.spamhaus.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(christopheadams111[at]hotmail.com)
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.0 MISSING_HEADERS Missing To: header
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.0 HK_NAME_MR_MRS No description available.
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
1.0 FORM_FRAUD_3 Fill a form and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** IMF PENDING PAYMENT APPROVED
IMF PENDING PAYMENT APPROVED
From I.M.F.MONITORING TEAM
International Monetary Fund (I.M.F),
African Regional Department building
Subject: Re: Intercepted Transfer
Attention: Beneficiary,
It has come to our notice in our Headquarters building (I.M.F) that your impending
funds from Africa, which was intercepted,has not been released to you ,We noticed
that you made several attempt to transfer your funds but to no avail. Our
investigation continued to the African Department (I.M.F),The monitoring team gave
an unsatisfactory report to your transaction, hence the chairman is presently under
investigation for conspiracy with your representative with intention to divert your
funds.
You are advised to desist from contacting anyone including your agent or
representative in these regard, International Monetary Fund has taken full
responsibility to transfer your fund to you,respond to these mail by providing your
full below:
YOUR FULL NAME:
YOUR ADDRESS:
YOUR TELE/FAX NUMBER:
YOUR OCCUPATION:
YOUR INTERNATIONAL PASSPORT COPY OR DRIVERS LICENSE COPY ( SCAN ED COPY )
SEND REPLY TO THIS EMAIL: [email protected]
Regards,
Mr Christopher Adams
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
