by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id EChULV7jXFqoNwAAjbubUg
for <>; Mon, 15 Jan 2018 09:22:38 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 15 Jan 2018 09:22:38 -0800
Received: from 59-124-152-238.hinet-ip.hinet.net ([59.124.152.238]:52298 helo=jcsr3.jc01.com.tw)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1eb8Su-0003hO-TB
for ; Mon, 15 Jan 2018 09:22:38 -0800
Received: from User ([129.205.138.194]) by jcsr3.jc01.com.tw with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 16 Jan 2018 01:21:48 +0800
Reply-To: <[email protected]>
From: "JOHN JOHNSON"<[email protected]>
Date: Mon, 15 Jan 2018 18:21:50 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
Message-ID: <[email protected]>
X-OriginalArrivalTime: 15 Jan 2018 17:21:49.0443 (UTC) FILETIME=[53C80D30:01D38E25]
X-Spam-Status: Yes, score=64.6
X-Spam-Score: 646
X-Spam-Bar: +++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear Beneficiary, How are you doing today and hope this email
finds you well. My name is John Johnson with Central Bank of Nigeria/ United
Nation foreign debt settlement.I was sent here after the meeting and agreement
with President Muhammadu Buhari over the conclusion and strategy on how to
release your fund. [...]
Content analysis details: (64.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.2 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.6 URG_BIZ BODY: Contains urgent matter
0.5 KAM_NUMSUBJECT Subject ends in numbers
1.4 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 TVD_RCVD_IP Message was received from an IP address
3.0 NSL_RCVD_FROM_USER Received from User
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[59.124.152.238 listed in bb.barracudacentral.org]
4.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[59.124.152.238 listed in zen.spamhaus.org]
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(johnson.johnson-ky[at]yandex.com)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.2 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
3.2 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.8 FSL_NEW_HELO_USER Spam's using Helo and User
2.5 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
1.4 FROM_MISSP_USER From misspaced, from "User"
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.0 FROM_MISSP_DYNIP From misspaced + dynamic rDNS
1.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.6 FROM_MISSPACED From: missing whitespace
1.3 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.3 TO_NO_BRKTS_DYNIP To: lacks brackets and dynamic rDNS
2.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
3.5 FROM_MISSP_FREEMAIL From misspaced + freemail provider
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.4 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.1 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** CALL ME IMMEDIATELY: +1-786-763-3265
Dear Beneficiary,
How are you doing today and hope this email finds you well. My name is John Johnson
with Central Bank of Nigeria/ United Nation foreign debt settlement.I was sent here
after the meeting and agreement with President Muhammadu Buhari over the conclusion
and strategy on how to release your fund.
The President set a goal and it was agreed that if you do not have the original
document of your fund, no bank or organization will make any payment to you because
all banks in Europe, Asia, London, USA that you have been in contact with towards
the release of this fund has revert back to CBN treasury department. Any banks or
organization contacting you or, you might have been in contact with towards
releasing any fund to you is only deceiving you which at the end you will not
receive anything from them but lost your hard earned money.
That's why it was declared that all beneficiaries will have their original documents
of their contract/inheritance fund to proof that this fund is legal and legitimate.
All agents in United States is aware of this meeting like FBI, Homeland Security,
CIA and without the beneficiary having this original documents from the CBN, you
will never be in any position to receive the fund as the rightful owner of the fund.
In conclusion, you have been advise to comply with this instruction accordingly to
enable me complete the delivery of your bank draft valued $10.6 Million Dollars
which i have been sent over here to deliver to you. I need you to send me a copy of
the Fund Ownership Certificate issued to you and signed by President Goodluck
Jonathan to be presented to the authority here and to complete the delivery. If you
do not have it, let me know immediately so they can send it to you by courier which
is the only thing you need to receive your fund.
Also send me your address where to make the delivery and direct contact number.
Meanwhile, you can reach me on the above number +1-786-763-3265 leave a message if i
do not answer and i shall return your call.
Awaiting your immediate and urgent response.
Regards,
Mr. John Johnson.
Delivered-To:
Received: from
by with LMTP id EChULV7jXFqoNwAAjbubUg
for <>; Mon, 15 Jan 2018 09:22:38 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 15 Jan 2018 09:22:38 -0800
Received: from 59-124-152-238.hinet-ip.hinet.net ([59.124.152.238]:52298 helo=jcsr3.jc01.com.tw)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1eb8Su-0003hO-TB
for ; Mon, 15 Jan 2018 09:22:38 -0800
Received: from User ([129.205.138.194]) by jcsr3.jc01.com.tw with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 16 Jan 2018 01:21:48 +0800
Reply-To: <[email protected]>
From: "JOHN JOHNSON"<[email protected]>
Date: Mon, 15 Jan 2018 18:21:50 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
Message-ID: <[email protected]>
X-OriginalArrivalTime: 15 Jan 2018 17:21:49.0443 (UTC) FILETIME=[53C80D30:01D38E25]
X-Spam-Status: Yes, score=64.6
X-Spam-Score: 646
X-Spam-Bar: +++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear Beneficiary, How are you doing today and hope this email
finds you well. My name is John Johnson with Central Bank of Nigeria/ United
Nation foreign debt settlement.I was sent here after the meeting and agreement
with President Muhammadu Buhari over the conclusion and strategy on how to
release your fund. [...]
Content analysis details: (64.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.2 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.6 URG_BIZ BODY: Contains urgent matter
0.5 KAM_NUMSUBJECT Subject ends in numbers
1.4 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 TVD_RCVD_IP Message was received from an IP address
3.0 NSL_RCVD_FROM_USER Received from User
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[59.124.152.238 listed in bb.barracudacentral.org]
4.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[59.124.152.238 listed in zen.spamhaus.org]
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(johnson.johnson-ky[at]yandex.com)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.2 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
3.2 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.8 FSL_NEW_HELO_USER Spam's using Helo and User
2.5 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
1.4 FROM_MISSP_USER From misspaced, from "User"
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.0 FROM_MISSP_DYNIP From misspaced + dynamic rDNS
1.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.6 FROM_MISSPACED From: missing whitespace
1.3 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.3 TO_NO_BRKTS_DYNIP To: lacks brackets and dynamic rDNS
2.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
3.5 FROM_MISSP_FREEMAIL From misspaced + freemail provider
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.4 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.1 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** CALL ME IMMEDIATELY: +1-786-763-3265
Dear Beneficiary,
How are you doing today and hope this email finds you well. My name is John Johnson
with Central Bank of Nigeria/ United Nation foreign debt settlement.I was sent here
after the meeting and agreement with President Muhammadu Buhari over the conclusion
and strategy on how to release your fund.
The President set a goal and it was agreed that if you do not have the original
document of your fund, no bank or organization will make any payment to you because
all banks in Europe, Asia, London, USA that you have been in contact with towards
the release of this fund has revert back to CBN treasury department. Any banks or
organization contacting you or, you might have been in contact with towards
releasing any fund to you is only deceiving you which at the end you will not
receive anything from them but lost your hard earned money.
That's why it was declared that all beneficiaries will have their original documents
of their contract/inheritance fund to proof that this fund is legal and legitimate.
All agents in United States is aware of this meeting like FBI, Homeland Security,
CIA and without the beneficiary having this original documents from the CBN, you
will never be in any position to receive the fund as the rightful owner of the fund.
In conclusion, you have been advise to comply with this instruction accordingly to
enable me complete the delivery of your bank draft valued $10.6 Million Dollars
which i have been sent over here to deliver to you. I need you to send me a copy of
the Fund Ownership Certificate issued to you and signed by President Goodluck
Jonathan to be presented to the authority here and to complete the delivery. If you
do not have it, let me know immediately so they can send it to you by courier which
is the only thing you need to receive your fund.
Also send me your address where to make the delivery and direct contact number.
Meanwhile, you can reach me on the above number +1-786-763-3265 leave a message if i
do not answer and i shall return your call.
Awaiting your immediate and urgent response.
Regards,
Mr. John Johnson.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
