by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id mMvkEbiXg1w7awAAjbubUg
for <>; Sat, 09 Mar 2019 02:38:48 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 09 Mar 2019 02:38:48 -0800
Received: from mail.baltnet.ru ([217.168.64.22]:40955)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1h2ZNN-00078A-Pe
for ; Sat, 09 Mar 2019 02:38:48 -0800
Received: from User (117-201-36-78.baltnet.ru [78.36.201.117])
by mail.baltnet.ru (8.14.6/8.14.6) with SMTP id x29AbpBF022286;
Sat, 9 Mar 2019 12:37:57 +0200
Message-Id: <[email protected]>
Reply-To: <[email protected]>
From: "PRESIDENT MUHAMMADU BUHARI"<[email protected]>
Date: Sat, 9 Mar 2019 11:37:59 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=28.6
X-Spam-Score: 286
X-Spam-Bar: ++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: FROM THE OFFICE OF MUHAMMADU BUHARI, THE PRESIDENT AND COMMANDER-IN-CHIEF
OF THE ARMED FORCES OF THE FEDERAL REPUBLIC OF NIGERIA. Dear Beneficiary,
I am sorry for not being in contact with you for sometime as i have been
very busy with my re-election activities which have just been concluded. I
have also tried calling you several times but couldn't reach you. However,
i have been informed by the Bank of America that your fund is currently deposited
with the Pacific Western bank for seizure since you refused to comply with
their directives. I have written to them and pleaded with them to give you
the grace to make contact with them rather than confiscating your fund without
hearing from you. The good thing is that this fund is also deposited under
your name where you can be provided with the details to access your fund,
confirm your account online before anything can be done from your part. [...]
Content analysis details: (28.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 NSL_RCVD_FROM_USER Received from User
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[78.36.201.117 listed in zen.spamhaus.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?78.36.201.117>]
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low
trust
[217.168.64.22 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(federalgn.buhari[at]gmail.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 MISSING_HEADERS Missing To: header
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
1.5 SUBJ_ALL_CAPS Subject is all capitals
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.4 MALFORMED_FREEMAIL Bad headers on message from free email service
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
0.0 FROM_MISSPACED From: missing whitespace
1.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** YOUR DEPOSITED FUND
FROM THE OFFICE OF MUHAMMADU BUHARI, THE PRESIDENT AND COMMANDER-IN-CHIEF OF THE
ARMED FORCES OF THE FEDERAL REPUBLIC OF NIGERIA.
Dear Beneficiary,
I am sorry for not being in contact with you for sometime as i have been very busy
with my re-election activities which have just been concluded. I have also tried
calling you several times but couldn't reach you. However, i have been informed by
the Bank of America that your fund is currently deposited with the Pacific Western
bank for seizure since you refused to comply with their directives. I have written
to them and pleaded with them to give you the grace to make contact with them rather
than confiscating your fund without hearing from you. The good thing is that this
fund is also deposited under your name where you can be provided with the details to
access your fund, confirm your account online before anything can be done from your
part.
They are now waiting for you to make contact with them and you need to do that
immediately and comply with the directives to avoid having your fund confiscated. I
need you to get back to me immediately on the receipt of your email so i can provide
you the contact details of the bank.
Looking forward to your immediate response and co-operation.
Kind Regards,
Muhammadu Buhari,
(President and Commander-In-Chief of the Armed Forces of the Federal Republic of
Nigeria).
Delivered-To:
Received: from
by with LMTP id mMvkEbiXg1w7awAAjbubUg
for <>; Sat, 09 Mar 2019 02:38:48 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 09 Mar 2019 02:38:48 -0800
Received: from mail.baltnet.ru ([217.168.64.22]:40955)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1h2ZNN-00078A-Pe
for ; Sat, 09 Mar 2019 02:38:48 -0800
Received: from User (117-201-36-78.baltnet.ru [78.36.201.117])
by mail.baltnet.ru (8.14.6/8.14.6) with SMTP id x29AbpBF022286;
Sat, 9 Mar 2019 12:37:57 +0200
Message-Id: <[email protected]>
Reply-To: <[email protected]>
From: "PRESIDENT MUHAMMADU BUHARI"<[email protected]>
Date: Sat, 9 Mar 2019 11:37:59 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=28.6
X-Spam-Score: 286
X-Spam-Bar: ++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: FROM THE OFFICE OF MUHAMMADU BUHARI, THE PRESIDENT AND COMMANDER-IN-CHIEF
OF THE ARMED FORCES OF THE FEDERAL REPUBLIC OF NIGERIA. Dear Beneficiary,
I am sorry for not being in contact with you for sometime as i have been
very busy with my re-election activities which have just been concluded. I
have also tried calling you several times but couldn't reach you. However,
i have been informed by the Bank of America that your fund is currently deposited
with the Pacific Western bank for seizure since you refused to comply with
their directives. I have written to them and pleaded with them to give you
the grace to make contact with them rather than confiscating your fund without
hearing from you. The good thing is that this fund is also deposited under
your name where you can be provided with the details to access your fund,
confirm your account online before anything can be done from your part. [...]
Content analysis details: (28.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 NSL_RCVD_FROM_USER Received from User
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[78.36.201.117 listed in zen.spamhaus.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?78.36.201.117>]
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low
trust
[217.168.64.22 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(federalgn.buhari[at]gmail.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 MISSING_HEADERS Missing To: header
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
1.5 SUBJ_ALL_CAPS Subject is all capitals
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.4 MALFORMED_FREEMAIL Bad headers on message from free email service
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
0.0 FROM_MISSPACED From: missing whitespace
1.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** YOUR DEPOSITED FUND
FROM THE OFFICE OF MUHAMMADU BUHARI, THE PRESIDENT AND COMMANDER-IN-CHIEF OF THE
ARMED FORCES OF THE FEDERAL REPUBLIC OF NIGERIA.
Dear Beneficiary,
I am sorry for not being in contact with you for sometime as i have been very busy
with my re-election activities which have just been concluded. I have also tried
calling you several times but couldn't reach you. However, i have been informed by
the Bank of America that your fund is currently deposited with the Pacific Western
bank for seizure since you refused to comply with their directives. I have written
to them and pleaded with them to give you the grace to make contact with them rather
than confiscating your fund without hearing from you. The good thing is that this
fund is also deposited under your name where you can be provided with the details to
access your fund, confirm your account online before anything can be done from your
part.
They are now waiting for you to make contact with them and you need to do that
immediately and comply with the directives to avoid having your fund confiscated. I
need you to get back to me immediately on the receipt of your email so i can provide
you the contact details of the bank.
Looking forward to your immediate response and co-operation.
Kind Regards,
Muhammadu Buhari,
(President and Commander-In-Chief of the Armed Forces of the Federal Republic of
Nigeria).
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
