by buried under 419s
Mon Jun 06, 2011 9:30 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 06 Jun 2011 13:40:33 -0700
Received: from rs25s9.datacenter.cha.cantv.net ([200.11.173.10])
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <[email protected]>)
id 1QTgb9-0007cQ-Cr
for ; Mon, 06 Jun 2011 13:40:33 -0700
X-Virus-Scanned: amavisd-new at cantv.net
Received: from webmail-05.datacenter.cha.cantv.net (webmail-05.datacenter.cha.cantv.net [200.11.153.88])
(authenticated bits=0)
by rs25s9.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP id p56KceHq030937;
Mon, 6 Jun 2011 16:08:43 -0430
X-Matched-Lists: []
Received: from 41.138.89.39 ([41.138.89.39]) by webmail-05.datacenter.cha.cantv.net (Cantv Webmail) with HTTP; Mon, 6 Jun 2011 16:08:40 -0430 (VET)
Date: Mon, 6 Jun 2011 16:08:40 -0430 (VET)
From: "MR.TONY MIKE" <[email protected]>
To: [email protected]
Message-ID: <657837131.400128.1307392723782.JavaMail.gess@webmail-05.datacenter.cha.cantv.net>
Subject: Dear Beneficiary
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Mailer: Cantv Webmail
X-Originating-IP: [41.138.89.39]
X-Spam-Subject: ***SPAM*** Dear Beneficiary
X-Spam-Status: Yes, score=17.3
X-Spam-Score: 173
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello I am writing to confirm if you are DEAD or ALIVE and
failure to reply back in the next 24hrs simply means what Rev Patrick Larry
said on 31/05/2011 was right that you are dead. Rev Patrick Larry has agreed
to pay the needed fund valued at $175.00US Dollars required for the Bond
Stamp Duty Fee of your Atm Card, but we have not gotten the money from him
yet as we want to find out if you are truly dead or not, so if you are still
alive you are advice in your own best interest to reply back immediately.
[...]
Content analysis details: (17.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[200.11.173.10 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?41.138.89.39>]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[200.11.173.10 listed in bb.barracudacentral.org]
0.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[200.11.173.10 listed in zen.spamhaus.org]
0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[41.138.89.39 listed in dnsbl.sorbs.net]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
-0.0 SPF_PASS SPF: sender matches SPF record
2.3 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.4 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_MR_MRS T_HK_NAME_MR_MRS
0.0 RFC_ABUSE_POST Both abuse and postmaster missing on sender domain
1.4 MONEY_ATM_CARD Lots of money on an ATM card
1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.5 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Hello
I am writing to confirm if you are DEAD or ALIVE and failure to reply back in the next 24hrs simply means what Rev Patr= ick Larry said on 31/05/2011 was right that you are dead. Rev Patrick Larry= has agreed to pay the needed fund valued at $175.00US Dollars required for the Bond Stamp Duty Fee of your Atm Card, but we have not gotten the money= from him yet as we want to find out if you are truly dead or not, so if you are still alive you are advice in your own best interest to reply back immediately.
The only money you will pay to our office is US$175.0= 0 for the paper works, Once we receive your mail we can stop further commun= ication with Rev. Patrick Larry, and deliver the ATM CARD to your door step= being the original beneficiary of the said US$750.000.00.
Besid= e if you fail to comply with the needed US$175.00 required there’s no= way we can deliver the ATM CARD and we will confirm that Rev. Larry, is sa= ying the truth, if you are Alive kindly comply with us immediately so that = we can deliver your ATM CARD to you without any more delay and have Rev Lar= ry reported to the International Police for arrested for attempting Fraud.
Looking forward to hearing from you if you are still very much a= live, reply back for fast action so that your delivery will commence upon receipt of your payment, as soon as I hear from you, I will advise you where to send the 175.00us
Regards,
Mrs Dorcas William
(ATM= Payment Centre)"
Contact me on my private E-mail:( [email protected] )
Envelope-to:
Delivery-date: Mon, 06 Jun 2011 13:40:33 -0700
Received: from rs25s9.datacenter.cha.cantv.net ([200.11.173.10])
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <[email protected]>)
id 1QTgb9-0007cQ-Cr
for ; Mon, 06 Jun 2011 13:40:33 -0700
X-Virus-Scanned: amavisd-new at cantv.net
Received: from webmail-05.datacenter.cha.cantv.net (webmail-05.datacenter.cha.cantv.net [200.11.153.88])
(authenticated bits=0)
by rs25s9.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP id p56KceHq030937;
Mon, 6 Jun 2011 16:08:43 -0430
X-Matched-Lists: []
Received: from 41.138.89.39 ([41.138.89.39]) by webmail-05.datacenter.cha.cantv.net (Cantv Webmail) with HTTP; Mon, 6 Jun 2011 16:08:40 -0430 (VET)
Date: Mon, 6 Jun 2011 16:08:40 -0430 (VET)
From: "MR.TONY MIKE" <[email protected]>
To: [email protected]
Message-ID: <657837131.400128.1307392723782.JavaMail.gess@webmail-05.datacenter.cha.cantv.net>
Subject: Dear Beneficiary
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Mailer: Cantv Webmail
X-Originating-IP: [41.138.89.39]
X-Spam-Subject: ***SPAM*** Dear Beneficiary
X-Spam-Status: Yes, score=17.3
X-Spam-Score: 173
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello I am writing to confirm if you are DEAD or ALIVE and
failure to reply back in the next 24hrs simply means what Rev Patrick Larry
said on 31/05/2011 was right that you are dead. Rev Patrick Larry has agreed
to pay the needed fund valued at $175.00US Dollars required for the Bond
Stamp Duty Fee of your Atm Card, but we have not gotten the money from him
yet as we want to find out if you are truly dead or not, so if you are still
alive you are advice in your own best interest to reply back immediately.
[...]
Content analysis details: (17.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[200.11.173.10 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?41.138.89.39>]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[200.11.173.10 listed in bb.barracudacentral.org]
0.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[200.11.173.10 listed in zen.spamhaus.org]
0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[41.138.89.39 listed in dnsbl.sorbs.net]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
-0.0 SPF_PASS SPF: sender matches SPF record
2.3 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.4 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_MR_MRS T_HK_NAME_MR_MRS
0.0 RFC_ABUSE_POST Both abuse and postmaster missing on sender domain
1.4 MONEY_ATM_CARD Lots of money on an ATM card
1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.5 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Hello
I am writing to confirm if you are DEAD or ALIVE and failure to reply back in the next 24hrs simply means what Rev Patr= ick Larry said on 31/05/2011 was right that you are dead. Rev Patrick Larry= has agreed to pay the needed fund valued at $175.00US Dollars required for the Bond Stamp Duty Fee of your Atm Card, but we have not gotten the money= from him yet as we want to find out if you are truly dead or not, so if you are still alive you are advice in your own best interest to reply back immediately.
The only money you will pay to our office is US$175.0= 0 for the paper works, Once we receive your mail we can stop further commun= ication with Rev. Patrick Larry, and deliver the ATM CARD to your door step= being the original beneficiary of the said US$750.000.00.
Besid= e if you fail to comply with the needed US$175.00 required there’s no= way we can deliver the ATM CARD and we will confirm that Rev. Larry, is sa= ying the truth, if you are Alive kindly comply with us immediately so that = we can deliver your ATM CARD to you without any more delay and have Rev Lar= ry reported to the International Police for arrested for attempting Fraud.
Looking forward to hearing from you if you are still very much a= live, reply back for fast action so that your delivery will commence upon receipt of your payment, as soon as I hear from you, I will advise you where to send the 175.00us
Regards,
Mrs Dorcas William
(ATM= Payment Centre)"
Contact me on my private E-mail:( [email protected] )
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces