by buried under 419s
Sat Aug 13, 2011 11:25 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 13 Aug 2011 19:39:24 -0700
Received: from [41.197.94.3] (helo=mail.cogear.co.rw)
by with esmtp (Exim 4.69)
(envelope-from <[email protected]>)
id 1QsQbM-0001gP-6r
for ; Sat, 13 Aug 2011 19:39:24 -0700
Received: from User ([196.202.126.66]) by mail.cogear.co.rw with Microsoft SMTPSVC(6.0.3790.3959);
Sun, 14 Aug 2011 04:00:33 +0300
Reply-To: <[email protected]>
From: "W H B"<[email protected]>
To: W H B
Subject: Business Deal!!!
Date: Sun, 14 Aug 2011 03:55:41 +0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1250"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <[email protected]>
X-OriginalArrivalTime: 14 Aug 2011 01:00:35.0125 (UTC) FILETIME=[92DA8E50:01CC5A1D]
X-Spam-Subject: ***SPAM*** Business Deal!!!
X-Spam-Status: Yes, score=18.5
X-Spam-Score: 185
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Good-Day Friend, I need your assistance in transferring a
deceased client fund of $18.5M USD out of my Bank here in Hong Kong. If interested
reply to my personal email on [email protected] for more details. [...]
Content analysis details: (18.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.1 TO_MALFORMED To: has a malformed address
1.2 NSL_RCVD_FROM_USER Received from User
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?41.197.94.3>]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[41.197.94.3 listed in bb.barracudacentral.org]
0.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[41.197.94.3 listed in zen.spamhaus.org]
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5020]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSPACED From: missing whitespace
0.5 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.5 FROM_MISSP_USER From misspaced, from "User"
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Good-Day Friend,
I need your assistance in transferring a deceased client fund of $18.5M USD out of my Bank here in Hong Kong. If interested reply to my personal email on [email protected] for more details.
Sincerely,
Mr. Ho chi Wai Louis
[email protected]
Envelope-to:
Delivery-date: Sat, 13 Aug 2011 19:39:24 -0700
Received: from [41.197.94.3] (helo=mail.cogear.co.rw)
by with esmtp (Exim 4.69)
(envelope-from <[email protected]>)
id 1QsQbM-0001gP-6r
for ; Sat, 13 Aug 2011 19:39:24 -0700
Received: from User ([196.202.126.66]) by mail.cogear.co.rw with Microsoft SMTPSVC(6.0.3790.3959);
Sun, 14 Aug 2011 04:00:33 +0300
Reply-To: <[email protected]>
From: "W H B"<[email protected]>
To: W H B
Subject: Business Deal!!!
Date: Sun, 14 Aug 2011 03:55:41 +0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1250"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <[email protected]>
X-OriginalArrivalTime: 14 Aug 2011 01:00:35.0125 (UTC) FILETIME=[92DA8E50:01CC5A1D]
X-Spam-Subject: ***SPAM*** Business Deal!!!
X-Spam-Status: Yes, score=18.5
X-Spam-Score: 185
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Good-Day Friend, I need your assistance in transferring a
deceased client fund of $18.5M USD out of my Bank here in Hong Kong. If interested
reply to my personal email on [email protected] for more details. [...]
Content analysis details: (18.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.1 TO_MALFORMED To: has a malformed address
1.2 NSL_RCVD_FROM_USER Received from User
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?41.197.94.3>]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[41.197.94.3 listed in bb.barracudacentral.org]
0.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[41.197.94.3 listed in zen.spamhaus.org]
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5020]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSPACED From: missing whitespace
0.5 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.5 FROM_MISSP_USER From misspaced, from "User"
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Good-Day Friend,
I need your assistance in transferring a deceased client fund of $18.5M USD out of my Bank here in Hong Kong. If interested reply to my personal email on [email protected] for more details.
Sincerely,
Mr. Ho chi Wai Louis
[email protected]
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces