by buried under 419s
Thu Oct 06, 2011 12:26 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 06 Oct 2011 06:46:18 -0700
Received: from 10ibl21ser04.datacenter.cha.cantv.net ([200.11.173.10])
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <[email protected]>)
id 1RBoHB-0008FK-A4
for ; Thu, 06 Oct 2011 06:46:18 -0700
X-Virus-Scanned: amavisd-new at cantv.net
Received: from webmail-01.datacenter.cha.cantv.net (webmail-01.datacenter.cha.cantv.net [200.11.153.84])
(authenticated bits=0)
by 10ibl21ser04.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP id p96Di2Jq032086;
Thu, 6 Oct 2011 09:14:02 -0430
X-Matched-Lists: []
Received: from 41.216.40.128 ([41.216.40.128]) by webmail-01.datacenter.cha.cantv.net (Cantv Webmail) with HTTP; Thu, 6 Oct 2011 09:14:02 -0430 (VET)
Date: Thu, 6 Oct 2011 09:14:02 -0430 (VET)
From: festus <[email protected]>
Reply-To: [email protected]
To: [email protected]
Message-ID: <726540796.741356.1317908642557.JavaMail.gess@webmail-01.datacenter.cha.cantv.net>
Subject: festus and caroline Attah.
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Mailer: Cantv Webmail
X-Originating-IP: [41.216.40.128]
X-Spam-Subject: ***SPAM*** festus and caroline Attah.
X-Spam-Status: Yes, score=8.1
X-Spam-Score: 81
X-Spam-Bar: ++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello Dear, Good Day to you, I know this mail may come to
you as a surprise, since we have not known or written before. I am festus
attah, I am contacting you on behalf of myself and my younger sister caroline,
We are an orphan. [...]
Content analysis details: (8.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[200.11.173.10 listed in psbl.surriel.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4999]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.4 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 LOTS_OF_MONEY Huge... sums of money
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.8 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Hello Dear,
Good Day to you, I know this mail may come to you as a surprise, since we have not known or written before. I am festus attah, I a= m contacting you on behalf of myself and my younger sister caroline, We are= an orphan.
We lost our mother when I was 2 years and my younger sister Elizabeth was 2 months old. Now we lost our father to the war in Cote D’Ivoire. (My Father Late Mr Lawrence attah) He was a coffee and Cocoa merchant before he died. Please reply to our personal email: [email protected]
We was banished by our late father’s other wife’s grown up children. But God is so kind to wipe my tears, as I just discovered a secretdocument that my late father deposited Money in the Finane and Security company in Benin. Now I am in Benin Republic and have confirmed the deposits.The deposited fund is,US$ 12.5m (Twelve Million Five Hundred Thousand American Dollars).
= All that we want is your sincere and genuine help to move the funds abroad= . We shall discuss your percentage when you reply with your contact details .I will give you more informat as s Iion asoon hear from you. Please reply = to our personal email: [email protected]
Thank= s,
Yours sincerely,
festus and caroline Attah.
Envelope-to:
Delivery-date: Thu, 06 Oct 2011 06:46:18 -0700
Received: from 10ibl21ser04.datacenter.cha.cantv.net ([200.11.173.10])
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <[email protected]>)
id 1RBoHB-0008FK-A4
for ; Thu, 06 Oct 2011 06:46:18 -0700
X-Virus-Scanned: amavisd-new at cantv.net
Received: from webmail-01.datacenter.cha.cantv.net (webmail-01.datacenter.cha.cantv.net [200.11.153.84])
(authenticated bits=0)
by 10ibl21ser04.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP id p96Di2Jq032086;
Thu, 6 Oct 2011 09:14:02 -0430
X-Matched-Lists: []
Received: from 41.216.40.128 ([41.216.40.128]) by webmail-01.datacenter.cha.cantv.net (Cantv Webmail) with HTTP; Thu, 6 Oct 2011 09:14:02 -0430 (VET)
Date: Thu, 6 Oct 2011 09:14:02 -0430 (VET)
From: festus <[email protected]>
Reply-To: [email protected]
To: [email protected]
Message-ID: <726540796.741356.1317908642557.JavaMail.gess@webmail-01.datacenter.cha.cantv.net>
Subject: festus and caroline Attah.
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Mailer: Cantv Webmail
X-Originating-IP: [41.216.40.128]
X-Spam-Subject: ***SPAM*** festus and caroline Attah.
X-Spam-Status: Yes, score=8.1
X-Spam-Score: 81
X-Spam-Bar: ++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello Dear, Good Day to you, I know this mail may come to
you as a surprise, since we have not known or written before. I am festus
attah, I am contacting you on behalf of myself and my younger sister caroline,
We are an orphan. [...]
Content analysis details: (8.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[200.11.173.10 listed in psbl.surriel.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4999]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.4 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 LOTS_OF_MONEY Huge... sums of money
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.8 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Hello Dear,
Good Day to you, I know this mail may come to you as a surprise, since we have not known or written before. I am festus attah, I a= m contacting you on behalf of myself and my younger sister caroline, We are= an orphan.
We lost our mother when I was 2 years and my younger sister Elizabeth was 2 months old. Now we lost our father to the war in Cote D’Ivoire. (My Father Late Mr Lawrence attah) He was a coffee and Cocoa merchant before he died. Please reply to our personal email: [email protected]
We was banished by our late father’s other wife’s grown up children. But God is so kind to wipe my tears, as I just discovered a secretdocument that my late father deposited Money in the Finane and Security company in Benin. Now I am in Benin Republic and have confirmed the deposits.The deposited fund is,US$ 12.5m (Twelve Million Five Hundred Thousand American Dollars).
= All that we want is your sincere and genuine help to move the funds abroad= . We shall discuss your percentage when you reply with your contact details .I will give you more informat as s Iion asoon hear from you. Please reply = to our personal email: [email protected]
Thank= s,
Yours sincerely,
festus and caroline Attah.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces