by buried under 419s
Fri Oct 07, 2011 1:42 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Fri, 07 Oct 2011 09:43:51 -0700
Received: from mail.oblpo.ru ([77.106.20.158])
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <[email protected]>)
id 1RCDWX-0006k9-00
for ; Fri, 07 Oct 2011 09:43:51 -0700
Received: from User (unknown [82.128.45.50])
by mail.oblpo.ru (Postfix) with ESMTPA id 5739B25C220;
Fri, 7 Oct 2011 04:04:07 +0400 (MSD)
Reply-To: <[email protected]>
From: "Hello."<[email protected]>
Subject: Read this Mail and Respond quickly .
Date: Wed, 21 Sep 2011 02:18:16 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Subject: ***SPAM*** Read this Mail and Respond quickly .
X-Spam-Status: Yes, score=18.2
X-Spam-Score: 182
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Dear Legal beneficiary, Following the delay by some payment
officials to complete the outstanding payment of several beneficiaries, coupled
with various complaints of extortion, your payment file was handed over to
my office so that your payment will be completed immediately. [...]
Content analysis details: (18.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 T_LOTTO_DEPT BODY: Claims Department
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.6 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[77.106.20.158 listed in bb.barracudacentral.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[77.106.20.158 listed in bl.score.senderscore.com]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[77.106.20.158 listed in psbl.surriel.com]
3.4 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date
3.1 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 T_LOTTO_URI URI: Claims Department
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.2 FSL_UA FSL_UA
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
1.3 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.6 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.9 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.9 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
2.5 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
0.1 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.8 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
-8.2 AWL AWL: From: address is in the auto white-list
X-Spam-Flag: YES
Dear Legal beneficiary,
Following the delay by some payment officials to complete the outstanding payment of several beneficiaries, coupled with various complaints of extortion, your payment file was handed over to my office so that your payment will be completed immediately.
It may interest you to note that this payment panel was inaugurated by the president of Nigeria (Dr. Goodluck Jonathan) who has earmarked a total sum of USD2.7 Billion to cover all such outstanding debts in your category within this last quarter of this fiscal year.
Consequently, you have been strictly advised to discontinue any form of correspondence with your current representatives for they are incompetent of timely conclusion of your immediate payment. You may contact them upon our conclusion and compensate them accordingly, if so ever desire. You will be paid within 5days from today.
Kindly call me immediately on my direct mobile line ( + 234- 816-277- 9029 ) so that I will advise you on your prompt payment without further delay.
Be advised to comply accordingly.
Yours Sincerely,
Mr. Edward E. Ekong.
E-mail: [email protected]
Director International Foreign Payment Department (CBN).
Envelope-to:
Delivery-date: Fri, 07 Oct 2011 09:43:51 -0700
Received: from mail.oblpo.ru ([77.106.20.158])
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <[email protected]>)
id 1RCDWX-0006k9-00
for ; Fri, 07 Oct 2011 09:43:51 -0700
Received: from User (unknown [82.128.45.50])
by mail.oblpo.ru (Postfix) with ESMTPA id 5739B25C220;
Fri, 7 Oct 2011 04:04:07 +0400 (MSD)
Reply-To: <[email protected]>
From: "Hello."<[email protected]>
Subject: Read this Mail and Respond quickly .
Date: Wed, 21 Sep 2011 02:18:16 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Subject: ***SPAM*** Read this Mail and Respond quickly .
X-Spam-Status: Yes, score=18.2
X-Spam-Score: 182
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Dear Legal beneficiary, Following the delay by some payment
officials to complete the outstanding payment of several beneficiaries, coupled
with various complaints of extortion, your payment file was handed over to
my office so that your payment will be completed immediately. [...]
Content analysis details: (18.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 T_LOTTO_DEPT BODY: Claims Department
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.6 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[77.106.20.158 listed in bb.barracudacentral.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[77.106.20.158 listed in bl.score.senderscore.com]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[77.106.20.158 listed in psbl.surriel.com]
3.4 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date
3.1 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 T_LOTTO_URI URI: Claims Department
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.2 FSL_UA FSL_UA
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
1.3 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.6 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.9 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.9 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
2.5 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
0.1 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.8 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
-8.2 AWL AWL: From: address is in the auto white-list
X-Spam-Flag: YES
Dear Legal beneficiary,
Following the delay by some payment officials to complete the outstanding payment of several beneficiaries, coupled with various complaints of extortion, your payment file was handed over to my office so that your payment will be completed immediately.
It may interest you to note that this payment panel was inaugurated by the president of Nigeria (Dr. Goodluck Jonathan) who has earmarked a total sum of USD2.7 Billion to cover all such outstanding debts in your category within this last quarter of this fiscal year.
Consequently, you have been strictly advised to discontinue any form of correspondence with your current representatives for they are incompetent of timely conclusion of your immediate payment. You may contact them upon our conclusion and compensate them accordingly, if so ever desire. You will be paid within 5days from today.
Kindly call me immediately on my direct mobile line ( + 234- 816-277- 9029 ) so that I will advise you on your prompt payment without further delay.
Be advised to comply accordingly.
Yours Sincerely,
Mr. Edward E. Ekong.
E-mail: [email protected]
Director International Foreign Payment Department (CBN).
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces