by buried under 419s
Mon Dec 05, 2011 5:11 am
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 05 Dec 2011 00:57:09 -0800
Received: from alpes.grupoperola.com.br ([200.249.138.130])
by with esmtp (Exim 4.69)
(envelope-from <[email protected]>)
id 1RXUMF-0006Zn-Sj
for ; Mon, 05 Dec 2011 00:57:09 -0800
Received: by alpes.grupoperola.com.br (Postfix, from userid 113)
id EBF8BDE84; Mon, 5 Dec 2011 04:15:57 -0300 (BRT)
Received: from localhost by debian
with SpamAssassin (version 3.2.5);
Mon, 05 Dec 2011 04:15:57 -0300
From: "Mr.Ho Chi Wai Louis"<[email protected]>
To: W@debian, H@debian, B@debian
Subject: Business Deal ------ Reply !!!!
Date: Mon, 5 Dec 2011 02:18:52 -0500
Message-Id: <[email protected]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on debian
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3,
ALL_TRUSTED,BAYES_50,FORGED_MUA_OUTLOOK,MSOE_MID_WRONG_CASE,TO_MALFORMED,
URG_BIZ autolearn=no version=3.2.5
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4EDC6FAD.DAE950D6"
X-Spam-Subject: ***SPAM*** Business Deal ------ Reply !!!!
X-Spam-Status: Yes, score=17.2
X-Spam-Score: 172
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Spam detection software, running on the system "debian", has
identified this incoming email as possible spam. The original message has
been attached to this so you can view it (if it isn't spam) or label similar
future email. If you have any questions, see the administrator of that system
for details. [...]
Content analysis details: (17.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.1 HK_SCAM_N2 BODY: HK_SCAM_N2
0.6 URG_BIZ BODY: Contains urgent matter
2.1 TO_MALFORMED To: has a malformed address
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(chlw12hk[at]yahoo.com.hk)
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[200.249.138.130 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?200.249.138.130>]
0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[200.249.138.130 listed in dnsbl.sorbs.net]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[200.249.138.130 listed in bb.barracudacentral.org]
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4674]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_FM_MR_MRS T_HK_NAME_FM_MR_MRS
1.9 FREEMAIL_REPLY From and body contain different freemails
0.0 TO_NO_BRKTS_PCNT To: misformatted + percentage
0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
0.1 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)
0.8 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
0.0 T_TO_NO_BRKTS_FREEMAIL To: misformatted and free email service
0.4 MONEY_FRAUD_5 Lots of money and many fraud phrases
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
This is a multi-part message in MIME format.
------------=_4EDC6FAD.DAE950D6
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Spam detection software, running on the system "debian", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Good-Day Friend, I am Mr. Ho Chi Wai Louis working with=
one
of the prime bank here in Honk Kong, I seek your consent to present yo=
u as
the next of kin to our bank deceased customer in order to repatriate t=
he
sum of ($18.5M USD) out of my Bank here in Hong Kong. [...]=20
Content analysis details: (7.6 points, 5.0 required)
pts rule name description
---- ---------------------- ---------------------------------------------=
-----
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
1.2 TO_MALFORMED To: has a malformed address
1.6 URG_BIZ BODY: Contains urgent matter
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5000]
0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419=
)
1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419=
)
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Good-Day Friend,
I am Mr. Ho Chi Wai Louis working with one of the prime bank here in Honk Kong, I seek your consent to present you as the next of kin to our bank deceased customer in order to repatriate the sum of ($18.5M USD) out of my Bank here in Hong Kong.
(1) Can you handle this project?
(2) Can I give you this trust?
(3) What will be your commission?
I expect your urgent response only if you can handle this project. If interested reply to my personal email on [email protected] for more details.
Sincerely,
Mr. Ho chi Wai Louis
[email protected]
------------=_4EDC6FAD.DAE950D6--
Envelope-to:
Delivery-date: Mon, 05 Dec 2011 00:57:09 -0800
Received: from alpes.grupoperola.com.br ([200.249.138.130])
by with esmtp (Exim 4.69)
(envelope-from <[email protected]>)
id 1RXUMF-0006Zn-Sj
for ; Mon, 05 Dec 2011 00:57:09 -0800
Received: by alpes.grupoperola.com.br (Postfix, from userid 113)
id EBF8BDE84; Mon, 5 Dec 2011 04:15:57 -0300 (BRT)
Received: from localhost by debian
with SpamAssassin (version 3.2.5);
Mon, 05 Dec 2011 04:15:57 -0300
From: "Mr.Ho Chi Wai Louis"<[email protected]>
To: W@debian, H@debian, B@debian
Subject: Business Deal ------ Reply !!!!
Date: Mon, 5 Dec 2011 02:18:52 -0500
Message-Id: <[email protected]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on debian
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.6 required=5.0 tests=ADVANCE_FEE_2,ADVANCE_FEE_3,
ALL_TRUSTED,BAYES_50,FORGED_MUA_OUTLOOK,MSOE_MID_WRONG_CASE,TO_MALFORMED,
URG_BIZ autolearn=no version=3.2.5
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4EDC6FAD.DAE950D6"
X-Spam-Subject: ***SPAM*** Business Deal ------ Reply !!!!
X-Spam-Status: Yes, score=17.2
X-Spam-Score: 172
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Spam detection software, running on the system "debian", has
identified this incoming email as possible spam. The original message has
been attached to this so you can view it (if it isn't spam) or label similar
future email. If you have any questions, see the administrator of that system
for details. [...]
Content analysis details: (17.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.1 HK_SCAM_N2 BODY: HK_SCAM_N2
0.6 URG_BIZ BODY: Contains urgent matter
2.1 TO_MALFORMED To: has a malformed address
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(chlw12hk[at]yahoo.com.hk)
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[200.249.138.130 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?200.249.138.130>]
0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[200.249.138.130 listed in dnsbl.sorbs.net]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[200.249.138.130 listed in bb.barracudacentral.org]
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4674]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_FM_MR_MRS T_HK_NAME_FM_MR_MRS
1.9 FREEMAIL_REPLY From and body contain different freemails
0.0 TO_NO_BRKTS_PCNT To: misformatted + percentage
0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
0.1 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)
0.8 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
0.0 T_TO_NO_BRKTS_FREEMAIL To: misformatted and free email service
0.4 MONEY_FRAUD_5 Lots of money and many fraud phrases
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
This is a multi-part message in MIME format.
------------=_4EDC6FAD.DAE950D6
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Spam detection software, running on the system "debian", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Good-Day Friend, I am Mr. Ho Chi Wai Louis working with=
one
of the prime bank here in Honk Kong, I seek your consent to present yo=
u as
the next of kin to our bank deceased customer in order to repatriate t=
he
sum of ($18.5M USD) out of my Bank here in Hong Kong. [...]=20
Content analysis details: (7.6 points, 5.0 required)
pts rule name description
---- ---------------------- ---------------------------------------------=
-----
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
1.2 TO_MALFORMED To: has a malformed address
1.6 URG_BIZ BODY: Contains urgent matter
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5000]
0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419=
)
1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419=
)
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Good-Day Friend,
I am Mr. Ho Chi Wai Louis working with one of the prime bank here in Honk Kong, I seek your consent to present you as the next of kin to our bank deceased customer in order to repatriate the sum of ($18.5M USD) out of my Bank here in Hong Kong.
(1) Can you handle this project?
(2) Can I give you this trust?
(3) What will be your commission?
I expect your urgent response only if you can handle this project. If interested reply to my personal email on [email protected] for more details.
Sincerely,
Mr. Ho chi Wai Louis
[email protected]
------------=_4EDC6FAD.DAE950D6--
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces