by buried under 419s
Tue Aug 06, 2013 8:34 pm
Return-Path: <[email protected]>
Received: from visp-mail1.isdsl.net (visp-mail1.isdsl.net [196.26.208.216])
(8.14.4/8.14.4) with ESMTP id r76NbTYM028900
(envelope-from [email protected])
Received: from [41.138.89.38] (port=18515 helo=User)
by visp-mail1.isdsl.net with esmtpa (Exim 4.76 (FreeBSD))
(envelope-from <[email protected]>)
id 1V6qnu-000C6u-Rn; Wed, 07 Aug 2013 01:36:43 +0200
Reply-To: <[email protected]>
From: "Western Union"<[email protected]>
Subject: HI
Date: Wed, 7 Aug 2013 00:37:09 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 130806-1, 08/06/2013), Outbound message
X-Antivirus-Status: Clean
Message-Id: <[email protected]>
X-SA-Score: 47.7
X-SA-Report: Spam detection software, running on the system "visp-mail1.isdsl.net", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
The administrator of that system for details.
Content preview: This is to inform you that the federal ministry of finance
Benin Republic has started releasing scam victim compensation fund & Flood
disasters, Earthquake mandated by United Nation Organization through our
office. [...]
Content analysis details: (47.7 points, 10.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP
1.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
2.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(officeo29[at]yahoo.com.ph)
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (officeo29[at]yahoo.com.ph)
1.2 MISSING_HEADERS Missing To: header
0.9 URG_BIZ BODY: Contains urgent matter
0.9 HK_SCAM_N8 BODY: HK_SCAM_N8
0.0 LOTS_OF_MONEY Huge... sums of money
1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
2.8 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.6 FSL_NEW_HELO_USER FSL_NEW_HELO_USER
3.8 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2
3.4 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
2.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to
3.8 MONEY_FROM_MISSP Lots of money and misspaced From
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.4 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
2.0 FROM_MISSPACED From: missing whitespace
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
1.4 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.6 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
4.3 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.8 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.6 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.7 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
1.6 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-SA-Status: Yes
To: undisclosed-recipients:;
X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.2.7
This is to inform you that the federal ministry of finance Benin Republic has started releasing scam victim compensation fund & Flood disasters, Earthquake mandated by United Nation Organization through our office.
I am contacting you because our agent have sent you the first payment of $5,000 for your compensation funds total amount of $500 000 USD(Five hundred thousand united state dollar)
We need your urgent response so that we shall release your payment information to you.
Our pleasure to be of your service.
Sincerely,
Dr. otto anna
Director Western Union Money
Benin Republic
Phone: +229 99388639
Received: from visp-mail1.isdsl.net (visp-mail1.isdsl.net [196.26.208.216])
(8.14.4/8.14.4) with ESMTP id r76NbTYM028900
(envelope-from [email protected])
Received: from [41.138.89.38] (port=18515 helo=User)
by visp-mail1.isdsl.net with esmtpa (Exim 4.76 (FreeBSD))
(envelope-from <[email protected]>)
id 1V6qnu-000C6u-Rn; Wed, 07 Aug 2013 01:36:43 +0200
Reply-To: <[email protected]>
From: "Western Union"<[email protected]>
Subject: HI
Date: Wed, 7 Aug 2013 00:37:09 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 130806-1, 08/06/2013), Outbound message
X-Antivirus-Status: Clean
Message-Id: <[email protected]>
X-SA-Score: 47.7
X-SA-Report: Spam detection software, running on the system "visp-mail1.isdsl.net", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
The administrator of that system for details.
Content preview: This is to inform you that the federal ministry of finance
Benin Republic has started releasing scam victim compensation fund & Flood
disasters, Earthquake mandated by United Nation Organization through our
office. [...]
Content analysis details: (47.7 points, 10.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP
1.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
2.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(officeo29[at]yahoo.com.ph)
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (officeo29[at]yahoo.com.ph)
1.2 MISSING_HEADERS Missing To: header
0.9 URG_BIZ BODY: Contains urgent matter
0.9 HK_SCAM_N8 BODY: HK_SCAM_N8
0.0 LOTS_OF_MONEY Huge... sums of money
1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
2.8 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.6 FSL_NEW_HELO_USER FSL_NEW_HELO_USER
3.8 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2
3.4 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
2.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to
3.8 MONEY_FROM_MISSP Lots of money and misspaced From
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.4 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
2.0 FROM_MISSPACED From: missing whitespace
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
1.4 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.6 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
4.3 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.8 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.6 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.7 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
1.6 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-SA-Status: Yes
To: undisclosed-recipients:;
X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.2.7
This is to inform you that the federal ministry of finance Benin Republic has started releasing scam victim compensation fund & Flood disasters, Earthquake mandated by United Nation Organization through our office.
I am contacting you because our agent have sent you the first payment of $5,000 for your compensation funds total amount of $500 000 USD(Five hundred thousand united state dollar)
We need your urgent response so that we shall release your payment information to you.
Our pleasure to be of your service.
Sincerely,
Dr. otto anna
Director Western Union Money
Benin Republic
Phone: +229 99388639
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces