by buried under 419s
Thu Sep 26, 2013 10:37 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 26 Sep 2013 19:06:34 -0700
Received: from [216.246.52.35] (port=37961 helo=server.offshoreinvestment.com.biz)
by
with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1VPNRv-0003u1-2T
for ; Thu, 26 Sep 2013 19:06:34 -0700
Received: from ti-227-39-234.telkomadsl.co.za ([105.227.39.234]:4314 helo=[10.0.0.3])
by server.offshoreinvestment.com.biz with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80.1)
(envelope-from <[email protected]>)
id 1VPNPw-0004Ap-4f; Fri, 27 Sep 2013 06:04:28 +0400
Content-Type: multipart/alternative; boundary="===============1219804235=="
MIME-Version: 1.0
To: Recipients <[email protected]>
From: [email protected]
Date: Fri, 27 Sep 2013 04:03:54 +0200
Reply-To: [email protected]
Return-receipt-to: [email protected]
Disposition-notification-to: [email protected]
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.offshoreinvestment.com.biz
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - gmail.com
X-Get-Message-Sender-Via: server.offshoreinvestment.com.biz: authenticated_id: hondalin/only user confirmed/virtual account not confirmed
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam-Status: Yes, score=17.2
X-Spam-Score: 172
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: My partner in advance, I am Dr. Modise Thomas, financial manager
working with Absa Bank, Republic of South Africa. I am contacting you with
regards the estate of Mr. Martin Hart , who is a resident in Republic of
South Africa and has an investment placed in our bank 5 years ago. It is important
you keep the contents of this email confidential and respect the integrity
of the information you come by, I am contacting you independently. I need
your help to transfer the sum of 18.35 million for investment in your country.
Do contact me via this email address: { [email protected] } . I await
your response Dr.Modise Thomas My partner in advance, I am Dr. Modise Thomas,
financial manager working with Absa Bank, Republic of South Africa. I am
contacting you with regards the estate of Mr. Martin Hart , who is a resident
in Republic of South Africa and has an investment placed in our bank 5 years
ago. It is important you keep the contents of this email confidential and
respect the integrity of the information you come by, I am contacting you
independently. I need your help to transfer the sum of 18.35 million for
investment in your country. Do contact me via this email address: { [email protected]
} . I await your response Dr.Modise Thomas [...]
Content analysis details: (17.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(drmodisethomas101[at]gmail.com)
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[216.246.52.35 listed in bb.barracudacentral.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[216.246.52.35 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?216.246.52.35>]
0.7 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (drmodisethomas101[at]gmail.com)
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5144]
0.5 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.4 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
3.8 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** From Dr. Modise Thomas (Update 26th Sept 2013)
You will not see this in a MIME-aware mail reader.
--===============1219804235==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
My partner in advance, I am Dr. Modise Thomas, financial manager working with Absa Bank, Republic of South Africa. I am contacting you with regards the estate of Mr. Martin Hart , who is a resident in Republic of South Africa and has an investment placed in our bank 5 years ago. It is important you keep the contents of this email confidential and respect the integrity of the information you come by, I am contacting you independently. I need your help to transfer the sum of 18.35 million for investment in your country. Do contact me via this email address: { [email protected] } . I await your response Dr.Modise Thomas
Envelope-to:
Delivery-date: Thu, 26 Sep 2013 19:06:34 -0700
Received: from [216.246.52.35] (port=37961 helo=server.offshoreinvestment.com.biz)
by
with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1VPNRv-0003u1-2T
for ; Thu, 26 Sep 2013 19:06:34 -0700
Received: from ti-227-39-234.telkomadsl.co.za ([105.227.39.234]:4314 helo=[10.0.0.3])
by server.offshoreinvestment.com.biz with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80.1)
(envelope-from <[email protected]>)
id 1VPNPw-0004Ap-4f; Fri, 27 Sep 2013 06:04:28 +0400
Content-Type: multipart/alternative; boundary="===============1219804235=="
MIME-Version: 1.0
To: Recipients <[email protected]>
From: [email protected]
Date: Fri, 27 Sep 2013 04:03:54 +0200
Reply-To: [email protected]
Return-receipt-to: [email protected]
Disposition-notification-to: [email protected]
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.offshoreinvestment.com.biz
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - gmail.com
X-Get-Message-Sender-Via: server.offshoreinvestment.com.biz: authenticated_id: hondalin/only user confirmed/virtual account not confirmed
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam-Status: Yes, score=17.2
X-Spam-Score: 172
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: My partner in advance, I am Dr. Modise Thomas, financial manager
working with Absa Bank, Republic of South Africa. I am contacting you with
regards the estate of Mr. Martin Hart , who is a resident in Republic of
South Africa and has an investment placed in our bank 5 years ago. It is important
you keep the contents of this email confidential and respect the integrity
of the information you come by, I am contacting you independently. I need
your help to transfer the sum of 18.35 million for investment in your country.
Do contact me via this email address: { [email protected] } . I await
your response Dr.Modise Thomas My partner in advance, I am Dr. Modise Thomas,
financial manager working with Absa Bank, Republic of South Africa. I am
contacting you with regards the estate of Mr. Martin Hart , who is a resident
in Republic of South Africa and has an investment placed in our bank 5 years
ago. It is important you keep the contents of this email confidential and
respect the integrity of the information you come by, I am contacting you
independently. I need your help to transfer the sum of 18.35 million for
investment in your country. Do contact me via this email address: { [email protected]
} . I await your response Dr.Modise Thomas [...]
Content analysis details: (17.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(drmodisethomas101[at]gmail.com)
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[216.246.52.35 listed in bb.barracudacentral.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[216.246.52.35 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?216.246.52.35>]
0.7 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (drmodisethomas101[at]gmail.com)
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5144]
0.5 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.4 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
3.8 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** From Dr. Modise Thomas (Update 26th Sept 2013)
You will not see this in a MIME-aware mail reader.
--===============1219804235==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
My partner in advance, I am Dr. Modise Thomas, financial manager working with Absa Bank, Republic of South Africa. I am contacting you with regards the estate of Mr. Martin Hart , who is a resident in Republic of South Africa and has an investment placed in our bank 5 years ago. It is important you keep the contents of this email confidential and respect the integrity of the information you come by, I am contacting you independently. I need your help to transfer the sum of 18.35 million for investment in your country. Do contact me via this email address: { [email protected] } . I await your response Dr.Modise Thomas
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces