by buried under 419s
Wed Jun 04, 2014 4:25 am
Return-path: <>
Envelope-to:
Delivery-date: Tue, 03 Jun 2014 23:40:44 -0700
Received: from mail-yh0-f68.google.com ([209.85.213.68]:55356)
by s with esmtps (TLSv1:RC4-SHA:128)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1Ws4rz-0000hr-Fu
for ; Tue, 03 Jun 2014 23:40:44 -0700
Received: by mail-yh0-f68.google.com with SMTP id z6so1802978yhz.3
for <m>; Tue, 03 Jun 2014 23:40:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:reply-to:date:message-id:subject:from:to:content-type;
bh=bv12tLl8aRdId6gShqb16R8xfQLQNiMv/+SxOKsYXuI=;
b=T3Xk+Fk0c9iYMtoxi/MA7Q5RI5Kw87inkJlpVzu+2luyICeDNKRq/Gl2olwDt06nSx
I7GrbDxkAFha5v7kKy1gAj5hpbz4IWPwMtIFyzUI6WFm6ckC4k97bZTXodDqC+ijzYMo
CgMLhEWBp2OOKbiHThSkiUYjXmqTThqRougW8heZg8JB7Hxd+m1zXY2w2iyNY2hXGRRX
Nup9dVzAxzRGpUgpRSB1aLS2P0hmm/hYlILwvdw+3yn2Pou+afwWy/UN6Iwk6lnJUhNy
9RrLF6JaDHeH8IL9joAtX2WKxGoLbzwOO+RVo1Hb139/Xlii8qvrjIHQMCoG43qz3lW0
Do2A==
MIME-Version: 1.0
X-Received: by 10.236.71.100 with SMTP id q64mr21361280yhd.133.1401864018390;
Tue, 03 Jun 2014 23:40:18 -0700 (PDT)
Received: by 10.170.68.196 with HTTP; Tue, 3 Jun 2014 23:40:18 -0700 (PDT)
Reply-To: [email protected]
Date: Wed, 4 Jun 2014 07:40:18 +0100
Message-ID: <CAATamq1o_uW5BUeU_DmzBGd6YDzzcFncrOJ48f8ztpLASuPO6g@mail.gmail.com>
Subject: Confidential, Read And Get Back To Me Immediately, Good Luck.
From: "Barr, Richard Johnson," <[email protected]>
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc:
X-Spam-Status: No, score=6.9
X-Spam-Score: 69
X-Spam-Bar: ++++++
X-Ham-Report: Spam detection software, running on the system ", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Attn; Beneficiary, Your contract payment has been approved
and ready for payment to you via these three options written below, so I
implore you to chose any one of these options and get back to me immediately.
[...]
Content analysis details: (6.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(richardjohnson10021[at]gmail.com)
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
trust
[209.85.213.68 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (richardjohnson10021[at]gmail.com)
2.9 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.3 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: NO
Attn; Beneficiary,
Your contract payment has been approved and ready for payment to you
via these three options written below, so I implore you to chose any
one of these options and get back to me immediately.
These are the three options,
(1) Through Bank to Bank transfer,
(2) Delivering your consignment through diplomatic cash delivery,
(3) Through ATM Card.
And you can also come down to sign and receive the fund in person.
Please re-confirm the following.
Your full names, ---------
Your surface address, ---------
Your direct phone number, ---------
Also scan your international passport. -------
Sex, --------
Note: I could see the amount you are being owned. This is why I
decided to get involved.
Contact me immediately.
Barr, Richard Johnson,
Envelope-to:
Delivery-date: Tue, 03 Jun 2014 23:40:44 -0700
Received: from mail-yh0-f68.google.com ([209.85.213.68]:55356)
by s with esmtps (TLSv1:RC4-SHA:128)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1Ws4rz-0000hr-Fu
for ; Tue, 03 Jun 2014 23:40:44 -0700
Received: by mail-yh0-f68.google.com with SMTP id z6so1802978yhz.3
for <m>; Tue, 03 Jun 2014 23:40:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:reply-to:date:message-id:subject:from:to:content-type;
bh=bv12tLl8aRdId6gShqb16R8xfQLQNiMv/+SxOKsYXuI=;
b=T3Xk+Fk0c9iYMtoxi/MA7Q5RI5Kw87inkJlpVzu+2luyICeDNKRq/Gl2olwDt06nSx
I7GrbDxkAFha5v7kKy1gAj5hpbz4IWPwMtIFyzUI6WFm6ckC4k97bZTXodDqC+ijzYMo
CgMLhEWBp2OOKbiHThSkiUYjXmqTThqRougW8heZg8JB7Hxd+m1zXY2w2iyNY2hXGRRX
Nup9dVzAxzRGpUgpRSB1aLS2P0hmm/hYlILwvdw+3yn2Pou+afwWy/UN6Iwk6lnJUhNy
9RrLF6JaDHeH8IL9joAtX2WKxGoLbzwOO+RVo1Hb139/Xlii8qvrjIHQMCoG43qz3lW0
Do2A==
MIME-Version: 1.0
X-Received: by 10.236.71.100 with SMTP id q64mr21361280yhd.133.1401864018390;
Tue, 03 Jun 2014 23:40:18 -0700 (PDT)
Received: by 10.170.68.196 with HTTP; Tue, 3 Jun 2014 23:40:18 -0700 (PDT)
Reply-To: [email protected]
Date: Wed, 4 Jun 2014 07:40:18 +0100
Message-ID: <CAATamq1o_uW5BUeU_DmzBGd6YDzzcFncrOJ48f8ztpLASuPO6g@mail.gmail.com>
Subject: Confidential, Read And Get Back To Me Immediately, Good Luck.
From: "Barr, Richard Johnson," <[email protected]>
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc:
X-Spam-Status: No, score=6.9
X-Spam-Score: 69
X-Spam-Bar: ++++++
X-Ham-Report: Spam detection software, running on the system ", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Attn; Beneficiary, Your contract payment has been approved
and ready for payment to you via these three options written below, so I
implore you to chose any one of these options and get back to me immediately.
[...]
Content analysis details: (6.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(richardjohnson10021[at]gmail.com)
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
trust
[209.85.213.68 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (richardjohnson10021[at]gmail.com)
2.9 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.3 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: NO
Attn; Beneficiary,
Your contract payment has been approved and ready for payment to you
via these three options written below, so I implore you to chose any
one of these options and get back to me immediately.
These are the three options,
(1) Through Bank to Bank transfer,
(2) Delivering your consignment through diplomatic cash delivery,
(3) Through ATM Card.
And you can also come down to sign and receive the fund in person.
Please re-confirm the following.
Your full names, ---------
Your surface address, ---------
Your direct phone number, ---------
Also scan your international passport. -------
Sex, --------
Note: I could see the amount you are being owned. This is why I
decided to get involved.
Contact me immediately.
Barr, Richard Johnson,
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces