Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#386243 by buried under 419s Mon May 20, 2019 9:36 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id WMySAiWo4lzwZAAAjbubUg
for <>; Mon, 20 May 2019 06:14:13 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 20 May 2019 06:14:13 -0700
Received: from [124.217.227.71] (port=37584 helo=server9212.pnbdevt.com)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hSi7C-0006hx-Mh
for ; Mon, 20 May 2019 06:14:12 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=pnbdevt.com
; s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Date:
Subject:From:Reply-To; bh=623F0ytRGMw7mKqUnDRrbyrwG5teGJCmFgj8iqAz3gU=; b=SMi
bSj/OfUKS5QhyRkXbnqzLnWET1O5cjRmixZYB+OWPNjfx56DywM9JaW0WMBmOCTIXn7ko27H3ZWAy
nb2hf4tWy7g1mzvu3QMVz1Et5hHT6L0X0xXLnbI9IOGYrz5G2oZ7oczSGILxeR+/7LepE+qQ4ODnJ
ItdR+18B9jlXIVaDgPWj+4lvKxHtLAUYgT9Dr3CmkMtc+TzatZbZkNz5TSXVeSeuXPWd1y4K7wZkD
DBQe7sGeLosbIxjPZtxoM30iBfHfS2uFn8J2U2RLFrXtazsOcDVtR1mDXN495tN2YErup9L3GlAZB
UUv0zwX/ZEaw/ete3sBCPtjOfFjHPOQ==;
Received: from [105.112.29.93] (port=35558 helo=User)
by server9212.pnbdevt.com with esmtpa (Exim 4.86_1)
(envelope-from <[email protected]>)
id 1hSi6L-0000Zy-R8; Mon, 20 May 2019 21:13:14 +0800
Reply-To: <[email protected]>
From: "Mr. Romo Steven"<[email protected]>
Date: Mon, 20 May 2019 14:13:19 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server9212.pnbdevt.com
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - pnbdevt.com
X-Get-Message-Sender-Via: server9212.pnbdevt.com: authenticated_id: [email protected]
X-Authenticated-Sender: server9212.pnbdevt.com: [email protected]
X-Spam-Status: Yes, score=22.9
X-Spam-Score: 229
X-Spam-Bar: ++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: Dear Sir/Madam Your claim funds sum amount $8 Million United
state dollars has been approved to be delivered to you through diplomatic
immunity payment with the help of the diplomat Mr Joseph Steven Romo currently
in Phoenix Arizona USA. [...]

Content analysis details: (22.9 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
1.1 MILLION_USD BODY: Talks about millions of dollars
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.2 NSL_RCVD_HELO_USER Received from HELO User
1.0 MISSING_HEADERS Missing To: header
0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(romosteven627[at]aol.com)
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 T_HK_NAME_MR_MRS No description available.
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.6 MISSING_MID Missing Message-Id: header
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.9 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Your Funds luggage Delivery


Dear Sir/Madam

Your claim funds sum amount $8 Million United state dollars has been approved to be
delivered to you through diplomatic immunity payment with the help of the diplomat
Mr Joseph Steven Romo currently in Phoenix Arizona USA.

Name : Mr Joseph Steven Romo
Cell: +1-602-598-2449
Email: [email protected]

Get in-touch with him via email and sms text message and get back to me asap.

Mr Sola Adepetun
Chairman, Board of Directors
Standard Chartered Bank Nigeria
https://www.sc.com/ng/

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
Advertisement

Who is online

Users browsing this forum: No registered users and 96 guests