#391412 by buried under 419s
Fri Jul 12, 2019 9:30 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id SPXXF8ImKF15HwAAjbubUg
for <>; Thu, 11 Jul 2019 23:20:50 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 11 Jul 2019 23:20:50 -0700
Received: from [103.233.0.196] (port=34306 helo=mail.brandker.com)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hlovE-00025S-JS
for ; Thu, 11 Jul 2019 23:20:50 -0700
Received: from User (unknown [199.96.83.18])
by mail.brandker.com (Postfix) with ESMTPA id 9BDB6AC1AD;
Fri, 12 Jul 2019 14:19:48 +0800 (+08)
Reply-To: <[email protected]>
From: "Mr. Graham Williamson"<[email protected]>
Date: Thu, 11 Jul 2019 23:20:01 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=46.5
X-Spam-Score: 465
X-Spam-Bar: ++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: My Dear Friend, It is my humble pleasure to solicit your strictest
confidence in this transaction. My name is: Graham Williamson, the financial
director of RIX Petroleum Scotland Ltd. UK. I am the officer in-charge of
offshore remittances to contractors / beneficiaries. We are seeking your
assistance to transfer the sum of Thirty Seven Million, Three Hundred Thousand
Dollars (US$37,300,000.00) to your account for private investment. [...]
Content analysis details: (46.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.6 URG_BIZ BODY: Contains urgent matter
2.0 MILLION_USD BODY: Talks about millions of dollars
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.233.0.196 listed in bl.score.senderscore.com]
4.0 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=o ... zet.sk;ip=]
1.0 MISSING_HEADERS Missing To: header
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(obeclicince[at]azet.sk)
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.6 MISSING_MID Missing Message-Id: header
1.2 FROM_MISSP_SPF_FAIL No description available.
0.0 FROM_MISSP_USER From misspaced, from "User"
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.1 MALFORMED_FREEMAIL Bad headers on message from free email service
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.5 HK_NAME_FM_MR_MRS No description available.
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.5 KAM_NIGERIAN Nigerian Scam and Variants
2.2 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.5 SPOOFED_FREEMAIL_NO_RDNS From T_SPOOFED_FREEMAIL and no rDNS
2.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
0.5 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
3.1 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.2 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Awaiting your TOP URGENT Response today.
My Dear Friend,
It is my humble pleasure to solicit your strictest confidence in this transaction.
My name is: Graham Williamson, the financial director of RIX Petroleum Scotland Ltd.
UK. I am the officer in-charge of offshore remittances to contractors /
beneficiaries. We are seeking your assistance to transfer the sum of Thirty Seven
Million, Three Hundred Thousand Dollars (US$37,300,000.00) to your account for
private investment.
This amount accrued from an over-invoiced contract amount for the construction of an
Oil Refinery Sub- stations from 2014 to 2017 to expatriate companies.
The contract was originally valued for One Hundred and Twenty Million United States
Dollar US$120,000,000.00) but we over-invoiced the figure to read $157,300,000.00.
Therefore, we have perfected plans to quickly TRANSFER the extra US$37,300,000.00 to
your bank account.
This contract has been completely executed and the original contractors have been
paid all their contract bills less this $37,300,000.00 through our partner banks in
UK, United States and Europe.
We shall forward your personal details to the legal department of the Bank for the
payment process of the balance US$37.3 Million. Be rest assured that all modalities
are set for smooth execution of this viable transaction.
This transaction is 100% risk free, and requires absolute confidentiality. You must
do this transaction alone!
Awaiting your TOP URGENT Response today.
Best regards,
Mr. Graham Williamson
Delivered-To:
Received: from
by with LMTP id SPXXF8ImKF15HwAAjbubUg
for <>; Thu, 11 Jul 2019 23:20:50 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 11 Jul 2019 23:20:50 -0700
Received: from [103.233.0.196] (port=34306 helo=mail.brandker.com)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hlovE-00025S-JS
for ; Thu, 11 Jul 2019 23:20:50 -0700
Received: from User (unknown [199.96.83.18])
by mail.brandker.com (Postfix) with ESMTPA id 9BDB6AC1AD;
Fri, 12 Jul 2019 14:19:48 +0800 (+08)
Reply-To: <[email protected]>
From: "Mr. Graham Williamson"<[email protected]>
Date: Thu, 11 Jul 2019 23:20:01 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=46.5
X-Spam-Score: 465
X-Spam-Bar: ++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: My Dear Friend, It is my humble pleasure to solicit your strictest
confidence in this transaction. My name is: Graham Williamson, the financial
director of RIX Petroleum Scotland Ltd. UK. I am the officer in-charge of
offshore remittances to contractors / beneficiaries. We are seeking your
assistance to transfer the sum of Thirty Seven Million, Three Hundred Thousand
Dollars (US$37,300,000.00) to your account for private investment. [...]
Content analysis details: (46.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.6 URG_BIZ BODY: Contains urgent matter
2.0 MILLION_USD BODY: Talks about millions of dollars
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.233.0.196 listed in bl.score.senderscore.com]
4.0 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=o ... zet.sk;ip=]
1.0 MISSING_HEADERS Missing To: header
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(obeclicince[at]azet.sk)
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.6 MISSING_MID Missing Message-Id: header
1.2 FROM_MISSP_SPF_FAIL No description available.
0.0 FROM_MISSP_USER From misspaced, from "User"
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.1 MALFORMED_FREEMAIL Bad headers on message from free email service
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.5 HK_NAME_FM_MR_MRS No description available.
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.5 KAM_NIGERIAN Nigerian Scam and Variants
2.2 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.5 SPOOFED_FREEMAIL_NO_RDNS From T_SPOOFED_FREEMAIL and no rDNS
2.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
0.5 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
3.1 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.2 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Awaiting your TOP URGENT Response today.
My Dear Friend,
It is my humble pleasure to solicit your strictest confidence in this transaction.
My name is: Graham Williamson, the financial director of RIX Petroleum Scotland Ltd.
UK. I am the officer in-charge of offshore remittances to contractors /
beneficiaries. We are seeking your assistance to transfer the sum of Thirty Seven
Million, Three Hundred Thousand Dollars (US$37,300,000.00) to your account for
private investment.
This amount accrued from an over-invoiced contract amount for the construction of an
Oil Refinery Sub- stations from 2014 to 2017 to expatriate companies.
The contract was originally valued for One Hundred and Twenty Million United States
Dollar US$120,000,000.00) but we over-invoiced the figure to read $157,300,000.00.
Therefore, we have perfected plans to quickly TRANSFER the extra US$37,300,000.00 to
your bank account.
This contract has been completely executed and the original contractors have been
paid all their contract bills less this $37,300,000.00 through our partner banks in
UK, United States and Europe.
We shall forward your personal details to the legal department of the Bank for the
payment process of the balance US$37.3 Million. Be rest assured that all modalities
are set for smooth execution of this viable transaction.
This transaction is 100% risk free, and requires absolute confidentiality. You must
do this transaction alone!
Awaiting your TOP URGENT Response today.
Best regards,
Mr. Graham Williamson
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces