Envelope-to: info@behniwalgroup.com
Delivery-date: Wed, 23 Jul 2025 03:57:05 -0600
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
To: info@behniwalgroup.com
From: "Themba Mthembu" <mtheembbuub230@gmail.com>
Date: Wed, 23 Jul 2025 03:39:27 +0700
Reply-To: mthemb230@gmail.com
Message-ID: <0.0.11.549.1DBFB858E4D866C.0@service.nbqtp.cn>
    
 Content analysis details:   (38.7 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: nbqtp.cn]
  1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
                             bl.spamcop.net
               [Blocked - see <https://www.spamcop.net/bl.shtml?107.173.80.36>]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
                             The query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [107.173.80.36 listed in sa-accredit.habeas.com]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [107.173.80.36 listed in bl.score.senderscore.com]
  1.9 URIBL_ABUSE_SURBL      Contains an URL listed in the ABUSE SURBL
                             blocklist
                             [URIs: nbqtp.cn]
  1.5 SPF_SOFTFAIL           SPF: sender does not match SPF record (softfail)
  0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                              CUSTOM_MED
  0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
                             digit
                             [mthemb230[at]gmail.com]
  0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
                             in digit
                             [mtheembbuub230[at]gmail.com]
  0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail
                             provider
                             [mtheembbuub230[at]gmail.com]
  1.0 FORGED_GMAIL_RCVD      'From' gmail.com does not match 'Received'
                             headers
  1.1 DATE_IN_PAST_06_12     Date: is 6 to 12 hours before Received: date
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  0.2 KAM_DMARC_NONE         DKIM has Failed or SPF has failed on the message
                             and the domain has no DMARC policy
  0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
  2.0 RDNS_NONE              Delivered to internal network by a host with no rDNS
  0.0 LOTS_OF_MONEY          Huge... sums of money
   10 KAM_BENEFICIARY        Beneficiary scams
  2.5 KAM_NIGERIAN           Nigerian Scam and Variants
  6.0 KAM_INVEST             Investment Scams
  0.7 MONEY_NOHTML           Lots of money in plain text
  1.0 FREEMAIL_REPLYTO       Reply-To/From or Reply-To/body contain
                             different freemails
  0.0 MONEY_FREEMAIL_REPTO   Lots of money from someone using free
                             email?
  0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
  0.0 T_MONEY_PERCENT        X% of a lot of money for you
  1.2 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing
                             list
  0.0 SPOOFED_FREEMAIL       No description available.
  1.5 SPOOF_GMAIL_MID        From Gmail but it doesn't seem to be...
  2.5 SPOOFED_FREEM_REPTO    Forged freemail sender with freemail
                             reply-to
  0.0 MONEY_FRAUD_8          Lots of money and very many fraud phrases
  3.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject:    Good Day

Greetings,

I am contacting you after making official enquiries at the foreign trade of=
fice of the Chambers of Commerce here in Johannesburg, South Africa. I have=
n t disclosed the nature of my intention to anyone due to the sensitive and=
 confidential nature of the project involved which is my need for assistanc=
e in profiling some investment funds and transfer of said funds to your cou=
ntry.

I must plead for your confidence and confidentiality and if it so happens t=
hat you are unable to assist in this project, I would crave your indulgence=
 and ask that you do not divulge this to any other third party and ignore t=
his email. I am constrained to issue more details about this mutually benef=
icial financial project until I get your positive response by email.

The fund in question $47,000,000.00 (Forty-Seven Million USD) accrued from =
an over-inflated contract executed by foreign contractors through our conne=
ctions and the over-invoiced amount is waiting to be remitted from a commer=
cial bank here in South Africa. By virtue of my position as a senior civil =
servant I cannot acquire this money in my name due to the fact that I am bo=
und by the Civil Service Code of Ethics which bars me from operating bank a=
ccounts outside of our shores. On the other hand, it is not safe to keep th=
e funds here due to security reasons; hence my need to source for an overse=
as silent partner to facilitate the transfer of these funds for our mutual =
benefit.

My proposal is that after you receive the funds, it would be shared as foll=
ows: 30% to you as commission for your co-operation and assistance in facil=
itating the transfer, while the remaining 70% belongs to me. You will be fr=
ee to take out your commission immediately after the money is credited to y=
our account in your country. Since our objective is to invest the money in =
a foreign country, it would be appreciated if you could also help us with a=
dvice and direction on investing into profitable ventures in your country.

What we need to do is give you an approval from the ministry and you will e=
mail the approval to the paying bank to facilitate the processing and trans=
fer of the contract funds into any of your nominated bank accounts. If you =
are interested and capable, I request you forward your personal details to =
enable me to contact you for further discussion. I would also request that =
you send me your most confidential phone number for further communication t=
oo.

Respectfully,

Mr. Themba Mthembu

Director, Project Implementation and Audit Committee