#331929 by buried under 419s
Sat Jun 24, 2017 7:13 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 24 Jun 2017 16:03:53 -0700
Received: from [31.148.3.41] (port=55189 helo=ca.orsodin.ru)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1dOu5h-0002u0-Kp
for ; Sat, 24 Jun 2017 16:03:53 -0700
Received: from User (unknown [88.99.254.159])
by ca.orsodin.ru (Postfix) with ESMTPA id 3EB5911B963;
Thu, 15 Jun 2017 14:16:49 +0300 (MSK)
Reply-To: <[email protected]>
From: "Aleem Gillani"<[email protected]>
Date: Thu, 15 Jun 2017 04:16:58 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=26.4
X-Spam-Score: 264
X-Spam-Bar: ++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: SUN TRUST BANK Internal Affairs Department New York NOTIFICATION
OF CREDIT FROM SUN TRUST BANK. [...]
Content analysis details: (26.4 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[31.148.3.41 listed in dnsbl.sorbs.net]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?31.148.3.41>]
3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[31.148.3.41 listed in zen.spamhaus.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(james[at]gmail.com)
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
1.0 MISSING_HEADERS Missing To: header
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.6 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.6 REPLYTO_WITHOUT_TO_CC No description available.
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** NOTIFICATION OF CREDIT FROM SUN TRUST BANK
SUN TRUST BANK
Internal Affairs Department New York
NOTIFICATION OF CREDIT FROM SUN TRUST BANK.
Dear Beneficiary,
It has come to our notice that you have been defrauded of your hard earned money by
fraudsters from Africa (Nigeria) and other country's. During the last Anti-Fraud
meeting held in Washington DC USA, it was alarmed so much by the rest of the world
on the loss of funds by various foreigners to scam artists operating all over the
world today.
After the meeting, we concluded to redeem the good image of UK and African Countries
through compensation,Therefore,an out standing payment of $5,500,000.00 USD (five
Million,Five Hundred Thousand United States Dollars) has been ordered for each of
the affected victims.This is in accordance to our recommendations.
However,this payments will be made by SUN TRUST BANK as the authorized and
corresponding paying bank under the funding assistance of the World Bank.
Note: A special and reserved request Online Transfer System ( O.T S) was made that
this funds should be transferred to you in the most confidential environment .
You are required to e-mail us with your FULL NAME AND TELEPHONE NUMBER for accuracy
and to enable us transfer your funds as instructed.
Anticipating your prompt response.
Yours in Service,
Aleem Gillani
Chief Financial Officer,
Sun Trust Bank.
Envelope-to:
Delivery-date: Sat, 24 Jun 2017 16:03:53 -0700
Received: from [31.148.3.41] (port=55189 helo=ca.orsodin.ru)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1dOu5h-0002u0-Kp
for ; Sat, 24 Jun 2017 16:03:53 -0700
Received: from User (unknown [88.99.254.159])
by ca.orsodin.ru (Postfix) with ESMTPA id 3EB5911B963;
Thu, 15 Jun 2017 14:16:49 +0300 (MSK)
Reply-To: <[email protected]>
From: "Aleem Gillani"<[email protected]>
Date: Thu, 15 Jun 2017 04:16:58 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=26.4
X-Spam-Score: 264
X-Spam-Bar: ++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: SUN TRUST BANK Internal Affairs Department New York NOTIFICATION
OF CREDIT FROM SUN TRUST BANK. [...]
Content analysis details: (26.4 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[31.148.3.41 listed in dnsbl.sorbs.net]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?31.148.3.41>]
3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[31.148.3.41 listed in zen.spamhaus.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(james[at]gmail.com)
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
1.0 MISSING_HEADERS Missing To: header
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.6 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.6 REPLYTO_WITHOUT_TO_CC No description available.
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** NOTIFICATION OF CREDIT FROM SUN TRUST BANK
SUN TRUST BANK
Internal Affairs Department New York
NOTIFICATION OF CREDIT FROM SUN TRUST BANK.
Dear Beneficiary,
It has come to our notice that you have been defrauded of your hard earned money by
fraudsters from Africa (Nigeria) and other country's. During the last Anti-Fraud
meeting held in Washington DC USA, it was alarmed so much by the rest of the world
on the loss of funds by various foreigners to scam artists operating all over the
world today.
After the meeting, we concluded to redeem the good image of UK and African Countries
through compensation,Therefore,an out standing payment of $5,500,000.00 USD (five
Million,Five Hundred Thousand United States Dollars) has been ordered for each of
the affected victims.This is in accordance to our recommendations.
However,this payments will be made by SUN TRUST BANK as the authorized and
corresponding paying bank under the funding assistance of the World Bank.
Note: A special and reserved request Online Transfer System ( O.T S) was made that
this funds should be transferred to you in the most confidential environment .
You are required to e-mail us with your FULL NAME AND TELEPHONE NUMBER for accuracy
and to enable us transfer your funds as instructed.
Anticipating your prompt response.
Yours in Service,
Aleem Gillani
Chief Financial Officer,
Sun Trust Bank.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces