Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#364089 by buried under 419s Tue May 08, 2018 10:42 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Tue, 08 May 2018 16:35:53 -0700
Received: from server2.icoantech.com ([159.203.84.91]:48990)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fGC96-0004Z1-9P
for c; Tue, 08 May 2018 16:35:53 -0700
Received: from User (unknown [105.12.5.248])
by server2.icoantech.com (Postfix) with ESMTPA id 5F9C9206023;
Tue, 8 May 2018 11:04:06 -0400 (EDT)
Reply-To: <[email protected]>
From: "The FedEx Team."<[email protected]>
Date: Tue, 8 May 2018 17:05:11 +0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=34.0
X-Spam-Score: 340
X-Spam-Bar: ++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: Dear Unpaid Beneficiary, This email is coming to you as a
reminder concerning your pending parcel that has been with FedEx for a very
long time. Due to the petitions received by the UNCC regarding unfinished
transfers going on worldwide involving Governments of foreign lands, custom
officials and security agents who have been delaying people's funds, consignments,
parcels and other valuables in their custody, a consensus has been reached
that all the beneficiaries who have not received their fund be attended to
irrespective of the part of their world. [...]

Content analysis details: (34.0 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.7 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(donaldsmith_01[at]outlook.com)
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[159.203.84.91 listed in psbl.surriel.com]
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 FROM_MISSP_USER From misspaced, from "User"
1.5 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.6 MISSING_MID Missing Message-Id: header
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.4 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.1 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
2.5 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** YOUR PACKAGE WITH (Tracking Number: 800277347645) IS IN MEMPHIS.

Dear Unpaid Beneficiary,

This email is coming to you as a reminder concerning your pending parcel that has
been with FedEx for a very long time. Due to the petitions received by the UNCC
regarding unfinished transfers going on worldwide involving Governments of foreign
lands, custom officials and security agents who have been delaying people's funds,
consignments, parcels and other valuables in their custody, a consensus has been
reached that all the beneficiaries who have not received their fund be attended to
irrespective of the part of their world.

The United Nation Anti-crime commission and the United State Government have ordered
the money recovered sent to you immediately. I am pleased to to inform you that the
said fund has been successfully transferred into an ATM Mastercard for convenient
access to your fund and for security reasons.

In this light, FedEx courier company had carried out delivery to your residential
address. The package left Cape Town,South Africa on January 3rd 2018 and since on
the 5th of January 2018 it has been at Memphis, USA awaiting clearance.

To track your package, go to www.fedex.com/tracking and insert the tracking number
below to view your parcel status.

www.fedex.com/tracking
Tracking Number: 800277347645
Phone: +27627617511

To effect the clearance of your parcel containing an ATM Mastercard with vital
documents valued at $12.5 million in Memphis TN USA, you are advised to contact the
director of payment via his email address now!

Name: Mr. Donald Smith
Email: [email protected]
Phone: +27627617511

You are hereby advised to provide him with the information below so he can
immediately have it sent out to FedEx in Memphis for parcel clearance to you.

Full Name:
Your Delivery Address:
Your Direct telephone Number:

This is important and as such your immediate response will do you Good.

From the desk Jonathan Howkins,
For Ambassador Susan Rice,
Fmr. United States Ambassador to the United Nations.


YOUR PACKAGE WITH (Tracking Number: 800277347645) IS IN MEMPHIS.


SUSAN RICE.

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
Advertisement

#365150 by buried under 419s Sun May 20, 2018 5:59 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sun, 20 May 2018 14:30:50 -0700
Received: from server2.icoantech.com ([159.203.84.91]:52526)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fKVug-0002yJ-5Y
for ; Sun, 20 May 2018 14:30:50 -0700
Received: from User (unknown [105.8.6.94])
by server2.icoantech.com (Postfix) with ESMTPA id 525FFC96D8;
Thu, 10 May 2018 12:06:21 -0400 (EDT)
Reply-To: <[email protected]>
From: "The FedEx Team."<[email protected]>
Date: Thu, 10 May 2018 18:07:30 +0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=35.1
X-Spam-Score: 351
X-Spam-Bar: +++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: Dear Beneficiary, Your parcel has arrived on April 30th containing
an ATM master card loaded with US$2.5 million. The courier was unable to
deliver parcel to you as at April 28th, 06:33 PM. To receive your parcel,
please, confirm to us your valid address. [...]

Content analysis details: (35.1 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[159.203.84.91 listed in psbl.surriel.com]
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[159.203.84.91 listed in bl.mailspike.net]
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(donaldsmith_01[at]outlook.com)
1.0 MISSING_HEADERS Missing To: header
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
1.8 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 MISSING_MID Missing Message-Id: header
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
1.6 REPLYTO_WITHOUT_TO_CC No description available.
5.0 KAM_FAKE_DELIVER Fake delivery notifications
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.4 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.6 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** Your parcel has arrived at Friday April 30th Containing an ATM master card.!!!!

Dear Beneficiary,

Your parcel has arrived on April 30th containing an ATM master card loaded with
US$2.5 million. The courier was unable to deliver parcel to you as at April 28th,
06:33 PM. To receive your parcel, please, confirm to us your valid address.

You can track the status of your parcel below;

www.fedex.com/tracking
Tracking Number: 800277347645

Best Regards,
Mr. Donald Smith
+1 202 495 0762
FedEx Online Management Team.

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces

Who is online

Users browsing this forum: Bing [Bot] and 99 guests