Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#389822 by buried under 419s Mon Jun 24, 2019 9:42 pm
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id sEmAOs8QEV2rXQAAjbubUg
for <>; Mon, 24 Jun 2019 11:05:03 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 24 Jun 2019 11:05:03 -0700
Received: from fm1-correo5.smtp.telconet.net ([181.39.191.61]:26577 helo=fm.telconet.net)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hfTKv-0006EH-IF
for ; Mon, 24 Jun 2019 11:05:03 -0700
Received: from correo5.cloudcenter.ec (correo5.cloudcenter.ec [181.198.2.18])
by fm.telconet.net with ESMTP id x5OI3kiJ012135-x5OI3kiL012135
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
Mon, 24 Jun 2019 13:03:46 -0500
Received: from correo5.cloudcenter.ec (localhost [127.0.0.1])
by correo5.cloudcenter.ec (Postfix) with ESMTPS id B15B12E3627;
Mon, 24 Jun 2019 13:03:45 -0500 (ECT)
Received: from localhost (localhost [127.0.0.1])
by correo5.cloudcenter.ec (Postfix) with ESMTP id 417612E3626;
Mon, 24 Jun 2019 13:03:45 -0500 (ECT)
DKIM-Filter: OpenDKIM Filter v2.10.3 correo5.cloudcenter.ec 417612E3626
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netlife.ec;
s=6A88B7D8-7E11-11E6-80C7-CAD66EEE68CA; t=1561399425;
bh=aAYTEdHqY4T7vaJuLVUoRZKc7Uaa1yr6MnBdqgGgLRs=;
h=From:Date:MIME-Version:Message-Id;
b=uBhKgzAaNvUMSI2jfRArXSx3FBBWKzp8bmwS4qO1/iM5NiV+MCmo2b+kxVJSaCVcv
HTef/HXcBb9oNoaG5ZfWhr/1usWxqSMz/V35eKSrU8vu3h9yiQOsRrJa7jMfJK3t3H
dI+LUePwQcqetAkff54auXMygDCKcffdD4qjSnCM=
Received: from correo5.cloudcenter.ec ([127.0.0.1])
by localhost (correo5.cloudcenter.ec [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id narDse-2cjT5; Mon, 24 Jun 2019 13:03:45 -0500 (ECT)
Received: from User (host-186-101-255-146.netlife.ec [186.101.255.146])
by correo5.cloudcenter.ec (Postfix) with SMTP id 852692E34C0;
Mon, 24 Jun 2019 13:03:02 -0500 (ECT)
Reply-To: <[email protected]>
From: "Vincenzo Caruso"<[email protected]>
Date: Mon, 24 Jun 2019 19:03:41 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=29.0
X-Spam-Score: 290
X-Spam-Bar: +++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: Hello Dear, My name is Agent Vincenzo Caruso with United Nation
delivery company. I wish to inform you that i have been instructed by Mr.
David Malpass of the World Bank to deliver your approved part payment of
$5.5Million Dollars long overdue payment. I wish to inform you that i have
arrived at Fort Lauderdale-Hollywood International Airport and i need you
to get back to me immediately and reconfirm the following details: [...]

Content analysis details: (29.0 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
2.5 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?186.101.255.146>]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 MISSING_HEADERS Missing To: header
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
2.6 MSOE_MID_WRONG_CASE No description available.
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_USER From misspaced, from "User"
3.8 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
2.5 MONEY_FORM_SHORT Lots of money if you fill out a short form
X-Spam-Flag: YES
Subject: ***SPAM*** I have Arrived Fort Lauderdale-Hollywood International Airport with your delivery



Hello Dear,

My name is Agent Vincenzo Caruso with United Nation delivery company. I wish to
inform you that i have been instructed by Mr. David Malpass of the World Bank to
deliver your approved part payment of $5.5Million Dollars long overdue payment. I
wish to inform you that i have arrived at Fort Lauderdale-Hollywood International
Airport and i need you to get back to me immediately and reconfirm the following
details:

Full Name:
Address:
Telephone Number:
Occupation:
Scan Copy of your ID:

I need you to get back to me immediately as i need to get this delivery completed
today as scheduled. Call me on +1 (786) 480-1964

Waiting for your immediate response and cooperation.

Regards,
Mr. Vincenzo Caruso.
Tel: +1 (786) 480-1964.

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
Advertisement

Who is online

Users browsing this forum: No registered users and 36 guests