#407953 by buried under 419s
Wed Apr 08, 2020 8:42 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 08 Apr 2020 12:23:50 -0400
Received: from [114.7.15.212] (port=33460 helo=webmail.gcs-gresik.com)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.93)
(envelope-from <[email protected]>)
id 1jMDUS-000Jxv-Pj
for ; Wed, 08 Apr 2020 12:23:50 -0400
Received: from localhost (localhost [127.0.0.1])
by webmail.gcs-gresik.com (Postfix) with ESMTP id 256C52AD8546;
Wed, 8 Apr 2020 03:48:51 -0400 (EDT)
Received: from webmail.gcs-gresik.com ([127.0.0.1])
by localhost (webmail.gcs-gresik.com [127.0.0.1]) (amavisd-new, port 10032)
with ESMTP id O0c4nzdk0p_4; Wed, 8 Apr 2020 03:48:50 -0400 (EDT)
Received: from localhost (localhost [127.0.0.1])
by webmail.gcs-gresik.com (Postfix) with ESMTP id 445342ADA9F1;
Wed, 8 Apr 2020 03:11:07 -0400 (EDT)
X-Virus-Scanned: amavisd-new at gcs-gresik.com
Received: from webmail.gcs-gresik.com ([127.0.0.1])
by localhost (webmail.gcs-gresik.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id 00rQZ7U-ZGCu; Wed, 8 Apr 2020 03:11:07 -0400 (EDT)
Received: from [45.143.223.202] (gateway [192.168.100.253])
by webmail.gcs-gresik.com (Postfix) with ESMTP id A194D24A4126;
Wed, 8 Apr 2020 02:49:57 -0400 (EDT)
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
To: Recipients <[email protected]>
From: UNITED NATIONS <[email protected]>
Date: Tue, 07 Apr 2020 23:50:14 -0700
Reply-To: [email protected]
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=23.9
X-Spam-Score: 239
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Good day, We have concluded to Send your payment through Western
Union money transfer $6,000.00 daily until the total fund of ($3.7MILLION
) is completely transferred. Meanwhile, Mr. Jeff Edward has Send you $6 [...]
Content analysis details: (23.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.6 RCVD_IN_SORBS_SMTP RBL: SORBS: sender is open SMTP relay
[114.7.15.212 listed in dnsbl.sorbs.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[114.7.15.212 listed in bl.score.senderscore.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[nations740[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[nations740[at]gmail.com]
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.0 LOTS_OF_MONEY Huge... sums of money
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing
list
0.9 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
0.0 T_LOTTO_AGENT Claims Agent
2.0 SPOOFED_FREEMAIL No description available.
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail
reply-to
0.9 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Contact Mr. Jeff Edward For Your Payment
Good day,
We have concluded to Send your payment through Western Union money transfer $6,000.00 daily until the total fund of ($3.7MILLION ) is completely transferred. Meanwhile, Mr. Jeff Edward has Send you $6,000.00 in your name today. So contact Mr. Jeff Edward, through Western Union money transfer payment Agent to SEND you the MTCN to pick up this $6000 now:
CONTACT PERSON: Mr. Jeff Edward
Cell Phone (+229) 6503-8547
Email Address:([email protected])
Please remember to Call and ask him to give you the Reference Number, sender name, question and answer to pick up the $6000.00. Also you should send to him your information to cross check it to avoid mistake.
Receiver's Name________________
Address: ______________________
Country: ______________________
Phone Number: _________________
Your Occupation _______________
I.D Card:______________________
Though, Mr. Jeff Edward has sent $6000 in your name today so contact Mr. Jeff Edward or you call him (+229) 6503-8547 as soon as you receive this email and tell him to give you the Reference Number, sender name and question/answer to pick the $6000 Please let us know as soon as you received all your fund.
Best Regards.
Regional Coordinator
United Nations
Envelope-to:
Delivery-date: Wed, 08 Apr 2020 12:23:50 -0400
Received: from [114.7.15.212] (port=33460 helo=webmail.gcs-gresik.com)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.93)
(envelope-from <[email protected]>)
id 1jMDUS-000Jxv-Pj
for ; Wed, 08 Apr 2020 12:23:50 -0400
Received: from localhost (localhost [127.0.0.1])
by webmail.gcs-gresik.com (Postfix) with ESMTP id 256C52AD8546;
Wed, 8 Apr 2020 03:48:51 -0400 (EDT)
Received: from webmail.gcs-gresik.com ([127.0.0.1])
by localhost (webmail.gcs-gresik.com [127.0.0.1]) (amavisd-new, port 10032)
with ESMTP id O0c4nzdk0p_4; Wed, 8 Apr 2020 03:48:50 -0400 (EDT)
Received: from localhost (localhost [127.0.0.1])
by webmail.gcs-gresik.com (Postfix) with ESMTP id 445342ADA9F1;
Wed, 8 Apr 2020 03:11:07 -0400 (EDT)
X-Virus-Scanned: amavisd-new at gcs-gresik.com
Received: from webmail.gcs-gresik.com ([127.0.0.1])
by localhost (webmail.gcs-gresik.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id 00rQZ7U-ZGCu; Wed, 8 Apr 2020 03:11:07 -0400 (EDT)
Received: from [45.143.223.202] (gateway [192.168.100.253])
by webmail.gcs-gresik.com (Postfix) with ESMTP id A194D24A4126;
Wed, 8 Apr 2020 02:49:57 -0400 (EDT)
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
To: Recipients <[email protected]>
From: UNITED NATIONS <[email protected]>
Date: Tue, 07 Apr 2020 23:50:14 -0700
Reply-To: [email protected]
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=23.9
X-Spam-Score: 239
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Good day, We have concluded to Send your payment through Western
Union money transfer $6,000.00 daily until the total fund of ($3.7MILLION
) is completely transferred. Meanwhile, Mr. Jeff Edward has Send you $6 [...]
Content analysis details: (23.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.6 RCVD_IN_SORBS_SMTP RBL: SORBS: sender is open SMTP relay
[114.7.15.212 listed in dnsbl.sorbs.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[114.7.15.212 listed in bl.score.senderscore.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[nations740[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[nations740[at]gmail.com]
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.0 LOTS_OF_MONEY Huge... sums of money
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing
list
0.9 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
0.0 T_LOTTO_AGENT Claims Agent
2.0 SPOOFED_FREEMAIL No description available.
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail
reply-to
0.9 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Contact Mr. Jeff Edward For Your Payment
Good day,
We have concluded to Send your payment through Western Union money transfer $6,000.00 daily until the total fund of ($3.7MILLION ) is completely transferred. Meanwhile, Mr. Jeff Edward has Send you $6,000.00 in your name today. So contact Mr. Jeff Edward, through Western Union money transfer payment Agent to SEND you the MTCN to pick up this $6000 now:
CONTACT PERSON: Mr. Jeff Edward
Cell Phone (+229) 6503-8547
Email Address:([email protected])
Please remember to Call and ask him to give you the Reference Number, sender name, question and answer to pick up the $6000.00. Also you should send to him your information to cross check it to avoid mistake.
Receiver's Name________________
Address: ______________________
Country: ______________________
Phone Number: _________________
Your Occupation _______________
I.D Card:______________________
Though, Mr. Jeff Edward has sent $6000 in your name today so contact Mr. Jeff Edward or you call him (+229) 6503-8547 as soon as you receive this email and tell him to give you the Reference Number, sender name and question/answer to pick the $6000 Please let us know as soon as you received all your fund.
Best Regards.
Regional Coordinator
United Nations
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces