Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#415155 by buried under 419s Fri Aug 07, 2020 8:57 pm
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP
id 1ERDLKSnLV+FIAAAibB4EA
(envelope-from <[email protected]>)
for <>; Fri, 07 Aug 2020 19:12:36 +0000
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Fri, 07 Aug 2020 19:12:36 +0000
Received: from mail-io1-f66.google.com ([209.85.166.66]:38893)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <[email protected]>)
id 1k47n9-000291-PN
for ; Fri, 07 Aug 2020 19:12:36 +0000
Received: by mail-io1-f66.google.com with SMTP id l1so2974119ioh.5
for <>; Fri, 07 Aug 2020 12:12:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=VE2i1x8L8C6E1QZ/6R6znuBdBh8tShdU3NyRkL+dy7o=;
b=SnThHiQDhJ51bp+zbsZKdAZSpZBxS4DuD9nPneXZre3hvE31+PKcXPZJpbag+Zuo8e
Ud73lXYQmB3wnJWL47+dDR0JqiCRpqH5+PnHRFLgPs1BKxhmiI4mkTmKTDkj/X45ga4w
RlhHaP1yGSlGqwej/R81cXrCkYAhtPBg8imzUH920wUO3rJNrmReUYmUvNZdwJSOP1Fi
FkxX+uVMNgb5i8pcLWV940ON970IFz/enDfM9nmXPoQz0SFx0fIsDNjKFj3UKDuodaqp
wC8eocN9X9diOv4IPev6JWIa1Am7PxcgCq2kDw6HBu4mGua34NZfoKmJ/ebTUdmQ75lU
Prbg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=VE2i1x8L8C6E1QZ/6R6znuBdBh8tShdU3NyRkL+dy7o=;
b=lWG6tQVVXbEL2+IgXPu4i8295iTqtzf7MFfDuZ/WpdRYprzGYAvHOiKqTKpc24D1Sn
DqCZIUQrdGR426agKxWZVopJG1ygkh5IE9neXdtGHAsunrLZjvHVEJa1AVPsITTlfqvI
zq1k5UsX+syvS71P0qfMG6uhal6/RMkFdRFDjQF9XEYCJDyXebKzXZ+NCk08AHhgAJ5j
0MazuEVkKl3OJ9gwKFmCqP8tqb1isVN74sZCYnz/CBjdOOS/LAvdg5K8XcpVWkXME3Yd
FIy6c4Hu8JUYXud63YeuQ6guFsO3K+n4z65ddcATEiQ9HFJYH3IQ3DdQDZ3ZLpP3WoaA
12Sw==
X-Gm-Message-State: AOAM531d8n+nZGOm8INVSRQxLrOImrnUUOz3U8RGBamKOgoVcvapzfib
vpoaPsx96BLXMpdnh/NTLc4Y025VzPCuDpxKFuU=
X-Google-Smtp-Source: ABdhPJwRPBPMlOA8xnYDA1No4LVi8SaqW1pu8e2fdu574mtYgeTBaa3nc3g5kSIGCbSG6wBPRHlmUqssEY40VCfm2ic=
X-Received: by 2002:a6b:b356:: with SMTP id c83mr5302378iof.99.1596827514799;
Fri, 07 Aug 2020 12:11:54 -0700 (PDT)
MIME-Version: 1.0
Reply-To: [email protected]
From: Ulster Bank <[email protected]>
Date: Fri, 7 Aug 2020 20:11:42 -0700
Message-ID: <[email protected]om>
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000c992e405ac4e6023"
Bcc:
X-Spam-Status: Yes, score=11.2
X-Spam-Score: 112
X-Spam-Bar: +++++++++++
X-Spam-Report: Spam detection software, running on the system "m",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attention: Here write Tom Roddy of Ulster Bank London, We
have been mandated by the World Bank and the European Union to pay out the
sum of £6,470,900.00 (Six Million Four Hundred and Seventy Thousand Nine
Hund [...]
Content analysis details: (11.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
2.5 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
1.0 HK_RANDOM_FROM From username looks random
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
-0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.166.66 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[ulsterbnnk[at]gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 LOTS_OF_MONEY Huge... sums of money
X-Spam-Flag: YES
Subject: ***SPAM*** RE

--000000000000c992e405ac4e6023
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Attention:

Here write Tom Roddy of Ulster Bank London, We have been mandated by the World Bank and the European Union to pay out the sum of £6,470,900.00 (Six Million Four Hundred and Seventy Thousand Nine Hundred Pounds) as Compensation Fund to you. You are require to provide the information as listed below

Name and Address
Telephone and Any Form of Identification
Age and Occupation

Further details will be unveil in my next email response and as soon as I hear from you

Sincerely

Ulster Bank
Tom Roddy
Position: Branch Manager
Address: 11-16 Donegall Square E, Belfast BT1 5UB, UK
Telephone: +44 28 9089 8999

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
Online
Advertisement

Who is online

Users browsing this forum: buried under 419s, Majestic-12 [Bot] and 41 guests