#315231 by buried under 419s
Wed Dec 21, 2016 11:34 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 21 Dec 2016 16:00:18 -0800
Received: from arispro.ru ([212.158.174.170]:34492)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.87)
(envelope-from <[email protected]>)
id 1cJqnc-0000RC-So
for ; Wed, 21 Dec 2016 16:00:18 -0800
Received: from [95.165.236.94] (helo=arispost)
by arispro.ru with esmtpa (Exim 4.77)
(envelope-from <[email protected]>)
id 1cJPiU-0004KV-3g; Tue, 20 Dec 2016 22:04:50 +0300
Received: from [217.128.30.13] (account [email protected] HELO User)
by arispro.ru (CommuniGate Pro SMTP 6.1.12)
with ESMTPA id 90197; Tue, 20 Dec 2016 22:04:49 +0300
Reply-To: <[email protected]>
From: "State Treasury"<[email protected]>
Date: Tue, 20 Dec 2016 20:04:49 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <auto-000000090197@arispost>
X-Spam-Status: Yes, score=18.2
X-Spam-Score: 182
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Good Day , Have you received your funds of $10.5 Million
dollars from the IRS / Home Land office If not contact the information below,
this Mail as been secure verify from the Home Land office United State [...]
Content analysis details: (18.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 MILLION_USD BODY: Talks about millions of dollars
0.0 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[217.128.30.13 listed in zen.spamhaus.org]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
-3.1 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(homelandclaraoffice32[at]yahoo.com)
1.0 MISSING_HEADERS Missing To: header
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[217.128.30.13 listed in dnsbl.sorbs.net]
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 FAKE_REPLY_C No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
1.0 FORM_FRAUD Fill a form and a fraud phrase
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Have you received your funds
Good Day ,
Have you received your funds of $10.5 Million dollars from the IRS / Home Land
office If not contact the information below, this Mail as been secure verify from
the Home Land office United State
Homeland Security US Department
Office Address : Federal Government Office 300 7th St SW
Email : [email protected]
Office Secretary : Mrs Clara Rodrick
We are happy to inform you that at our office here we recover the some of Ten
Million five hundred thousand United State dollars from some Africa, Asia United
Kingdom and even here in the State from internet fraudster and gang with the help of
international Criminal Committee
Reason for contacting you is that we have found your email to be among the people
who are to be compensating with the sum above as your email and name as fail among
our list to pay.
The United State Government will not hold your payment for any reasons as long as
this email get to you then know that you have been selected to receive the payment
without any delay it dose not matter which country you are from know that there is
all possible payment to you .
The IRS / Home Land have been waiting for you to get back to them all this time i
see no reason why you should abandon your funds. Also make sure you Re-confirm your
information to the IRS / Home Land to avoid any mistake.
You can also confirm your information below to the Home Land Security
Full Name :
Full Home Address :
Tel Phone Number :
Contact the IRS / Home Land as soon as this mail get to you . to avoid any delay of
your payment Mr. John Ben have received his fund $ 10.5 million a week ago
Your email will be respond to as soon as you confirm your information as we will
treat your urgent and release your payment of Ten Million five hundred thousand
United State dollars ($10.5 Million ) to you please you are only advice to contact
us if you have not receive your payment and that is all ,
Homeland Security US Department
Federal Government Office
300 7th St SW
Envelope-to:
Delivery-date: Wed, 21 Dec 2016 16:00:18 -0800
Received: from arispro.ru ([212.158.174.170]:34492)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.87)
(envelope-from <[email protected]>)
id 1cJqnc-0000RC-So
for ; Wed, 21 Dec 2016 16:00:18 -0800
Received: from [95.165.236.94] (helo=arispost)
by arispro.ru with esmtpa (Exim 4.77)
(envelope-from <[email protected]>)
id 1cJPiU-0004KV-3g; Tue, 20 Dec 2016 22:04:50 +0300
Received: from [217.128.30.13] (account [email protected] HELO User)
by arispro.ru (CommuniGate Pro SMTP 6.1.12)
with ESMTPA id 90197; Tue, 20 Dec 2016 22:04:49 +0300
Reply-To: <[email protected]>
From: "State Treasury"<[email protected]>
Date: Tue, 20 Dec 2016 20:04:49 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <auto-000000090197@arispost>
X-Spam-Status: Yes, score=18.2
X-Spam-Score: 182
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Good Day , Have you received your funds of $10.5 Million
dollars from the IRS / Home Land office If not contact the information below,
this Mail as been secure verify from the Home Land office United State [...]
Content analysis details: (18.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 MILLION_USD BODY: Talks about millions of dollars
0.0 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[217.128.30.13 listed in zen.spamhaus.org]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
-3.1 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(homelandclaraoffice32[at]yahoo.com)
1.0 MISSING_HEADERS Missing To: header
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[217.128.30.13 listed in dnsbl.sorbs.net]
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 FAKE_REPLY_C No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
1.0 FORM_FRAUD Fill a form and a fraud phrase
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Have you received your funds
Good Day ,
Have you received your funds of $10.5 Million dollars from the IRS / Home Land
office If not contact the information below, this Mail as been secure verify from
the Home Land office United State
Homeland Security US Department
Office Address : Federal Government Office 300 7th St SW
Email : [email protected]
Office Secretary : Mrs Clara Rodrick
We are happy to inform you that at our office here we recover the some of Ten
Million five hundred thousand United State dollars from some Africa, Asia United
Kingdom and even here in the State from internet fraudster and gang with the help of
international Criminal Committee
Reason for contacting you is that we have found your email to be among the people
who are to be compensating with the sum above as your email and name as fail among
our list to pay.
The United State Government will not hold your payment for any reasons as long as
this email get to you then know that you have been selected to receive the payment
without any delay it dose not matter which country you are from know that there is
all possible payment to you .
The IRS / Home Land have been waiting for you to get back to them all this time i
see no reason why you should abandon your funds. Also make sure you Re-confirm your
information to the IRS / Home Land to avoid any mistake.
You can also confirm your information below to the Home Land Security
Full Name :
Full Home Address :
Tel Phone Number :
Contact the IRS / Home Land as soon as this mail get to you . to avoid any delay of
your payment Mr. John Ben have received his fund $ 10.5 million a week ago
Your email will be respond to as soon as you confirm your information as we will
treat your urgent and release your payment of Ten Million five hundred thousand
United State dollars ($10.5 Million ) to you please you are only advice to contact
us if you have not receive your payment and that is all ,
Homeland Security US Department
Federal Government Office
300 7th St SW
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces