#381294 by buried under 419s
Thu Feb 07, 2019 10:29 am
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 07 Feb 2019 01:46:34 -0800
Received: from 230.rafmarham.org.uk ([62.172.235.230]:61540 helo=our.madebysonder.com)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1grgGN-0001yb-F6
for ; Thu, 07 Feb 2019 01:46:34 -0800
Received: from User (unknown [185.215.151.95])
by our.madebysonder.com (Postfix) with ESMTPA id EA55D3F46066;
Wed, 6 Feb 2019 21:10:10 +0000 (GMT)
Reply-To: <[email protected]>
From: "International Monetary Fund (I.M.F)."<[email protected]>
Date: Wed, 6 Feb 2019 13:10:12 -0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=34.5
X-Spam-Score: 345
X-Spam-Bar: ++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I.M.F WORLD REGULATORY OFFICE International Monetary Fund,
SWIFT: IMFDUS3WXXX Business Hours: Monday - Friday: 8:30 a.m. to 6:00 p.m
Saturdays, Sundays: 12:30 p.m to 3:30 p.m holidays*: closed. Attention: Beneficiary,
[...]
Content analysis details: (34.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HK_SCAM_N8 BODY: No description available.
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[62.172.235.230 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?62.172.235.230>]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[62.172.235.230 listed in zen.spamhaus.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[62.172.235.230 listed in bl.score.senderscore.com]
4.0 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=h ... mf.com;ip=]
1.0 MISSING_HEADERS Missing To: header
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.4 HK_SCAM_N3 BODY: No description available.
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.8 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/)
0.6 FSL_BULK_SIG Bulk signature with no Unsubscribe
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 MISSING_MID Missing Message-Id: header
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.0 FROM_MISSP_SPF_FAIL No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 KAM_NIGERIAN Nigerian Scam and Variants
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** INTERNATIONAL MONETARY FUND
I.M.F WORLD REGULATORY OFFICE
International Monetary Fund,
SWIFT: IMFDUS3WXXX
Business Hours: Monday - Friday: 8:30 a.m. to 6:00 p.m
Saturdays, Sundays: 12:30 p.m to 3:30 p.m
holidays*: closed.
Attention: Beneficiary,
I am Barr Alfred Morris the Financial Counselor and Director Monetary and Capital
Markets Department, (I.M.F). I'm a highly placed official of the International
Monetary Fund (I.M.F).
Note. Due to the global financial crisis rocking the American's, Africa, Asian and
European Countries, we the (I.M.F) International Monetary Fund conducted an
investigation at the Western Union Headquarters and the Money Gram Headquarters in
America with the assistance of the United States FBI and the CIA. We wish to inform
you that during our investigation process at the Western Union Headquarters and the
Money Gram Headquarters, your name was found among the scam victims that sent out
money through western union to other countries without receiving anything in return
rather all you got was a empty promises of your funds release.
So therefore, the World Bank has approved the total sum of $6,500,000.00 (Six
Million Five Hundred Thousand United States Dollars ) only to your name and the
approved fund is ready for immediate payout to you as a compensation, but you will
have to pay $165usd for CLAIMS AFFIDAVIT and $185usd for IRREVOCABLE PAYMENT
CLEARANCE papers, so the total amount you are to pay is $165 + $185 = $350usd only,
and that is the only fee requested and your compensation funds would be release to
you with immediate effect. Note among the 35 scam victims that was approved to
receive the compensation funds, 19 scam victims has been paid $6,500,000.00usd each
and you are the next victims to be paid on the list.
But surprisingly yesterday, we received a message from a man who identify himself as
Mr. Patrick Edward, he claims to be your cousin, and he told us that you are dead,
and he wants the approved compensation fund to be release into his personal bank
account stated below, and Mr. Patrick Edwards also agreed to pay the $350usd
requested for the CLAIMS AFFIDAVIT and the IRREVOCABLE PAYMENT CLEARANCE papers of
your compensation fund.
========================
Bank Name: 1st Mariner Bank.
Bank Address: 201 W Baltimore Street. Baltimore, MD 21201
Name of Account Holder: Patrick B. Edward.
Account Number: #473-843-8484
Routing Number: #897-900
========================
But due to our intelligence and experiences, we dishonor Mr. Patrick Edward request,
because we need to be 100% sure that you are dead before we can proceed on releasing
the funds into your cousin bank account stated above, so whereby send you this
message to confirm if truly you are dead or alive, and your failure to respond back
to this message within the next 48hours will leave us with no doubt but to believe
that you are dead according to Mr. Patrick Edward and we will go ahead with the fund
release to Mr. Patrick Edward account after the receipt of the $350usd payment from
him, but if you are still alive and you receive this message, quickly get back to me
via this email address: [email protected]
You are advised to respond back with the details required below.
Your Full Name:.............
Home Address:..................
Office Address:..................
Direct Telephone Number:..........
Age:.........................
Occupation:..................
Best Regard,
Barr Alfred Morris,
Financial Counselor and Director
Monetary and Capital Markets Department, IMF.
INTERNATIONAL MONETARY FUND
Envelope-to:
Delivery-date: Thu, 07 Feb 2019 01:46:34 -0800
Received: from 230.rafmarham.org.uk ([62.172.235.230]:61540 helo=our.madebysonder.com)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1grgGN-0001yb-F6
for ; Thu, 07 Feb 2019 01:46:34 -0800
Received: from User (unknown [185.215.151.95])
by our.madebysonder.com (Postfix) with ESMTPA id EA55D3F46066;
Wed, 6 Feb 2019 21:10:10 +0000 (GMT)
Reply-To: <[email protected]>
From: "International Monetary Fund (I.M.F)."<[email protected]>
Date: Wed, 6 Feb 2019 13:10:12 -0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=34.5
X-Spam-Score: 345
X-Spam-Bar: ++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I.M.F WORLD REGULATORY OFFICE International Monetary Fund,
SWIFT: IMFDUS3WXXX Business Hours: Monday - Friday: 8:30 a.m. to 6:00 p.m
Saturdays, Sundays: 12:30 p.m to 3:30 p.m holidays*: closed. Attention: Beneficiary,
[...]
Content analysis details: (34.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HK_SCAM_N8 BODY: No description available.
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[62.172.235.230 listed in psbl.surriel.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?62.172.235.230>]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[62.172.235.230 listed in zen.spamhaus.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[62.172.235.230 listed in bl.score.senderscore.com]
4.0 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=h ... mf.com;ip=]
1.0 MISSING_HEADERS Missing To: header
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.4 HK_SCAM_N3 BODY: No description available.
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.8 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/)
0.6 FSL_BULK_SIG Bulk signature with no Unsubscribe
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 MISSING_MID Missing Message-Id: header
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.0 FROM_MISSP_SPF_FAIL No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 KAM_NIGERIAN Nigerian Scam and Variants
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** INTERNATIONAL MONETARY FUND
I.M.F WORLD REGULATORY OFFICE
International Monetary Fund,
SWIFT: IMFDUS3WXXX
Business Hours: Monday - Friday: 8:30 a.m. to 6:00 p.m
Saturdays, Sundays: 12:30 p.m to 3:30 p.m
holidays*: closed.
Attention: Beneficiary,
I am Barr Alfred Morris the Financial Counselor and Director Monetary and Capital
Markets Department, (I.M.F). I'm a highly placed official of the International
Monetary Fund (I.M.F).
Note. Due to the global financial crisis rocking the American's, Africa, Asian and
European Countries, we the (I.M.F) International Monetary Fund conducted an
investigation at the Western Union Headquarters and the Money Gram Headquarters in
America with the assistance of the United States FBI and the CIA. We wish to inform
you that during our investigation process at the Western Union Headquarters and the
Money Gram Headquarters, your name was found among the scam victims that sent out
money through western union to other countries without receiving anything in return
rather all you got was a empty promises of your funds release.
So therefore, the World Bank has approved the total sum of $6,500,000.00 (Six
Million Five Hundred Thousand United States Dollars ) only to your name and the
approved fund is ready for immediate payout to you as a compensation, but you will
have to pay $165usd for CLAIMS AFFIDAVIT and $185usd for IRREVOCABLE PAYMENT
CLEARANCE papers, so the total amount you are to pay is $165 + $185 = $350usd only,
and that is the only fee requested and your compensation funds would be release to
you with immediate effect. Note among the 35 scam victims that was approved to
receive the compensation funds, 19 scam victims has been paid $6,500,000.00usd each
and you are the next victims to be paid on the list.
But surprisingly yesterday, we received a message from a man who identify himself as
Mr. Patrick Edward, he claims to be your cousin, and he told us that you are dead,
and he wants the approved compensation fund to be release into his personal bank
account stated below, and Mr. Patrick Edwards also agreed to pay the $350usd
requested for the CLAIMS AFFIDAVIT and the IRREVOCABLE PAYMENT CLEARANCE papers of
your compensation fund.
========================
Bank Name: 1st Mariner Bank.
Bank Address: 201 W Baltimore Street. Baltimore, MD 21201
Name of Account Holder: Patrick B. Edward.
Account Number: #473-843-8484
Routing Number: #897-900
========================
But due to our intelligence and experiences, we dishonor Mr. Patrick Edward request,
because we need to be 100% sure that you are dead before we can proceed on releasing
the funds into your cousin bank account stated above, so whereby send you this
message to confirm if truly you are dead or alive, and your failure to respond back
to this message within the next 48hours will leave us with no doubt but to believe
that you are dead according to Mr. Patrick Edward and we will go ahead with the fund
release to Mr. Patrick Edward account after the receipt of the $350usd payment from
him, but if you are still alive and you receive this message, quickly get back to me
via this email address: [email protected]
You are advised to respond back with the details required below.
Your Full Name:.............
Home Address:..................
Office Address:..................
Direct Telephone Number:..........
Age:.........................
Occupation:..................
Best Regard,
Barr Alfred Morris,
Financial Counselor and Director
Monetary and Capital Markets Department, IMF.
INTERNATIONAL MONETARY FUND
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces