#383972 by buried under 419s
Mon Apr 08, 2019 8:56 pm
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id sPFxI7W0q1xUGAAAjbubUg
for <>; Mon, 08 Apr 2019 13:53:09 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 08 Apr 2019 13:53:09 -0700
Received: from [124.217.227.71] (port=38232 helo=server9212.pnbdevt.com)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hDbGK-0001bZ-6t
for ; Mon, 08 Apr 2019 13:53:09 -0700
Received: from [172.93.148.196] (port=51840 helo=User)
by server9212.pnbdevt.com with esmtpa (Exim 4.86_1)
(envelope-from <[email protected]>)
id 1hDbFS-0007td-L4; Tue, 09 Apr 2019 04:52:11 +0800
Reply-To: <[email protected]>
From: "HARRY WELLS ,WELLS FARGO BANK"<[email protected]>
Date: Mon, 8 Apr 2019 13:52:12 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server9212.pnbdevt.com
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - bej-ivan.ro
X-Get-Message-Sender-Via: server9212.pnbdevt.com: authenticated_id: [email protected]
X-Authenticated-Sender: server9212.pnbdevt.com: [email protected]
X-Spam-Status: Yes, score=32.5
X-Spam-Score: 325
X-Spam-Bar: ++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: ATTN; Beneficiary . How are you doing today? Fine I hope.
Note that your inheritance payment is still in our possession and there some
tax and transfer fee that is needed be paid before final transfer of your
fund into your nominated bank account Knowing fully well that you might not
be able to pay the fee involved before final transfer of your fund into your
account . I have to seek for the assistance of an investor who has agreed
to loan us the needed fund, But he gave a condition of 3% of the total fund
immediately the transfer is made into your bank account .you don't have To
worry as I will sign all the document involved with the loan, Please do reconfirm
if not send your bank details . [...]
Content analysis details: (32.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.6 BILLION_DOLLARS BODY: Talks about lots of money
0.6 URG_BIZ BODY: Contains urgent matter
3.1 NSL_RCVD_HELO_USER Received from HELO User
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
2.5 FUZZY_MILLION BODY: Attempt to obfuscate words in spam
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 MISSING_MID Missing Message-Id: header
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.7 YOU_INHERIT Discussing your inheritance
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 L_8BIT_MISMATCH Header says 7bits but body disagrees
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.0 KAM_SUBJECTNOTICE Spam notices
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.1 FROM_MISSP_PHISH Malformed, claims to be from financial organization
- possible phish
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.2 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Final notice on your payment , No upfront payment from you
ATTN; Beneficiary .
How are you doing today? Fine I hope.
1, Do you send your full bank details with address,
2, Do also send your full address and your direct telephone number.
A promissory note that the fund that we be loan to you by the investor we be used
to finance the release of your 5miilion dollar inheritance fund with my bank . Note
that the loan from the investor is for the payment of the tax and proper
documentation of you fund and not for your personal use. WE HAVE ALSO
NOTICED THAT YOU ARE REQUIRED TO PAY BETWEEN $50,000 -$70,000 THESE BEING THE
OUTSTANDING ARREARS TO FINALIZE THIS TRANSACTION. NOTE THAT THE LOAN CAN ONLY BE PAY
BACK AFTER THE SUCCESSFUL TRANSFER OF THE 5MILLION DOLLAR INTO YOUR ACCOUNT.
Your urgent reply is needed,
HARRY WELLS ,
WELLS FARGO BANK.
Delivered-To:
Received: from
by with LMTP id sPFxI7W0q1xUGAAAjbubUg
for <>; Mon, 08 Apr 2019 13:53:09 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 08 Apr 2019 13:53:09 -0700
Received: from [124.217.227.71] (port=38232 helo=server9212.pnbdevt.com)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hDbGK-0001bZ-6t
for ; Mon, 08 Apr 2019 13:53:09 -0700
Received: from [172.93.148.196] (port=51840 helo=User)
by server9212.pnbdevt.com with esmtpa (Exim 4.86_1)
(envelope-from <[email protected]>)
id 1hDbFS-0007td-L4; Tue, 09 Apr 2019 04:52:11 +0800
Reply-To: <[email protected]>
From: "HARRY WELLS ,WELLS FARGO BANK"<[email protected]>
Date: Mon, 8 Apr 2019 13:52:12 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server9212.pnbdevt.com
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - bej-ivan.ro
X-Get-Message-Sender-Via: server9212.pnbdevt.com: authenticated_id: [email protected]
X-Authenticated-Sender: server9212.pnbdevt.com: [email protected]
X-Spam-Status: Yes, score=32.5
X-Spam-Score: 325
X-Spam-Bar: ++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: ATTN; Beneficiary . How are you doing today? Fine I hope.
Note that your inheritance payment is still in our possession and there some
tax and transfer fee that is needed be paid before final transfer of your
fund into your nominated bank account Knowing fully well that you might not
be able to pay the fee involved before final transfer of your fund into your
account . I have to seek for the assistance of an investor who has agreed
to loan us the needed fund, But he gave a condition of 3% of the total fund
immediately the transfer is made into your bank account .you don't have To
worry as I will sign all the document involved with the loan, Please do reconfirm
if not send your bank details . [...]
Content analysis details: (32.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.6 BILLION_DOLLARS BODY: Talks about lots of money
0.6 URG_BIZ BODY: Contains urgent matter
3.1 NSL_RCVD_HELO_USER Received from HELO User
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
2.5 FUZZY_MILLION BODY: Attempt to obfuscate words in spam
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 MISSING_MID Missing Message-Id: header
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.7 YOU_INHERIT Discussing your inheritance
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 L_8BIT_MISMATCH Header says 7bits but body disagrees
1.6 REPLYTO_WITHOUT_TO_CC No description available.
1.0 KAM_SUBJECTNOTICE Spam notices
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.1 FROM_MISSP_PHISH Malformed, claims to be from financial organization
- possible phish
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.2 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Final notice on your payment , No upfront payment from you
ATTN; Beneficiary .
How are you doing today? Fine I hope.
1, Do you send your full bank details with address,
2, Do also send your full address and your direct telephone number.
A promissory note that the fund that we be loan to you by the investor we be used
to finance the release of your 5miilion dollar inheritance fund with my bank . Note
that the loan from the investor is for the payment of the tax and proper
documentation of you fund and not for your personal use. WE HAVE ALSO
NOTICED THAT YOU ARE REQUIRED TO PAY BETWEEN $50,000 -$70,000 THESE BEING THE
OUTSTANDING ARREARS TO FINALIZE THIS TRANSACTION. NOTE THAT THE LOAN CAN ONLY BE PAY
BACK AFTER THE SUCCESSFUL TRANSFER OF THE 5MILLION DOLLAR INTO YOUR ACCOUNT.
Your urgent reply is needed,
HARRY WELLS ,
WELLS FARGO BANK.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces