#403256 by buried under 419s
Wed Jan 15, 2020 10:39 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP
id bogkKmYIH17yUAAAibB4EA
(envelope-from <[email protected]>)
for <>; Wed, 15 Jan 2020 07:41:10 -0500
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 15 Jan 2020 07:41:10 -0500
Received: from mx03lb.world4you.com ([81.19.149.113]:59262)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.92)
(envelope-from <[email protected]>)
id 1irhyq-0005Nt-JM
for ; Wed, 15 Jan 2020 07:41:10 -0500
Received: from [31.185.99.164] (helo=User)
by mx03lb.world4you.com with esmtpa (Exim 4.92.3)
(envelope-from <[email protected]>)
id 1irh21-00064A-7b; Wed, 15 Jan 2020 12:40:17 +0100
Reply-To: <[email protected]>
From: "CITIBANK GROUP"<[email protected]>
Date: Wed, 15 Jan 2020 12:40:16 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AV-Do-Run: Yes
X-Spam-Status: Yes, score=23.3
X-Spam-Score: 233
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Citibank Group 201 S Biscayne Blvd #100, Miami, FL 33131,
United States. Dear Beficiary, Happy New year,
Content analysis details: (23.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[31.185.99.164 listed in zen.spamhaus.org]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_HELO_USER Received from HELO User
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?31.185.99.164>]
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/,
low trust
[81.19.149.113 listed in list.dnswl.org]
0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[81.19.149.113 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 MISSING_HEADERS Missing To: header
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.5 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.8 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Credit Alert Valued $10.5 Million
Citibank Group
201 S Biscayne Blvd #100,
Miami, FL 33131,
United States.
Dear Beficiary,
Happy New year,
This is to notify you about the credit alert valued $10,500,000 to account# 9343262302 from the Bank of London. The said amount is under review before final crediting into your account.
As you are aware, The Bank Secrecy Act of 1970 (or BSA, or otherwise known as the Currency and Foreign Transactions Reporting Act) requires financial institutions to assist the Egyptian government agencies to detect and prevent money laundering. Specifically, the act requires financial institutions to keep records of cash purchases of negotiable instruments, and file reports of cash purchases of these negotiable instruments of more than $10,000 (daily aggregate amount), and to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities.
Having said this, we have every reason to believe that you are involve into money laundering or criminal activities due to the amount transferred to your account. I am entitled to report this transaction to the U.S Government. However, i will not do that because from your record there is no traces of money laundering or criminal activities. I can only ask you to provide the fund origin certificate before the final crediting into your account.
I want to help you if you are willing to help yourself and nobody must know about my involvement by trying to assist you. Secondly, you must not ask anybody from your branch or notify anyone about this until the fund gets to your account. If you try to play smart by asking questions or notifying anyone, i will have no option than to report the transaction to the U.S Government and i believe you know the consequences.
All you have to do is to provide me with the fund origin certificate immediately and your fund will be credited to your account without questioning by any authority and I will not report the transaction to the Government.
Your immediate co-operation is highly recommended.
Sincerely,
Deborah C. Wright
International Deposit Management Center.
Delivered-To:
Received: from
by with LMTP
id bogkKmYIH17yUAAAibB4EA
(envelope-from <[email protected]>)
for <>; Wed, 15 Jan 2020 07:41:10 -0500
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 15 Jan 2020 07:41:10 -0500
Received: from mx03lb.world4you.com ([81.19.149.113]:59262)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.92)
(envelope-from <[email protected]>)
id 1irhyq-0005Nt-JM
for ; Wed, 15 Jan 2020 07:41:10 -0500
Received: from [31.185.99.164] (helo=User)
by mx03lb.world4you.com with esmtpa (Exim 4.92.3)
(envelope-from <[email protected]>)
id 1irh21-00064A-7b; Wed, 15 Jan 2020 12:40:17 +0100
Reply-To: <[email protected]>
From: "CITIBANK GROUP"<[email protected]>
Date: Wed, 15 Jan 2020 12:40:16 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AV-Do-Run: Yes
X-Spam-Status: Yes, score=23.3
X-Spam-Score: 233
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Citibank Group 201 S Biscayne Blvd #100, Miami, FL 33131,
United States. Dear Beficiary, Happy New year,
Content analysis details: (23.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[31.185.99.164 listed in zen.spamhaus.org]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_HELO_USER Received from HELO User
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?31.185.99.164>]
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/,
low trust
[81.19.149.113 listed in list.dnswl.org]
0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[81.19.149.113 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 MISSING_HEADERS Missing To: header
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.5 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.8 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Credit Alert Valued $10.5 Million
Citibank Group
201 S Biscayne Blvd #100,
Miami, FL 33131,
United States.
Dear Beficiary,
Happy New year,
This is to notify you about the credit alert valued $10,500,000 to account# 9343262302 from the Bank of London. The said amount is under review before final crediting into your account.
As you are aware, The Bank Secrecy Act of 1970 (or BSA, or otherwise known as the Currency and Foreign Transactions Reporting Act) requires financial institutions to assist the Egyptian government agencies to detect and prevent money laundering. Specifically, the act requires financial institutions to keep records of cash purchases of negotiable instruments, and file reports of cash purchases of these negotiable instruments of more than $10,000 (daily aggregate amount), and to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities.
Having said this, we have every reason to believe that you are involve into money laundering or criminal activities due to the amount transferred to your account. I am entitled to report this transaction to the U.S Government. However, i will not do that because from your record there is no traces of money laundering or criminal activities. I can only ask you to provide the fund origin certificate before the final crediting into your account.
I want to help you if you are willing to help yourself and nobody must know about my involvement by trying to assist you. Secondly, you must not ask anybody from your branch or notify anyone about this until the fund gets to your account. If you try to play smart by asking questions or notifying anyone, i will have no option than to report the transaction to the U.S Government and i believe you know the consequences.
All you have to do is to provide me with the fund origin certificate immediately and your fund will be credited to your account without questioning by any authority and I will not report the transaction to the Government.
Your immediate co-operation is highly recommended.
Sincerely,
Deborah C. Wright
International Deposit Management Center.
Last edited by buried under 419s on Mon Apr 27, 2020 11:25 am, edited 1 time in total.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces