Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#403256 by buried under 419s Wed Jan 15, 2020 10:39 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP
id bogkKmYIH17yUAAAibB4EA
(envelope-from <[email protected]>)
for <>; Wed, 15 Jan 2020 07:41:10 -0500
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 15 Jan 2020 07:41:10 -0500
Received: from mx03lb.world4you.com ([81.19.149.113]:59262)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.92)
(envelope-from <[email protected]>)
id 1irhyq-0005Nt-JM
for ; Wed, 15 Jan 2020 07:41:10 -0500
Received: from [31.185.99.164] (helo=User)
by mx03lb.world4you.com with esmtpa (Exim 4.92.3)
(envelope-from <[email protected]>)
id 1irh21-00064A-7b; Wed, 15 Jan 2020 12:40:17 +0100
Reply-To: <[email protected]>
From: "CITIBANK GROUP"<[email protected]>
Date: Wed, 15 Jan 2020 12:40:16 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AV-Do-Run: Yes
X-Spam-Status: Yes, score=23.3
X-Spam-Score: 233
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Citibank Group 201 S Biscayne Blvd #100, Miami, FL 33131,
United States. Dear Beficiary, Happy New year,
Content analysis details: (23.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[31.185.99.164 listed in zen.spamhaus.org]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_HELO_USER Received from HELO User
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?31.185.99.164>]
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/,
low trust
[81.19.149.113 listed in list.dnswl.org]
0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[81.19.149.113 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 MISSING_HEADERS Missing To: header
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.5 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.8 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Credit Alert Valued $10.5 Million


Citibank Group
201 S Biscayne Blvd #100,
Miami, FL 33131,
United States.

Dear Beficiary,

Happy New year,

This is to notify you about the credit alert valued $10,500,000 to account# 9343262302 from the Bank of London. The said amount is under review before final crediting into your account.

As you are aware, The Bank Secrecy Act of 1970 (or BSA, or otherwise known as the Currency and Foreign Transactions Reporting Act) requires financial institutions to assist the Egyptian government agencies to detect and prevent money laundering. Specifically, the act requires financial institutions to keep records of cash purchases of negotiable instruments, and file reports of cash purchases of these negotiable instruments of more than $10,000 (daily aggregate amount), and to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities.

Having said this, we have every reason to believe that you are involve into money laundering or criminal activities due to the amount transferred to your account. I am entitled to report this transaction to the U.S Government. However, i will not do that because from your record there is no traces of money laundering or criminal activities. I can only ask you to provide the fund origin certificate before the final crediting into your account.

I want to help you if you are willing to help yourself and nobody must know about my involvement by trying to assist you. Secondly, you must not ask anybody from your branch or notify anyone about this until the fund gets to your account. If you try to play smart by asking questions or notifying anyone, i will have no option than to report the transaction to the U.S Government and i believe you know the consequences.

All you have to do is to provide me with the fund origin certificate immediately and your fund will be credited to your account without questioning by any authority and I will not report the transaction to the Government.

Your immediate co-operation is highly recommended.

Sincerely,
Deborah C. Wright
International Deposit Management Center.
Last edited by buried under 419s on Mon Apr 27, 2020 11:25 am, edited 1 time in total.

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
Advertisement

#407814 by buried under 419s Tue Apr 07, 2020 12:49 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP
id 6yHKFYn1i15mXgEAibB4EA
(envelope-from <[email protected]>)
for <>; Mon, 06 Apr 2020 23:37:45 -0400
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 06 Apr 2020 23:37:45 -0400
Received: from [134.209.235.51] (port=49922 helo=vps2.mstudio.hu)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.93)
(envelope-from <[email protected]>)
id 1jLf3X-000NJZ-Pi
for ; Mon, 06 Apr 2020 23:37:44 -0400
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=pestibulvar.hu; s=mail; h=Message-Id:Content-Transfer-Encoding:Content-Type
:MIME-Version:Date:Subject:From:Reply-To:Sender:To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=hxdzVbK3PVwF1ID9yIIZ6jtM24/EGrLy+DjdmydEZ4o=; b=aQfx6SHiYsIGSI5xCDqxB574EK
PmhP+uwLhZDKuTP2Y5sGbwKSVGizwB6LqclH45y+PEfNnqlaOTlCNDPWjofv5Yn5lHLtGU3MTW75i
i2E19a1VhLrFVkJqaiX1NGNTXHJrNMyJYUbO7xfW9hA+GE1z9EKgzLnWF7S1yU1T7ba0=;
Received: from [82.142.87.2] (helo=User)
by mstudio.example.com with esmtpa (Exim 4.90_1)
(envelope-from <[email protected]>)
id 1jLbxA-0007Iz-J3; Tue, 07 Apr 2020 02:18:57 +0200
Reply-To: <[email protected]>
From: "CITI GROUP"<[email protected]>
Date: Tue, 7 Apr 2020 10:32:12 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=26.7
X-Spam-Score: 267
X-Spam-Bar: ++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Citibank Group 201 S Biscayne Blvd #100, Miami, FL 33131,
United States. Dear Beneficiary, I am please to inform you that due to the
Pandemic the Chase Bank have concluded arrangement to grant you a waiver
to enable us receive your pending payment of $10.5 Million Dollars and allow
you pay [...]
Content analysis details: (26.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.7 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
3.2 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received:
date
0.5 SUBJ_ALL_CAPS Subject is all capitals
1.0 MISSING_HEADERS Missing To: header
-0.0 SPF_PASS SPF: sender matches SPF record
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[82.142.87.2 listed in zen.spamhaus.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?82.142.87.2>]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[134.209.235.51 listed in wl.mailspike.net]
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.4 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** WAIVER GRANTED

Citibank Group
201 S Biscayne Blvd #100,
Miami, FL 33131,
United States.

Dear Beneficiary,

I am please to inform you that due to the Pandemic the Chase Bank have concluded arrangement to grant you a waiver to enable us receive your pending payment of $10.5 Million Dollars and allow you pay the pending fee when you receive your fund. However, we can only send the money to you through your credit card or debit card and in other to complete the payment we need the following details.

Kindly provide us with the following details immediately to get the payment completed:

Card Number:
Expiry Date:
CVV
Mobile Number:

I am pleased to inform you that your payment would be processed within 24hour on the receipt of the above information.

Thanking you in anticipation..

Your immediate co-operation is highly recommended.

Sincerely,
Deborah C. Wright
International Deposit Management Center.

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces

Who is online

Users browsing this forum: Bing [Bot] and 102 guests