[email protected] Mr. Thomas Stevenson

[buried under 419s]

Return-Path: <[email protected]>
Delivered-To:
Received: from
by (Dovecot) with LMTP id VbhsJgY5Tlg9VwAAjbubUg
for <>; Sun, 11 Dec 2016 21:43:34 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sun, 11 Dec 2016 21:43:34 -0800
Received: from msa505.att.ne.jp ([210.134.90.15]:43090 helo=cmsa505.att.ne.jp)
by with esmtp (Exim 4.87)
(envelope-from <[email protected]>)
id 1cGJOK-0005nq-Iv
for ; Sun, 11 Dec 2016 21:43:34 -0800
Received: from vmsa505.att.ne.jp by cmsa505.att.ne.jp with ESMTP
id <[email protected]>
for <>; Mon, 12 Dec 2016 14:42:30 +0900
Received: from msrg5051.rgserv.att.ne.jp by vmsa505.att.ne.jp with ESMTP
id <[email protected]>;
Mon, 12 Dec 2016 14:42:30 +0900
Received: from User (151.237.190.58) by msrg5051.rgserv.att.ne.jp (9.0.018.07.06)
id 58490B36000A428D; Mon, 12 Dec 2016 14:42:30 +0900
Message-ID: <[email protected]> (added by [email protected])
Reply-To: <[email protected]>
From: "Mr. Thomas Stevenson"<[email protected]>
To: [email protected]
Date: Sat, 10 Dec 2016 08:25:56 -0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=16.0
X-Spam-Score: 160
X-Spam-Bar: ++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: FROM: MR. THOMAS STEVENSON. EXECUTIVE CHAIRMAN, FIDELITY WORLDWIDE
INVESTMENT. Office Address: 350 PARK AVENUE NEW YORK NY, 10022 USA. [...]


Content analysis details: (16.0 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 0.9976]
1.0 HK_RANDOM_FROM From username looks random
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
0.0 NSL_RCVD_FROM_USER Received from User
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[210.134.90.15 listed in list.dnswl.org]
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[151.237.190.58 listed in zen.spamhaus.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mrthomastsrfrfgbgbf[at]yahoo.com)
1.3 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(mrthomas1stevenson1[at]gmail.com)
1.6 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_USER From misspaced, from "User"
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** ****PAYMENT APPROVAL FROM THE FIDELITY WORLDWIDE INVESTMENT NEW YORK, NY USA.******


FROM: MR. THOMAS STEVENSON.

EXECUTIVE CHAIRMAN, FIDELITY WORLDWIDE INVESTMENT.

Office Address: 350 PARK AVENUE NEW YORK NY, 10022 USA.







****PAYMENT APPROVAL FROM THE FIDELITY WORLDWIDE INVESTMENT NEW YORK, NY USA.******







Urgent Attention,







I am Mr.Thomas Stevenson, Executive Chairman Fidelity Worldwide Investment New York.
This organization was set up to fight against scam and Fraudulent activities
worldwide. This Group is responsible for investigating the legitimacy of unpaid
contract, inheritance and lotto winning claims by companies and individuals and
directs the paying authorities (Banks) worldwide to make immediate payment of
verified claims to the beneficiaries without further delay.







You are being legally contacted regarding the release of your long awaited fund.
After a detailed review of your file, the United Nation Monetary Unit has been
authorized to release your fund immediately. The sum of US$10,500,000.00; has been
approved in your favor via my desk. This payment will be made via Bank to Bank Wire
Transfer or by Online Banking System.







Be informed that we are working in collaborations with the United Nation secretary
General Mr. Ban Ki-Moon, who authorize the immediate payment of your long awaited
fund without any further delay. You are advised to include the followings below:







(1). Your Full Name,

(2). Direct Telephone Numbers,

(3). Contact Address,

(4). Your Occupation,

age and Marital Status

5). Bank Name and Address.

(6). Account Numbers.

(7). Routing Numbers

(8). Swift Code.

(9). Beneficiary's Name.









Note that the above fund has been cleared from terrorist or fraud related activities.







Thanks for Your Cooperation.







Mr. Thomas Stevenson

Executive, Chairman

Fidelity Worldwide Investment.

Email: [email protected]

[buried under 419s]

Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id iOgUFnJqRFukFgAAjbubUg
for <>; Tue, 10 Jul 2018 01:12:34 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Tue, 10 Jul 2018 01:12:34 -0700
Received: from poczta.home-whs.pl ([46.41.156.4]:33426)
by with smtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fcnlA-0001V0-Ee
for ; Tue, 10 Jul 2018 01:12:34 -0700
Received: (qmail 1604 invoked from network); 10 Jul 2018 08:11:43 -0000
Received: from unknown (HELO User) ([email protected]@[31.211.247.58])
by 10.128.18.4 with ESMTPA; 10 Jul 2018 08:11:43 -0000
Reply-To: <[email protected]>
From: "MR. THOMAS STEVENSON"<[email protected]>
Date: Tue, 10 Jul 2018 01:11:43 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=25.9
X-Spam-Score: 259
X-Spam-Bar: +++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: From The Desk Of: MR. THOMAS STEVENSON. From Bank of America
USA Attn: The Beneficiary, [...]

Content analysis details: (25.9 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[46.41.156.4 listed in list.dnswl.org]
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(mrthomas1stevenson1[at]gmail.com)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mrthsfssfsfsfs[at]outlook.com)
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
1.5 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.6 MISSING_MID Missing Message-Id: header
0.0 MONEY_BARRISTER Lots of money from a UK lawyer
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 FROM_MISSPACED From: missing whitespace
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
2.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.3 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.1 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
2.4 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** We are hereby officially notify you concerning your fund telegraphic Transfer through our bank.
From The Desk Of: MR. THOMAS STEVENSON.

From Bank of America USA







Attn: The Beneficiary,







TELEGRAPHIC TRANSFER NOTICE.







We are hereby officially notify you concerning your fund telegraphic Transfer
through our bank, Bank of America, New York, to your bank account, which has been
officially approved by the management of World Bank Swiss (WEBS) to credit the sum
of US$10.5 Million into your bank

account.







Note that I have started processing your payment and every thing concerning the
immediate remittance of your funds will be carried out within the shortest possible
time from the time we received your? Below needed information.







Also be informed that the Governor of Bank in London (BL) will sign on your payment
advice and a copy of the advice will be sent to the World Bank in Swiss for some
record purposes. Meanwhile your information and your full contact details were
received from our research manager, Barr.Paul Peterson on your behalf to FR for
immediate release of your fund.







This fund was part of the lodged Late President Saddam Hussein of Iraq discovery
fund with World Bank of Switzerland, which the Swiss Bank has decided to distribute
it generously to help few lucky individuals and the American Government is in
agreement with the Swiss Bank to distribute the fund to 700 hundred thousand people
in America, Europe & Asia in other to help improve their businesses.







Therefore, reconfirm the aforesaid information accurately, because this office
cannot afford to be held liable for any wrong transfer of funds or liable of any
fund credited into an unknown account.







These are the information we needed to be reconfirmed by you.







1.Your Full Bank Account Details

2.Your Direct Cell or office phone to reach you

3.Your address of locations

4.Your full name







Finally, you are required to reconfirm directly to me the above information to
enable me use it to process your bill of payment. Your quick response shall be
mostly appreciated; all your response should be directed through our alternative
email address for the immediate attention of the credit control department.







Yours Faithfully,





MR. THOMAS STEVENSON.

Vice Chairman, Director, Credit /Telex Department.

Email: [email protected]


Telephone: +917 725 3388.

[buried under 419s]

Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id gIXpLmUEhVurcwAAjbubUg
for <>; Tue, 28 Aug 2018 01:14:29 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Tue, 28 Aug 2018 01:14:29 -0700
Received: from mbkd0339.ocn.ad.jp ([153.149.236.40]:52035)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1fuZ8u-0007he-2s
for ; Tue, 28 Aug 2018 01:14:29 -0700
Received: from mf-smf-ucb026c3 (mf-smf-ucb026c3.ocn.ad.jp [153.153.66.168])
by mbkd0339.ocn.ad.jp (Postfix) with ESMTP id 45BBDF04DA1;
Tue, 28 Aug 2018 17:13:47 +0900 (JST)
Received: from ocn-vc-mts-101c1.ocn.ad.jp ([153.153.66.78])
by mf-smf-ucb026c3 with ESMTP
id uZ7OfV8Ai2pqNuZ8Ff0mcs; Tue, 28 Aug 2018 17:13:47 +0900
Received: from vcsiren.ocn.ne.jp ([153.149.227.166])
by ocn-vc-mts-101c1.ocn.ad.jp with ESMTP
id uZ7vfbtebEH5BuZ7vfkk4W; Tue, 28 Aug 2018 17:13:47 +0900
Message-ID: <[email protected]>
Received: from User (p18059-ipngnfx01morioka.iwate.ocn.ne.jp [153.142.9.59])
by vcsiren.ocn.ne.jp (Postfix) with SMTP;
Tue, 28 Aug 2018 17:13:27 +0900 (JST)
Reply-To: <[email protected]>
From: "MR. THOMAS STEVENSON"<[email protected]>
Date: Tue, 28 Aug 2018 01:13:53 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=19.3
X-Spam-Score: 193
X-Spam-Bar: +++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: From the Desk Of: Manager: MR. THOMAS STEVENSON, JP Morgan
Chase Bank New York U.S.A [...]

Content analysis details: (19.3 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[153.149.236.40 listed in zen.spamhaus.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[153.149.236.40 listed in bl.score.senderscore.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?153.149.236.40>]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(mrthomas1stevenson1[at]gmail.com)
1.0 MISSING_HEADERS Missing To: header
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
0.0 T_HK_NAME_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSPACED From: missing whitespace
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
2.9 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Waiting for your immediate response.

From the Desk Of:

Manager: MR. THOMAS STEVENSON,

JP Morgan Chase Bank New York U.S.A

270 Park Ave. New York City







This is to bring to your kind notice that your outstanding payment of $10,500,000.00
which has been with our central paying office from United Nations has been signed
and Approved for payment after series of meeting with our board of directors,also
bear in mind that We want to conclude all payment before the 2nd quarter of 2018
runs out for you to receive your Fund.





Therefore, to enable us achieve our goal to release your Fund to you, you are advice
to re-confirm to us the below information to enable conclude this transaction with
you.





Your Full Name:

Your Complete Address:

Direct Tele: Number:

Mobile Number:

Occupation

Nationality.

Credit Card information (if any)





Finally, Response Should be Made Immediately before it will be too late for you.







Waiting for your immediate response.





Thanks for your Co-operation.





Manager: MR. THOMAS STEVENSON,

JP Morgan Chase Bank New York U.S.A

270 Park Ave. New York City,

Office mail Address: [email protected]

Telephone +917 725 3388.