by buried under 419s
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sun, 16 Apr 2017 16:02:30 -0700
Received: from rarusnn.ru ([95.79.44.10]:4694)
by with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.88)
(envelope-from <[email protected]>)
id 1cztBd-0007rp-9E
for ; Sun, 16 Apr 2017 16:02:30 -0700
Received: from User (Unknown [154.120.98.172])
by rarusnn.ru with ESMTPA
; Sun, 16 Apr 2017 21:11:05 +0400
Message-ID: <[email protected]>
Reply-To: <[email protected]>
From: "Deborah L. Hayes."<[email protected]>
Date: Sun, 16 Apr 2017 10:11:33 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 110323-1, 03/23/2011), Outbound message
X-Antivirus-Status: Clean
X-Spam-Status: Yes, score=31.9
X-Spam-Score: 319
X-Spam-Bar: +++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: From The Office of Senior Vice President of Corporate Affairs
United State of America Email.: [email protected] [...]
Content analysis details: (31.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(deborah.hayes4234[at]gmail.com)
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[95.79.44.10 listed in bb.barracudacentral.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[95.79.44.10 listed in psbl.surriel.com]
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[95.79.44.10 listed in bl.mailspike.net]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?95.79.44.10>]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.0 MISSING_HEADERS Missing To: header
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[95.79.44.10 listed in dnsbl.sorbs.net]
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** APPROVAL OF FUNDS RELEASE ORDER.(ACT FAST)!!
From The Office of Senior Vice President of Corporate Affairs
United State of America
Email.: [email protected]
Good day.
This is to inform you that the U.S Government collaborations with Federal Reserve
Bank International, Monetery Funds have instructed us to remit the sum of $2.5
Million US dollar into your account, the reason for this is because your name was
among the scam victims that lost a lot of money to African and European Fraudsters,
you are hereby advised to without delay stop all you have going on between you and
anybody on internet because you will end up at nothing, hence, there are two options
to receive your funds.
(1) By Bank to Bank Wire Transfer
(2) By Atm Card.
We are waiting your immediate response with your information to enable this bank
proceeds immediately with the transfer of your fund and serve you better.
Full Name....................
Home Address.................
Age/Occupation..............
Valid Phone number............
Your Country........
Any Of Your Identity Card........
Do not send money upfront fee to anyone from Europe or African again for what so
ever reason. This bank will immediately remit your account once I reconfirm your
banking details.
Congratulations.
Deborah L. Hayes
Envelope-to:
Delivery-date: Sun, 16 Apr 2017 16:02:30 -0700
Received: from rarusnn.ru ([95.79.44.10]:4694)
by with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.88)
(envelope-from <[email protected]>)
id 1cztBd-0007rp-9E
for ; Sun, 16 Apr 2017 16:02:30 -0700
Received: from User (Unknown [154.120.98.172])
by rarusnn.ru with ESMTPA
; Sun, 16 Apr 2017 21:11:05 +0400
Message-ID: <[email protected]>
Reply-To: <[email protected]>
From: "Deborah L. Hayes."<[email protected]>
Date: Sun, 16 Apr 2017 10:11:33 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 110323-1, 03/23/2011), Outbound message
X-Antivirus-Status: Clean
X-Spam-Status: Yes, score=31.9
X-Spam-Score: 319
X-Spam-Bar: +++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: From The Office of Senior Vice President of Corporate Affairs
United State of America Email.: [email protected] [...]
Content analysis details: (31.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(deborah.hayes4234[at]gmail.com)
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[95.79.44.10 listed in bb.barracudacentral.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[95.79.44.10 listed in psbl.surriel.com]
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[95.79.44.10 listed in bl.mailspike.net]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?95.79.44.10>]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.0 MISSING_HEADERS Missing To: header
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[95.79.44.10 listed in dnsbl.sorbs.net]
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** APPROVAL OF FUNDS RELEASE ORDER.(ACT FAST)!!
From The Office of Senior Vice President of Corporate Affairs
United State of America
Email.: [email protected]
Good day.
This is to inform you that the U.S Government collaborations with Federal Reserve
Bank International, Monetery Funds have instructed us to remit the sum of $2.5
Million US dollar into your account, the reason for this is because your name was
among the scam victims that lost a lot of money to African and European Fraudsters,
you are hereby advised to without delay stop all you have going on between you and
anybody on internet because you will end up at nothing, hence, there are two options
to receive your funds.
(1) By Bank to Bank Wire Transfer
(2) By Atm Card.
We are waiting your immediate response with your information to enable this bank
proceeds immediately with the transfer of your fund and serve you better.
Full Name....................
Home Address.................
Age/Occupation..............
Valid Phone number............
Your Country........
Any Of Your Identity Card........
Do not send money upfront fee to anyone from Europe or African again for what so
ever reason. This bank will immediately remit your account once I reconfirm your
banking details.
Congratulations.
Deborah L. Hayes
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
