by buried under 419s
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 14 Dec 2017 11:14:16 -0800
Received: from mail.onlime.ru ([77.37.255.50]:65205 helo=mail.ip.ncnet.ru)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1ePYxR-0003Ru-FG
for ; Thu, 14 Dec 2017 11:14:16 -0800
Received: from [77.37.221.86] (HELO User)
by mail.ip.ncnet.ru (CommuniGate Pro SMTP 5.2.12)
with SMTP id 206764911; Thu, 14 Dec 2017 23:52:14 +0400
Reply-To: <[email protected]>
From: "Mr. Smith Rogers Lester"<[email protected]>
Date: Thu, 14 Dec 2017 11:13:13 -0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <[email protected]>
X-Spam-Status: Yes, score=31.6
X-Spam-Score: 316
X-Spam-Bar: +++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: INSTRUCTION TO RELEASE YOUR OVERDUE FUND We are contacting
you in-respect of your overdue compensation fund totaling the sum of $ 4.5
million Dollars in our vault as authorized by the International Monitory
Fund (IMF) headquarters to immediately make a transfer to your safe account
. [...]
Content analysis details: (31.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.6 NSL_RCVD_HELO_USER Received from HELO User
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[77.37.255.50 listed in bb.barracudacentral.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[77.37.255.50 listed in wl.mailspike.net]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
1.0 MISSING_HEADERS Missing To: header
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(lestersmith276[at]gmail.com)
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 T_HK_NAME_MR_MRS No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
1.5 FAKE_REPLY_C No description available.
2.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.1 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.6 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.2 FORM_FRAUD_3 Fill a form and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** RE:INSTRUCTION TO RELEASE YOUR OVERDUE FUND
INSTRUCTION TO RELEASE YOUR OVERDUE FUND
We are contacting you in-respect of your overdue compensation fund totaling the sum
of $ 4.5 million Dollars in our vault as authorized by the International Monitory
Fund (IMF) headquarters to immediately make a transfer to your safe account .
It was also discovered that you made several attempt in the past to get this fund
released to you but all to no avail. Therefore you are strictly advise to desist
from further contact / communication with any other individual or persons outside
this department to avoid any form of delays or complication towards the immediate
released of your fund to you in this last quarter of the year to you and for you to
have this fund released is not far-fetched.
All you need do is to re-confirm your full details to us immediately for review and
onward processing of your fund for payment.
(1) Full Name and Address
(2) Age and Occupation
(3)Telephone number
Upon the receipt of all this information from you, we shall immediately process your
fund Payment to you without delays as instructed by our apex bank.
Awaiting your swift correspondence.
Mr. Smith Rogers Lester
Telephone: TEL: +233-23-854-2217
EMAIL: [email protected]
Envelope-to:
Delivery-date: Thu, 14 Dec 2017 11:14:16 -0800
Received: from mail.onlime.ru ([77.37.255.50]:65205 helo=mail.ip.ncnet.ru)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1ePYxR-0003Ru-FG
for ; Thu, 14 Dec 2017 11:14:16 -0800
Received: from [77.37.221.86] (HELO User)
by mail.ip.ncnet.ru (CommuniGate Pro SMTP 5.2.12)
with SMTP id 206764911; Thu, 14 Dec 2017 23:52:14 +0400
Reply-To: <[email protected]>
From: "Mr. Smith Rogers Lester"<[email protected]>
Date: Thu, 14 Dec 2017 11:13:13 -0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <[email protected]>
X-Spam-Status: Yes, score=31.6
X-Spam-Score: 316
X-Spam-Bar: +++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: INSTRUCTION TO RELEASE YOUR OVERDUE FUND We are contacting
you in-respect of your overdue compensation fund totaling the sum of $ 4.5
million Dollars in our vault as authorized by the International Monitory
Fund (IMF) headquarters to immediately make a transfer to your safe account
. [...]
Content analysis details: (31.6 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.6 NSL_RCVD_HELO_USER Received from HELO User
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[77.37.255.50 listed in bb.barracudacentral.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[77.37.255.50 listed in wl.mailspike.net]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
1.0 MISSING_HEADERS Missing To: header
1.5 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(lestersmith276[at]gmail.com)
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 T_HK_NAME_MR_MRS No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
1.5 FAKE_REPLY_C No description available.
2.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.1 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.6 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.2 FORM_FRAUD_3 Fill a form and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** RE:INSTRUCTION TO RELEASE YOUR OVERDUE FUND
INSTRUCTION TO RELEASE YOUR OVERDUE FUND
We are contacting you in-respect of your overdue compensation fund totaling the sum
of $ 4.5 million Dollars in our vault as authorized by the International Monitory
Fund (IMF) headquarters to immediately make a transfer to your safe account .
It was also discovered that you made several attempt in the past to get this fund
released to you but all to no avail. Therefore you are strictly advise to desist
from further contact / communication with any other individual or persons outside
this department to avoid any form of delays or complication towards the immediate
released of your fund to you in this last quarter of the year to you and for you to
have this fund released is not far-fetched.
All you need do is to re-confirm your full details to us immediately for review and
onward processing of your fund for payment.
(1) Full Name and Address
(2) Age and Occupation
(3)Telephone number
Upon the receipt of all this information from you, we shall immediately process your
fund Payment to you without delays as instructed by our apex bank.
Awaiting your swift correspondence.
Mr. Smith Rogers Lester
Telephone: TEL: +233-23-854-2217
EMAIL: [email protected]
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
