by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id IOdID/TJfFojEgAAjbubUg
for <>; Thu, 08 Feb 2018 14:06:44 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 08 Feb 2018 14:06:44 -0800
Received: from linxtek.ru ([91.121.121.21]:51683)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1ejuL4-0001CP-4e
for ; Thu, 08 Feb 2018 14:06:44 -0800
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=citi-moskva.ru; s=mail;
h=Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Date:Subject:From:Reply-To; bh=yCxzzaejZqQqW4P8WXXXxjgRc+0PsAzj8Cs5snTXmVc=;
b=QKmKm0bAjhTlQ0S89BDFAPyn4PiF+5waR9yEri93MZjGUHg2/DAXomDLHrVYiaavD+IbfOGdhtU3f40gTxjH1pkFc4mx3qLDjCInqD0WPNaf5Y89axcb3iTtmtT0cVrRUsovIAooBTh+8dMwrbykKLl83TSUbIoWGTxX4KF9B00=;
Received: from [197.210.226.157] (helo=User)
by linxtek.ru with esmtpa (Exim 4.84_2)
(envelope-from <[email protected]>)
id 1ejuJv-00035q-SJ; Fri, 09 Feb 2018 01:05:32 +0300
Reply-To: <[email protected]>
From: "Head Officer-in-Charge Administrative Service Inspection Unit"<[email protected]>
Date: Wed, 7 Feb 2018 23:05:48 -0600
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=19.8
X-Spam-Score: 198
X-Spam-Bar: +++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear owner I am Mr. Dan Williams, Head Officer-in-Charge,
Texas. During our investigation, I discovered an abandoned shipment through
a Diplomat from Africa Union , which was transferred from London Heath-row
international Airport to our facility in us America , and when scanned it
revealed an undisclosed sum of money in 2 Metal Trunk Boxes weighing approximately
110kg. The consignment was abandoned because the Content was not properly
declared by the consignee as money rather it was declared as personal effect/classified
document to either avoid diversion by the Shipping Agent or confiscation
by the relevant authorities. [...]
Content analysis details: (19.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[197.210.226.157 listed in zen.spamhaus.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(legatwilldan1949[at]gmail.com)
1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
1.0 MISSING_HEADERS Missing To: header
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** Your Parcel is available near You for delivery
Dear owner
Consignments like I said are one metal trunk boxes weighing about 65kg each
(Internal dimension: W61 x H156 x D73 (cm) effective capacity: 680 L) Approximately.
It is now left for you to decide if you still need the consignment or allow us
repatriate it back to Africa (place of origin) as we were instructed.
As I did say again, the shipper abandoned it and ran away, most importantly because
he gave a false declaration, he could not pay for the yellow tag, he could not
secure a valid non inspection document(s), etc. I am ready to assist you in any way
I can for you to get back this packages provided you will also give me something out
of it (financial gratification). You can either come in person but their most be an
interrogation, or i will help you engage the services of a secure shipping/delivery
Company/agent that will provide the necessary security that is required to deliver
the package to your doorstep or the destination of your choice. I need all the
guarantee that I can get from you before I can get involved in this project. i am
rest assured that these may or may not affect my job if care is not taking.
Please Reply this email strictly at ( [email protected] ) or text on :(972)
750-3020
Mr. Dan Williams
Head Officer-in-Charge
Administrative Service Inspection Unit
Delivered-To:
Received: from
by with LMTP id IOdID/TJfFojEgAAjbubUg
for <>; Thu, 08 Feb 2018 14:06:44 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 08 Feb 2018 14:06:44 -0800
Received: from linxtek.ru ([91.121.121.21]:51683)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1ejuL4-0001CP-4e
for ; Thu, 08 Feb 2018 14:06:44 -0800
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=citi-moskva.ru; s=mail;
h=Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Date:Subject:From:Reply-To; bh=yCxzzaejZqQqW4P8WXXXxjgRc+0PsAzj8Cs5snTXmVc=;
b=QKmKm0bAjhTlQ0S89BDFAPyn4PiF+5waR9yEri93MZjGUHg2/DAXomDLHrVYiaavD+IbfOGdhtU3f40gTxjH1pkFc4mx3qLDjCInqD0WPNaf5Y89axcb3iTtmtT0cVrRUsovIAooBTh+8dMwrbykKLl83TSUbIoWGTxX4KF9B00=;
Received: from [197.210.226.157] (helo=User)
by linxtek.ru with esmtpa (Exim 4.84_2)
(envelope-from <[email protected]>)
id 1ejuJv-00035q-SJ; Fri, 09 Feb 2018 01:05:32 +0300
Reply-To: <[email protected]>
From: "Head Officer-in-Charge Administrative Service Inspection Unit"<[email protected]>
Date: Wed, 7 Feb 2018 23:05:48 -0600
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=19.8
X-Spam-Score: 198
X-Spam-Bar: +++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear owner I am Mr. Dan Williams, Head Officer-in-Charge,
Texas. During our investigation, I discovered an abandoned shipment through
a Diplomat from Africa Union , which was transferred from London Heath-row
international Airport to our facility in us America , and when scanned it
revealed an undisclosed sum of money in 2 Metal Trunk Boxes weighing approximately
110kg. The consignment was abandoned because the Content was not properly
declared by the consignee as money rather it was declared as personal effect/classified
document to either avoid diversion by the Shipping Agent or confiscation
by the relevant authorities. [...]
Content analysis details: (19.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[197.210.226.157 listed in zen.spamhaus.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(legatwilldan1949[at]gmail.com)
1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
1.0 MISSING_HEADERS Missing To: header
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** Your Parcel is available near You for delivery
Dear owner
Consignments like I said are one metal trunk boxes weighing about 65kg each
(Internal dimension: W61 x H156 x D73 (cm) effective capacity: 680 L) Approximately.
It is now left for you to decide if you still need the consignment or allow us
repatriate it back to Africa (place of origin) as we were instructed.
As I did say again, the shipper abandoned it and ran away, most importantly because
he gave a false declaration, he could not pay for the yellow tag, he could not
secure a valid non inspection document(s), etc. I am ready to assist you in any way
I can for you to get back this packages provided you will also give me something out
of it (financial gratification). You can either come in person but their most be an
interrogation, or i will help you engage the services of a secure shipping/delivery
Company/agent that will provide the necessary security that is required to deliver
the package to your doorstep or the destination of your choice. I need all the
guarantee that I can get from you before I can get involved in this project. i am
rest assured that these may or may not affect my job if care is not taking.
Please Reply this email strictly at ( [email protected] ) or text on :(972)
750-3020
Mr. Dan Williams
Head Officer-in-Charge
Administrative Service Inspection Unit
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
