by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id 6EvPGnHOfFrBFwAAjbubUg
for <>; Thu, 08 Feb 2018 14:25:53 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 08 Feb 2018 14:25:53 -0800
Received: from linxtek.ru ([91.121.121.21]:45787)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1ejudY-0001Zo-4b
for ; Thu, 08 Feb 2018 14:25:53 -0800
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=citi-moskva.ru; s=mail;
h=Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Date:Subject:From:Reply-To; bh=PFdQUwvBfXzU6fZOTxZF81S6BmuvCicCP4lsmFlVPH8=;
b=eLxvi/ypiYIVZpbpk6caET0J+dNb+Mi4sKRzDNVUSWZxbyN8PDDTTYwlz/AnAaxHFT6plEUfJxWVjMTTUJ3lWprDIk+qQVjsnJSBfDKnIEgr6igqq9uCq74C5KEBPnmN7P0HhJdGbgwHX6ZAXEyCtMEp7nJcd+6aIjYJxVGQbTI=;
Received: from [197.210.226.157] (helo=User)
by linxtek.ru with esmtpa (Exim 4.84_2)
(envelope-from <[email protected]>)
id 1ejucZ-0001PV-Dr; Fri, 09 Feb 2018 01:24:48 +0300
Reply-To: <[email protected]>
From: "Chief Inspection Agent"<[email protected]>
Date: Wed, 7 Feb 2018 23:25:03 -0600
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=23.3
X-Spam-Score: 233
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I am Ms Lucy Hunter, Chief Inspection Agent United Nations
USA, On routine investigation, I discovered this forfeited consignment with
your name on the bill of entry. On an extensive inspection the Value of the
cash stuffed consignment was not declared but assumed approximately $18.5Million
USD. [...]
Content analysis details: (23.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[197.210.226.157 listed in zen.spamhaus.org]
1.0 MISSING_HEADERS Missing To: header
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(keaokahuna_80[at]yahoo.com)
2.0 MILLION_USD BODY: Talks about millions of dollars
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.5 FAKE_REPLY_C No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** Re: ***** / You have a package Dear owner Funds /*****
The Consignment was forfeited because of false declaration by the Consignee and the
delivery officers' inability to pay the Non Inspection fee (NI). The Consignment was
originally declared as personal effect while the real content is cash money.
Call me on (612 255 8394) or email me now if you are still interested in receiving
your consignment boxes ( [email protected] ).
Regards,
Ms Lucy Hunter
Chief Inspection Agent
Delivered-To:
Received: from
by with LMTP id 6EvPGnHOfFrBFwAAjbubUg
for <>; Thu, 08 Feb 2018 14:25:53 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 08 Feb 2018 14:25:53 -0800
Received: from linxtek.ru ([91.121.121.21]:45787)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1ejudY-0001Zo-4b
for ; Thu, 08 Feb 2018 14:25:53 -0800
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=citi-moskva.ru; s=mail;
h=Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Date:Subject:From:Reply-To; bh=PFdQUwvBfXzU6fZOTxZF81S6BmuvCicCP4lsmFlVPH8=;
b=eLxvi/ypiYIVZpbpk6caET0J+dNb+Mi4sKRzDNVUSWZxbyN8PDDTTYwlz/AnAaxHFT6plEUfJxWVjMTTUJ3lWprDIk+qQVjsnJSBfDKnIEgr6igqq9uCq74C5KEBPnmN7P0HhJdGbgwHX6ZAXEyCtMEp7nJcd+6aIjYJxVGQbTI=;
Received: from [197.210.226.157] (helo=User)
by linxtek.ru with esmtpa (Exim 4.84_2)
(envelope-from <[email protected]>)
id 1ejucZ-0001PV-Dr; Fri, 09 Feb 2018 01:24:48 +0300
Reply-To: <[email protected]>
From: "Chief Inspection Agent"<[email protected]>
Date: Wed, 7 Feb 2018 23:25:03 -0600
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=23.3
X-Spam-Score: 233
X-Spam-Bar: +++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I am Ms Lucy Hunter, Chief Inspection Agent United Nations
USA, On routine investigation, I discovered this forfeited consignment with
your name on the bill of entry. On an extensive inspection the Value of the
cash stuffed consignment was not declared but assumed approximately $18.5Million
USD. [...]
Content analysis details: (23.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
0.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[197.210.226.157 listed in zen.spamhaus.org]
1.0 MISSING_HEADERS Missing To: header
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(keaokahuna_80[at]yahoo.com)
2.0 MILLION_USD BODY: Talks about millions of dollars
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
1.5 FAKE_REPLY_C No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** Re: ***** / You have a package Dear owner Funds /*****
The Consignment was forfeited because of false declaration by the Consignee and the
delivery officers' inability to pay the Non Inspection fee (NI). The Consignment was
originally declared as personal effect while the real content is cash money.
Call me on (612 255 8394) or email me now if you are still interested in receiving
your consignment boxes ( [email protected] ).
Regards,
Ms Lucy Hunter
Chief Inspection Agent
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
