by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id INFeBd9rhVp6BQAAjbubUg
for <>; Thu, 15 Feb 2018 03:15:43 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 15 Feb 2018 03:15:43 -0800
Received: from smtp3.hiworks.co.kr ([121.254.168.205]:57488)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1emHVs-0000MH-W4
for ; Thu, 15 Feb 2018 03:15:42 -0800
Received: (qmail 122866 invoked from network); 15 Feb 2018 20:14:57 +0900
Received: from unknown (HELO hiworks.co.kr) (192.168.10.219)
by 0 (qmail 1.03 + ejcp v14) with SMTP;
15 Feb 2018 20:14:57 +0900
Received: (qmail 11968 invoked by uid 504); 15 Feb 2018 20:14:58 +0900
Received: from unknown (HELO User) ([email protected]@185.81.128.79)
by 0 (qmail 1.03 + ejcp v14) with SMTP;
15 Feb 2018 20:14:58 +0900
X-Authinfo: HIWORKS SMTP authenticated <[email protected]>
Reply-To: <[email protected]>
From: "Mr. Luis Hans"<[email protected]>
To: [email protected]
Date: Thu, 15 Feb 2018 01:14:57 -0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=31.8
X-Spam-Score: 318
X-Spam-Bar: +++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attention Beneficiary, This is to inform you that your name
was luckily selected among the 17 lucky winners who won the sum of $ 1.750,000
.00 United State Dollars on Facebook online promotional program held on the
10th January, to begin your claims send your Reference Number, Full Name,
Contact Address and Mobile Number to Facebook Payment Consultant, Mr. Luis
Hans, Tel/Fax: +905398645819. E-Mail: [email protected] for
processing and remittance of your winning prize. [...]
Content analysis details: (31.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.1 DEAR_BENEFICIARY BODY: Dear Beneficiary:
3.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[121.254.168.205 listed in list.dnswl.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?185.81.128.79>]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mrluhdsgsdshande[at]msn.com)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(hansconsultant1000[at]hotmail.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.5 KAM_LOTTO1 Likely to be an e-Lotto Scam Email
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.6 MISSING_MID Missing Message-Id: header
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.3 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
1.8 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.6 MONEY_FORM Lots of money if you fill out a form
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
2.9 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money
2.5 MONEY_FRAUD_5 Lots of money and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Congratulations!!!
Attention Beneficiary,
This is to inform you that your name was luckily selected among the 17 lucky winners
who won the sum of $ 1.750,000 .00 United State Dollars on Facebook online
promotional program held on the 10th January, to begin your claims send your
Reference Number, Full Name, Contact Address and Mobile Number to Facebook Payment
Consultant, Mr. Luis Hans, Tel/Fax: +905398645819. E-Mail:
[email protected] for processing and remittance of your winning prize.
REFERENCE NUMBER: CV2016FB3
BATCH NUMBER: OTK /5468/2018
Contact: Mr. Luis Hans
Tel/Fax : +905398645819.
E-Mail: [email protected]
Delivered-To:
Received: from
by with LMTP id INFeBd9rhVp6BQAAjbubUg
for <>; Thu, 15 Feb 2018 03:15:43 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 15 Feb 2018 03:15:43 -0800
Received: from smtp3.hiworks.co.kr ([121.254.168.205]:57488)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1emHVs-0000MH-W4
for ; Thu, 15 Feb 2018 03:15:42 -0800
Received: (qmail 122866 invoked from network); 15 Feb 2018 20:14:57 +0900
Received: from unknown (HELO hiworks.co.kr) (192.168.10.219)
by 0 (qmail 1.03 + ejcp v14) with SMTP;
15 Feb 2018 20:14:57 +0900
Received: (qmail 11968 invoked by uid 504); 15 Feb 2018 20:14:58 +0900
Received: from unknown (HELO User) ([email protected]@185.81.128.79)
by 0 (qmail 1.03 + ejcp v14) with SMTP;
15 Feb 2018 20:14:58 +0900
X-Authinfo: HIWORKS SMTP authenticated <[email protected]>
Reply-To: <[email protected]>
From: "Mr. Luis Hans"<[email protected]>
To: [email protected]
Date: Thu, 15 Feb 2018 01:14:57 -0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=31.8
X-Spam-Score: 318
X-Spam-Bar: +++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Attention Beneficiary, This is to inform you that your name
was luckily selected among the 17 lucky winners who won the sum of $ 1.750,000
.00 United State Dollars on Facebook online promotional program held on the
10th January, to begin your claims send your Reference Number, Full Name,
Contact Address and Mobile Number to Facebook Payment Consultant, Mr. Luis
Hans, Tel/Fax: +905398645819. E-Mail: [email protected] for
processing and remittance of your winning prize. [...]
Content analysis details: (31.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
3.1 DEAR_BENEFICIARY BODY: Dear Beneficiary:
3.1 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[121.254.168.205 listed in list.dnswl.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?185.81.128.79>]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mrluhdsgsdshande[at]msn.com)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(hansconsultant1000[at]hotmail.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.5 KAM_LOTTO1 Likely to be an e-Lotto Scam Email
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.6 MISSING_MID Missing Message-Id: header
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.3 FROM_MISSP_REPLYTO From misspaced, has Reply-To
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
1.8 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.6 MONEY_FORM Lots of money if you fill out a form
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
2.9 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money
2.5 MONEY_FRAUD_5 Lots of money and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Congratulations!!!
Attention Beneficiary,
This is to inform you that your name was luckily selected among the 17 lucky winners
who won the sum of $ 1.750,000 .00 United State Dollars on Facebook online
promotional program held on the 10th January, to begin your claims send your
Reference Number, Full Name, Contact Address and Mobile Number to Facebook Payment
Consultant, Mr. Luis Hans, Tel/Fax: +905398645819. E-Mail:
[email protected] for processing and remittance of your winning prize.
REFERENCE NUMBER: CV2016FB3
BATCH NUMBER: OTK /5468/2018
Contact: Mr. Luis Hans
Tel/Fax : +905398645819.
E-Mail: [email protected]
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
