by buried under 419s
Delivered-To:
Received: from
by with LMTP id mI2fOqcSAFtGDQAAjbubUg
for <>; Sat, 19 May 2018 05:03:51 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 19 May 2018 05:03:51 -0700
Received: from [103.82.242.83] (port=52978 helo=server.kisaran.online)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fK0aR-0000sB-3M
for ; Sat, 19 May 2018 05:03:51 -0700
Received: from User (unknown [185.81.128.79])
by server.kisaran.online (Postfix) with ESMTPA id D8B62C1F1;
Sat, 19 May 2018 15:22:33 +0800 (+08)
Reply-To: <[email protected]>
From: "MR. THOMAS STEVENSON"<[email protected]>
To: [email protected]
Date: Fri, 18 May 2018 22:22:55 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=33.3
X-Spam-Score: 333
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: From The Desk Of: MR. THOMAS STEVENSON. From Bank of America
USA Attn: The Beneficiary, [...]
Content analysis details: (33.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
-0.6 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[103.82.242.83 listed in wl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(mrthomas1stevenson1[at]gmail.com)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mrtstefsdgsds[at]outlook.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.6 MISSING_MID Missing Message-Id: header
0.0 HK_NAME_FM_MR_MRS No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_USER From misspaced, from "User"
2.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.6 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
3.4 MONEY_FRAUD_8 Lots of money and very many fraud phrases
2.5 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
3.6 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.6 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** We are hereby officially notify you concerning your fund telegraphic Transfer through our bank.
From The Desk Of: MR. THOMAS STEVENSON.
From Bank of America USA
Attn: The Beneficiary,
TELEGRAPHIC TRANSFER NOTICE.
We are hereby officially notify you concerning your fund telegraphic Transfer
through our bank, Bank of America, New York, to your bank account, which has been
officially approved by the management of World Bank Swiss (WEBS) to credit the sum
of US$10.5 Million into your bank
account.
Note that I have started processing your payment and every thing concerning the
immediate remittance of your funds will be carried out within the shortest possible
time from the time we received your? Below needed information.
Also be informed that the Governor of Bank in London (BL) will sign on your payment
advice and a copy of the advice will be sent to the World Bank in Swiss for some
record purposes. Meanwhile your information and your full contact details were
received from our research manager, Barr.Paul Peterson on your behalf to FR for
immediate release of your fund.
This fund was part of the lodged Late President Saddam Hussein of Iraq discovery
fund with World Bank of Switzerland, which the Swiss Bank has decided to distribute
it generously to help few lucky individuals and the American Government is in
agreement with the Swiss Bank to distribute the fund to 700 hundred thousand people
in America, Europe & Asia in other to help improve their businesses.
Therefore, reconfirm the aforesaid information accurately, because this office
cannot afford to be held liable for any wrong transfer of funds or liable of any
fund credited into an unknown account.
These are the information we needed to be reconfirmed by you.
1.Your Full Bank Account Details
2.Your Direct Cell or office phone to reach you
3.Your address of locations
4.Your full name
Finally, you are required to reconfirm directly to me the above information to
enable me use it to process your bill of payment. Your quick response shall be
mostly appreciated; all your response should be directed through our alternative
email address for the immediate attention of the credit control department.
Yours Faithfully,
MR. THOMAS STEVENSON.
Vice Chairman, Director, Credit /Telex Department.
Email: [email protected]
Telephone: +917 725 3388.
Received: from
by with LMTP id mI2fOqcSAFtGDQAAjbubUg
for <>; Sat, 19 May 2018 05:03:51 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 19 May 2018 05:03:51 -0700
Received: from [103.82.242.83] (port=52978 helo=server.kisaran.online)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1fK0aR-0000sB-3M
for ; Sat, 19 May 2018 05:03:51 -0700
Received: from User (unknown [185.81.128.79])
by server.kisaran.online (Postfix) with ESMTPA id D8B62C1F1;
Sat, 19 May 2018 15:22:33 +0800 (+08)
Reply-To: <[email protected]>
From: "MR. THOMAS STEVENSON"<[email protected]>
To: [email protected]
Date: Fri, 18 May 2018 22:22:55 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=33.3
X-Spam-Score: 333
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: From The Desk Of: MR. THOMAS STEVENSON. From Bank of America
USA Attn: The Beneficiary, [...]
Content analysis details: (33.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
-0.6 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[103.82.242.83 listed in wl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(mrthomas1stevenson1[at]gmail.com)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mrtstefsdgsds[at]outlook.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
1.6 MISSING_MID Missing Message-Id: header
0.0 HK_NAME_FM_MR_MRS No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_USER From misspaced, from "User"
2.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.6 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
3.4 MONEY_FRAUD_8 Lots of money and very many fraud phrases
2.5 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
3.6 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.6 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** We are hereby officially notify you concerning your fund telegraphic Transfer through our bank.
From The Desk Of: MR. THOMAS STEVENSON.
From Bank of America USA
Attn: The Beneficiary,
TELEGRAPHIC TRANSFER NOTICE.
We are hereby officially notify you concerning your fund telegraphic Transfer
through our bank, Bank of America, New York, to your bank account, which has been
officially approved by the management of World Bank Swiss (WEBS) to credit the sum
of US$10.5 Million into your bank
account.
Note that I have started processing your payment and every thing concerning the
immediate remittance of your funds will be carried out within the shortest possible
time from the time we received your? Below needed information.
Also be informed that the Governor of Bank in London (BL) will sign on your payment
advice and a copy of the advice will be sent to the World Bank in Swiss for some
record purposes. Meanwhile your information and your full contact details were
received from our research manager, Barr.Paul Peterson on your behalf to FR for
immediate release of your fund.
This fund was part of the lodged Late President Saddam Hussein of Iraq discovery
fund with World Bank of Switzerland, which the Swiss Bank has decided to distribute
it generously to help few lucky individuals and the American Government is in
agreement with the Swiss Bank to distribute the fund to 700 hundred thousand people
in America, Europe & Asia in other to help improve their businesses.
Therefore, reconfirm the aforesaid information accurately, because this office
cannot afford to be held liable for any wrong transfer of funds or liable of any
fund credited into an unknown account.
These are the information we needed to be reconfirmed by you.
1.Your Full Bank Account Details
2.Your Direct Cell or office phone to reach you
3.Your address of locations
4.Your full name
Finally, you are required to reconfirm directly to me the above information to
enable me use it to process your bill of payment. Your quick response shall be
mostly appreciated; all your response should be directed through our alternative
email address for the immediate attention of the credit control department.
Yours Faithfully,
MR. THOMAS STEVENSON.
Vice Chairman, Director, Credit /Telex Department.
Email: [email protected]
Telephone: +917 725 3388.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
