by buried under 419s
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 30 Jul 2018 08:47:00 -0700
Received: from ecs-117-78-44-171.compute.hwclouds-dns.com ([117.78.44.171]:50299 helo=myphc.com)
by with smtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1fkANr-0007el-TG
for ; Mon, 30 Jul 2018 08:47:00 -0700
Received: from User ([108.29.37.168])
(envelope-sender <[email protected]>)
by 192.168.0.64 with ESMTP
for <>; Mon, 30 Jul 2018 23:45:10 +0800
Reply-To: <[email protected]>
From: "Sgt.Johann Kristi"<[email protected]>
Date: Mon, 30 Jul 2018 11:45:07 -0400
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=26.3
X-Spam-Score: 263
X-Spam-Bar: ++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Hello, Pardon me for breaking into your privacy in this quest
for your kind assistance and cooperation. My name is Sgt.Johan Kristu,of
the US Army.I am presently serving in the Military at Camp Leatherneck Marine
in Helmand Province, Afghanistan.I lost my wife and only daughter during
the 9/11 incident. [...]
Content analysis details: (26.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[117.78.44.171 listed in bl.score.senderscore.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(kristijohann3[at]gmail.com)
1.0 MISSING_HEADERS Missing To: header
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(kristijohann[at]gmail.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_USER From misspaced, from "User"
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 MISSING_MID Missing Message-Id: header
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 FAKE_REPLY_C No description available.
0.0 FROM_MISSPACED From: missing whitespace
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
1.9 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
X-Spam-Flag: YES
Subject: ***SPAM*** Re:Information/Sgt.Johann Kristi
Hello,
Pardon me for breaking into your privacy in this quest for your kind assistance and
cooperation.
My name is Sgt.Johan Kristu,of the US Army.I am presently serving in the Military at
Camp Leatherneck Marine in Helmand Province, Afghanistan.I lost my wife and only
daughter during the 9/11 incident.
The United States Department of Defense, has just renewed deployment operations. I
have been listed in the batch announced by the Army authorities to move to Syria to
combat the ISIS terrorist group and I really need your help in assisting me receive
for safe keep a box containing Raw Gold and Valuable.
This valuables i acquired after a bombardment and raiding of the strong hold of the
Afghan Taliban.
I have a perfect means and method to bring in the box to you safely. I am ready and
willing to share the content on a 50/50 basis with you for your cooperation and
assistance.
I will be waiting for your response for further details.
Regards,
Sgt.Johann Kristi
Envelope-to:
Delivery-date: Mon, 30 Jul 2018 08:47:00 -0700
Received: from ecs-117-78-44-171.compute.hwclouds-dns.com ([117.78.44.171]:50299 helo=myphc.com)
by with smtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1fkANr-0007el-TG
for ; Mon, 30 Jul 2018 08:47:00 -0700
Received: from User ([108.29.37.168])
(envelope-sender <[email protected]>)
by 192.168.0.64 with ESMTP
for <>; Mon, 30 Jul 2018 23:45:10 +0800
Reply-To: <[email protected]>
From: "Sgt.Johann Kristi"<[email protected]>
Date: Mon, 30 Jul 2018 11:45:07 -0400
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=26.3
X-Spam-Score: 263
X-Spam-Bar: ++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Hello, Pardon me for breaking into your privacy in this quest
for your kind assistance and cooperation. My name is Sgt.Johan Kristu,of
the US Army.I am presently serving in the Military at Camp Leatherneck Marine
in Helmand Province, Afghanistan.I lost my wife and only daughter during
the 9/11 incident. [...]
Content analysis details: (26.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[117.78.44.171 listed in bl.score.senderscore.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(kristijohann3[at]gmail.com)
1.0 MISSING_HEADERS Missing To: header
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(kristijohann[at]gmail.com)
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSP_USER From misspaced, from "User"
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 MISSING_MID Missing Message-Id: header
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 FAKE_REPLY_C No description available.
0.0 FROM_MISSPACED From: missing whitespace
0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
1.9 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
X-Spam-Flag: YES
Subject: ***SPAM*** Re:Information/Sgt.Johann Kristi
Hello,
Pardon me for breaking into your privacy in this quest for your kind assistance and
cooperation.
My name is Sgt.Johan Kristu,of the US Army.I am presently serving in the Military at
Camp Leatherneck Marine in Helmand Province, Afghanistan.I lost my wife and only
daughter during the 9/11 incident.
The United States Department of Defense, has just renewed deployment operations. I
have been listed in the batch announced by the Army authorities to move to Syria to
combat the ISIS terrorist group and I really need your help in assisting me receive
for safe keep a box containing Raw Gold and Valuable.
This valuables i acquired after a bombardment and raiding of the strong hold of the
Afghan Taliban.
I have a perfect means and method to bring in the box to you safely. I am ready and
willing to share the content on a 50/50 basis with you for your cooperation and
assistance.
I will be waiting for your response for further details.
Regards,
Sgt.Johann Kristi
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
