by buried under 419s
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 15 Oct 2018 01:21:58 -0700
Received: from 153-149-172-206.vpcopennw.jp-e1.cloudn-service.com ([153.149.172.206]:49386 helo=mx1.ube-c.ac.jp)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1gBy8O-0004MR-Oq
for ; Mon, 15 Oct 2018 01:21:57 -0700
Received: from User (unknown [197.210.53.248])
by mx1.ube-c.ac.jp (Postfix) with ESMTPA id B74834004E7;
Mon, 15 Oct 2018 17:20:50 +0900 (JST)
Reply-To: <[email protected]>
From: "I.M.F OFFICE"<[email protected]>
Date: Mon, 15 Oct 2018 01:21:03 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=33.8
X-Spam-Score: 338
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: We are heartened to inform you that after we received the
approval for your payment release to you then there came a counter email from
Mr. Williams S. Brock who is claiming you are incapacitated due to an accident
you encountered and as a result he sent us a web-link as a proof that you
won't be able to claim the said payment Valued the sum of $1.950,000,00 and
thereby he is acting on your behalf to claim your money as Your Next Of Kin.
[...]
Content analysis details: (33.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.5 HK_SCAM_N2 BODY: No description available.
0.6 URG_BIZ BODY: Contains urgent matter
0.0 TVD_RCVD_IP Message was received from an IP address
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 MISSING_HEADERS Missing To: header
1.6 MISSING_MID Missing Message-Id: header
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.5 SUBJ_ATTENTION ATTENTION in Subject
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
5.0 KAM_FAKE_DELIVER Fake delivery notifications
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_DYNIP From misspaced + dynamic rDNS
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
2.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 MONEY_ATM_CARD Lots of money on an ATM card
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.2 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** ATTENTION PLEASE
We are heartened to inform you that after we received the approval for
your payment release to you then there came a counter email from Mr.
Williams S. Brock who is claiming you are incapacitated due to an
accident you encountered and as a result he sent us a web-link as a
proof that you won't be able to claim the said payment Valued the sum of
$1.950,000,00 and thereby he is acting on your behalf to claim your
money as Your Next Of Kin.
And in furtherance to claim the payment, he has sent us his full name
and address which is where he want us to Deliver The awarded Cash that
is already processed via ATM card/consignment/ Online Wire Transfer
being the mode of payment as approved by the Board award Ministers of
Finance. Below The address is the Information He sent To this office For
The Claim Of Your awarded Funds.
Name: Mr. Brock Visker Williams
Address: 2475 Arbor walk CT, Acworth Georgia 30101 USA
His email: < [email protected] >
According To Mr. Williams Brock he has promised To pay for the approval
fee which is the sum of $350 To make sure the delivery commence as soon
as possible, but To ensure transparency in our services to individuals,
therefore do us the favor to confirm immediately if this is the true
state of things that transpires between you and Mr. Williams S. Brock
else state otherwise You will not blame our office by transferring the
Money To Mr. William S. Brock.
Please we need Your urgent Reply To this Notification and Note that if
we didn't Hear from You in Next 48 Working Hours we will commence with
Mr. Williams Instruction and Give Him our Receiving information for him
To send the fee To commence with the delivery of the Funds, email us
now and let us know what is the problem with you.
Envelope-to:
Delivery-date: Mon, 15 Oct 2018 01:21:58 -0700
Received: from 153-149-172-206.vpcopennw.jp-e1.cloudn-service.com ([153.149.172.206]:49386 helo=mx1.ube-c.ac.jp)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1gBy8O-0004MR-Oq
for ; Mon, 15 Oct 2018 01:21:57 -0700
Received: from User (unknown [197.210.53.248])
by mx1.ube-c.ac.jp (Postfix) with ESMTPA id B74834004E7;
Mon, 15 Oct 2018 17:20:50 +0900 (JST)
Reply-To: <[email protected]>
From: "I.M.F OFFICE"<[email protected]>
Date: Mon, 15 Oct 2018 01:21:03 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=33.8
X-Spam-Score: 338
X-Spam-Bar: +++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: We are heartened to inform you that after we received the
approval for your payment release to you then there came a counter email from
Mr. Williams S. Brock who is claiming you are incapacitated due to an accident
you encountered and as a result he sent us a web-link as a proof that you
won't be able to claim the said payment Valued the sum of $1.950,000,00 and
thereby he is acting on your behalf to claim your money as Your Next Of Kin.
[...]
Content analysis details: (33.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.5 HK_SCAM_N2 BODY: No description available.
0.6 URG_BIZ BODY: Contains urgent matter
0.0 TVD_RCVD_IP Message was received from an IP address
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.0 MISSING_HEADERS Missing To: header
1.6 MISSING_MID Missing Message-Id: header
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.5 SUBJ_ATTENTION ATTENTION in Subject
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 LOTS_OF_MONEY Huge... sums of money
5.0 KAM_FAKE_DELIVER Fake delivery notifications
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_DYNIP From misspaced + dynamic rDNS
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
2.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 MONEY_ATM_CARD Lots of money on an ATM card
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.2 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** ATTENTION PLEASE
We are heartened to inform you that after we received the approval for
your payment release to you then there came a counter email from Mr.
Williams S. Brock who is claiming you are incapacitated due to an
accident you encountered and as a result he sent us a web-link as a
proof that you won't be able to claim the said payment Valued the sum of
$1.950,000,00 and thereby he is acting on your behalf to claim your
money as Your Next Of Kin.
And in furtherance to claim the payment, he has sent us his full name
and address which is where he want us to Deliver The awarded Cash that
is already processed via ATM card/consignment/ Online Wire Transfer
being the mode of payment as approved by the Board award Ministers of
Finance. Below The address is the Information He sent To this office For
The Claim Of Your awarded Funds.
Name: Mr. Brock Visker Williams
Address: 2475 Arbor walk CT, Acworth Georgia 30101 USA
His email: < [email protected] >
According To Mr. Williams Brock he has promised To pay for the approval
fee which is the sum of $350 To make sure the delivery commence as soon
as possible, but To ensure transparency in our services to individuals,
therefore do us the favor to confirm immediately if this is the true
state of things that transpires between you and Mr. Williams S. Brock
else state otherwise You will not blame our office by transferring the
Money To Mr. William S. Brock.
Please we need Your urgent Reply To this Notification and Note that if
we didn't Hear from You in Next 48 Working Hours we will commence with
Mr. Williams Instruction and Give Him our Receiving information for him
To send the fee To commence with the delivery of the Funds, email us
now and let us know what is the problem with you.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
