by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id ANdtFT5C2VzgFwAAjbubUg
for <>; Mon, 13 May 2019 03:09:02 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 13 May 2019 03:09:02 -0700
Received: from mail1.netwide.co.za ([41.76.183.130]:55235)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hQ7tA-0001Zr-E4
for ; Mon, 13 May 2019 03:09:02 -0700
Received: from User ([41.76.180.90]) by netwide.co.za with MailEnable ESMTP; Mon, 13 May 2019 12:07:19 +0200
Reply-To: <[email protected]>
From: "Steven T. Mnuchin"<[email protected]>
Date: Mon, 13 May 2019 11:07:48 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <[email protected]>
X-Spam-Status: Yes, score=22.2
X-Spam-Score: 222
X-Spam-Bar: ++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: U.S. DEPARTMENT OF THE TREASURY Steven Terner Mnuchin 9000
Blue Mound Rd, Fort Worth, TX 76131, United States. Date: 05/13/2019. Attention:
Beneficiary, [...]
Content analysis details: (22.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.8 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[41.76.180.90 listed in zen.spamhaus.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?41.76.180.90>]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
trust
[41.76.183.130 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.6 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
2.0 MONEY_FROM_41 Lots of money from Africa
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** Your fund has been mapped out for seizure
U.S. DEPARTMENT OF THE TREASURY
Steven Terner Mnuchin
9000 Blue Mound Rd,
Fort Worth, TX 76131,
United States.
Date: 05/13/2019.
Attention: Beneficiary,
Your fund valued at $11.5 Million Dollars has been forwarded to the office of the
U.S Treasury for seizure. According to our investigation it shows that you have paid
lots of money trying to receive this fund and no longer comfortable which is the
reason you have decided to let go of your fund. It was further confirmed that you
have been sending money to wrong people who does not have access to your fund which
is the reason you are yet to receive this fund. With the power invested on me as the
Secretary to the U.S Treasury, I decided to contact you before taking any action. I
need your urgent confirmation if you still want to receive this fund or should we go
ahead with the seizure?
Kindly acknowledge the receipt of this email immediately.
Yours faithfully,
Steven T. Mnuchin
US Treasury Secretary.
Delivered-To:
Received: from
by with LMTP id ANdtFT5C2VzgFwAAjbubUg
for <>; Mon, 13 May 2019 03:09:02 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 13 May 2019 03:09:02 -0700
Received: from mail1.netwide.co.za ([41.76.183.130]:55235)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hQ7tA-0001Zr-E4
for ; Mon, 13 May 2019 03:09:02 -0700
Received: from User ([41.76.180.90]) by netwide.co.za with MailEnable ESMTP; Mon, 13 May 2019 12:07:19 +0200
Reply-To: <[email protected]>
From: "Steven T. Mnuchin"<[email protected]>
Date: Mon, 13 May 2019 11:07:48 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <[email protected]>
X-Spam-Status: Yes, score=22.2
X-Spam-Score: 222
X-Spam-Bar: ++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: U.S. DEPARTMENT OF THE TREASURY Steven Terner Mnuchin 9000
Blue Mound Rd, Fort Worth, TX 76131, United States. Date: 05/13/2019. Attention:
Beneficiary, [...]
Content analysis details: (22.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.8 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[41.76.180.90 listed in zen.spamhaus.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?41.76.180.90>]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
trust
[41.76.183.130 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.6 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
2.0 MONEY_FROM_41 Lots of money from Africa
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
X-Spam-Flag: YES
Subject: ***SPAM*** Your fund has been mapped out for seizure
U.S. DEPARTMENT OF THE TREASURY
Steven Terner Mnuchin
9000 Blue Mound Rd,
Fort Worth, TX 76131,
United States.
Date: 05/13/2019.
Attention: Beneficiary,
Your fund valued at $11.5 Million Dollars has been forwarded to the office of the
U.S Treasury for seizure. According to our investigation it shows that you have paid
lots of money trying to receive this fund and no longer comfortable which is the
reason you have decided to let go of your fund. It was further confirmed that you
have been sending money to wrong people who does not have access to your fund which
is the reason you are yet to receive this fund. With the power invested on me as the
Secretary to the U.S Treasury, I decided to contact you before taking any action. I
need your urgent confirmation if you still want to receive this fund or should we go
ahead with the seizure?
Kindly acknowledge the receipt of this email immediately.
Yours faithfully,
Steven T. Mnuchin
US Treasury Secretary.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
