by buried under 419s
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id uBfxFkRy9VwtegAAjbubUg
for <>; Mon, 03 Jun 2019 12:17:24 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 03 Jun 2019 12:17:24 -0700
Received: from sonic305-20.consmr.mail.sg3.yahoo.com ([106.10.241.83]:38533)
by with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hXsSN-00087Y-Lh
for ; Mon, 03 Jun 2019 12:17:24 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1559589397; bh=5m+B7ZUZeacGsDyM/hiN3iPKoAI42WffTM8kFkVNINA=; h=Date:From:Reply-To:Subject:References:From:Subject; b=Cf4u92aauhMkgg9JvRqEk2KA4m48T5PI4SlQ3g9csqjrvJAt0Ckh1/mOVvRoYGkX21qheQaZfY/rA+wQ1hOhO9qugGWkArBPd/XG44MeXD29QDDhDdXMDlTukszexzhWV9AW1I/rTP+Y0pOdExV5RynjZTaqDHqjY7IYvoaA6VpSEoY44yK7F/J7wBOpB1EfCPjyYA5Z7rT+7GMpD/F3xFj8su0FY2dN++KcW1LguD/vWQZLCB2m5SG33OoynHKuD4cgSAydTqSH3Wvtsp9H8pHFUaA/+afY43gcIaxaE/s4q66aO2BhwphVvvoCoJqdd3zGuAMQFmvT8ehGgQDXeg==
X-YMail-OSG: N8kA4EgVM1mYOtFDY3v8A5i3wfxRmYNYJYhSNHnqutz7hnVaKSOisN_5IWuwx2b
vD.DI46HgrW3W01oZ6E6g0Zw.cXM92lxldot1t22hbEw9LXXBjveDYvpz0xltUZUqqslPGtGDnzl
yrWqFCBIYAdRRFD4Nn0j0AR2j4mzk6lOoiq2fj0tZGXSCuipFkDDIRdyZ8pB.KJtDEDutf.hOvgS
roLcB8KryJvumSGD_iHIHJU64A8Ad8cmVXoT1T2IUR_vqX3XlcJ4NOiJ08OhDBj5.iuWYeKMOX66
QoBJMBlmMgjmvlNm1hHjyUWErfvAQHHti.e98ZjWAavBhgH95cr2Se5Ot02GG.jFCF9kQt7zOGpJ
U.ZaVhd6hzJ.QBdjL8v4gigWmPRCVD6a3F.dQbegX0GnbkAvyeO.oDBryTNHDaJBF_YTgraXa72P
gdo9rLjjSsll_hLIYpTQ358GPrAGJij9kD8cnWPWSHhKohBDQsu_4jm0RKdgfciwnSA8kFE59Wga
jYnAOmUMHVoAM5alv41KRvk3vsGiXPQtXcmy.0qBVLk9cz0OveLWcmpN9iCphBEjvgdPxUb8KK2B
_gLCJGivE2hBNiRX9FPFjU0_lo612tzVLRapXh4._4pQRlmMFLU5PN22Oo.qpoltZR5gF.s1hjaf
EAciTuLZLT30g_JTBqL1qELYfc92R2vH._I.GGfevQrEhk7hQQsfSCrTiryoBhFq.25BCxwAZ_9a
7k.Vt3KuLoa42gASZHINcWaUCZQ60C4_COECcMzrsKZkdrBGOsBGkGpV.2Ew4nsN96lLFUxBlkDf
sr__0IUjBdfWZb9vhM7At0wB.W9Eb_kTrKXZBNqKkJO56yNBSKhSQVazy8_0AJ1oZFMZYmoBREyj
J8cB1kT0YuKyZV02ryUudZtGlUzi4vVk7bZkQqNBky53etJgWbTXKM1RYv3zewPhk7IEYV7GtQRK
_BTaT3OX_cprf5fRenLUT3uHUbYrRw.JL6fRdc_F9_XCxzOAzTfwVnWIcRJZImlGdNoQzFUhoh_r
OLIoYyM.8gUamf9iSc5z_Dlzg3U0k5Brw17Jp_7tbN9bBpceT6SEDFcaEE3jF.vM8HhDsCosuHkp
V.asfYvlWg0I7DIoSWnSuvviQbX0oQhBPP_31Yz3oTA9ubTk0ZZu428XJ.6vKJk3_BALkp7daV4Z
gv9dPfKnJYh3.qpIHWwIbBdbCHLgkyMzid2UJImIeR4foLRfNirokVHxTYo_8bju_eE8EVN74hR8
BSUgZG9OyW86oYtln7pRhz8BXqGJkqTjOJLzdJBT3ahutQdcCp5_yBgLK7QUJfe57iUczXeEh6g.
VlcAX90zwdvK_ypjZ0wUcEldD6QT_5yc7RnNXXHTxe4n7lIgcfhvjTfCg_pss_jVf0pDoH92fBXC
M.wu5XYG3UTpeSO_k3X7WzTuFCZnTbTnGmxcdxYf1Oyawneuc9ujKP0oRpKgrdabkmidanveJZ1p
WRLFmRT4-
Received: from sonic.gate.mail.ne1.yahoo.com by sonic305.consmr.mail.sg3.yahoo.com with HTTP; Mon, 3 Jun 2019 19:16:37 +0000
Date: Mon, 3 Jun 2019 19:16:36 +0000 (UTC)
From: MoneyGram Transfer <[email protected]>
Reply-To: MoneyGram Transfer <[email protected]>
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_2913600_1500476461.1559589396188"
References: <[email protected]>
X-Mailer: WebService/1.1.13634 YMailNorrin Mozilla/5.0 (Windows NT 6.1; rv:67.0) Gecko/20100101 Firefox/67.0
Content-Length: 25634
X-Spam-Status: Yes, score=13.2
X-Spam-Score: 132
X-Spam-Bar: +++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: MONEY GRAM MONEY TRANSFER . ATTENTION BENEFICIARY WE THE MONEY
GRAM REMITTING OFFICE, HERE TO LET YOU TO KNOW THAT WE HAVE SENT YOUR FULL
COMPENSATION PAYMENT OF $2,500.000.00, TO YOU THROUGH MONEY GRAM, YOU WILL
BE RECEIVING $15.000.00 PER DAY, NOW WE HAVE SEND THE FIRST PAYMENT TO YOU.
[...]
Content analysis details: (13.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(fbiinvestigationz[at]yahoo.com)
1.0 MISSING_HEADERS Missing To: header
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.3 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[106.10.241.83 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
trust
[106.10.241.83 listed in list.dnswl.org]
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
X-Spam-Flag: YES
Subject: ***SPAM*** MONEY GRAM TRANSFER NOTIFICATION
MONEY GRAM MONEY TRANSFER .
ATTENTION BENEFICIARY
WE THE MONEY GRAM REMITTING OFFICE, HERE TO LET YOU TO KNOW THAT WE HAVE SENT YOUR
FULL COMPENSATION PAYMENT OF $2,500.000.00, TO YOU THROUGH MONEY GRAM, YOU WILL BE
RECEIVING $15.000.00 PER DAY, NOW WE HAVE SEND THE FIRST PAYMENT TO YOU.
SO CONTACT OUR DIRECTOR MR FRED MICHAEL AND ASK HIM TO GIVE YOU THE MONEY GRAM
PAYMENT INFORMATION SO YOU WILL PICK UP YOUR FUNDS THROUGH MONEY GRAM WITHOUT ANY
PROBLEM.
EMAIL ADDRESS TO CONTACT
( [email protected] )
PHONE NUMBER +1 602-552-8689,
CONTACT HIM WITH YOUR FULL INFORMATION FOR CONFIRMATION IS YOU.
YOUR NAME:....
COUNTRY:......
PHONE NO:.....
ADDRESS:......
CITY:.........
AGE:..........
SEX:..........
CALL OR SMS OR EMAIL HIM NOW SO THAT HE CAN PROVIDE THE MONEY GRAM INFORMATION TO
YOU AS SOON AS YOU POSSIBLE.
YOURS SINCERELY
MR. GILBERT EDWARD
Delivered-To:
Received: from
by with LMTP id uBfxFkRy9VwtegAAjbubUg
for <>; Mon, 03 Jun 2019 12:17:24 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 03 Jun 2019 12:17:24 -0700
Received: from sonic305-20.consmr.mail.sg3.yahoo.com ([106.10.241.83]:38533)
by with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1hXsSN-00087Y-Lh
for ; Mon, 03 Jun 2019 12:17:24 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1559589397; bh=5m+B7ZUZeacGsDyM/hiN3iPKoAI42WffTM8kFkVNINA=; h=Date:From:Reply-To:Subject:References:From:Subject; b=Cf4u92aauhMkgg9JvRqEk2KA4m48T5PI4SlQ3g9csqjrvJAt0Ckh1/mOVvRoYGkX21qheQaZfY/rA+wQ1hOhO9qugGWkArBPd/XG44MeXD29QDDhDdXMDlTukszexzhWV9AW1I/rTP+Y0pOdExV5RynjZTaqDHqjY7IYvoaA6VpSEoY44yK7F/J7wBOpB1EfCPjyYA5Z7rT+7GMpD/F3xFj8su0FY2dN++KcW1LguD/vWQZLCB2m5SG33OoynHKuD4cgSAydTqSH3Wvtsp9H8pHFUaA/+afY43gcIaxaE/s4q66aO2BhwphVvvoCoJqdd3zGuAMQFmvT8ehGgQDXeg==
X-YMail-OSG: N8kA4EgVM1mYOtFDY3v8A5i3wfxRmYNYJYhSNHnqutz7hnVaKSOisN_5IWuwx2b
vD.DI46HgrW3W01oZ6E6g0Zw.cXM92lxldot1t22hbEw9LXXBjveDYvpz0xltUZUqqslPGtGDnzl
yrWqFCBIYAdRRFD4Nn0j0AR2j4mzk6lOoiq2fj0tZGXSCuipFkDDIRdyZ8pB.KJtDEDutf.hOvgS
roLcB8KryJvumSGD_iHIHJU64A8Ad8cmVXoT1T2IUR_vqX3XlcJ4NOiJ08OhDBj5.iuWYeKMOX66
QoBJMBlmMgjmvlNm1hHjyUWErfvAQHHti.e98ZjWAavBhgH95cr2Se5Ot02GG.jFCF9kQt7zOGpJ
U.ZaVhd6hzJ.QBdjL8v4gigWmPRCVD6a3F.dQbegX0GnbkAvyeO.oDBryTNHDaJBF_YTgraXa72P
gdo9rLjjSsll_hLIYpTQ358GPrAGJij9kD8cnWPWSHhKohBDQsu_4jm0RKdgfciwnSA8kFE59Wga
jYnAOmUMHVoAM5alv41KRvk3vsGiXPQtXcmy.0qBVLk9cz0OveLWcmpN9iCphBEjvgdPxUb8KK2B
_gLCJGivE2hBNiRX9FPFjU0_lo612tzVLRapXh4._4pQRlmMFLU5PN22Oo.qpoltZR5gF.s1hjaf
EAciTuLZLT30g_JTBqL1qELYfc92R2vH._I.GGfevQrEhk7hQQsfSCrTiryoBhFq.25BCxwAZ_9a
7k.Vt3KuLoa42gASZHINcWaUCZQ60C4_COECcMzrsKZkdrBGOsBGkGpV.2Ew4nsN96lLFUxBlkDf
sr__0IUjBdfWZb9vhM7At0wB.W9Eb_kTrKXZBNqKkJO56yNBSKhSQVazy8_0AJ1oZFMZYmoBREyj
J8cB1kT0YuKyZV02ryUudZtGlUzi4vVk7bZkQqNBky53etJgWbTXKM1RYv3zewPhk7IEYV7GtQRK
_BTaT3OX_cprf5fRenLUT3uHUbYrRw.JL6fRdc_F9_XCxzOAzTfwVnWIcRJZImlGdNoQzFUhoh_r
OLIoYyM.8gUamf9iSc5z_Dlzg3U0k5Brw17Jp_7tbN9bBpceT6SEDFcaEE3jF.vM8HhDsCosuHkp
V.asfYvlWg0I7DIoSWnSuvviQbX0oQhBPP_31Yz3oTA9ubTk0ZZu428XJ.6vKJk3_BALkp7daV4Z
gv9dPfKnJYh3.qpIHWwIbBdbCHLgkyMzid2UJImIeR4foLRfNirokVHxTYo_8bju_eE8EVN74hR8
BSUgZG9OyW86oYtln7pRhz8BXqGJkqTjOJLzdJBT3ahutQdcCp5_yBgLK7QUJfe57iUczXeEh6g.
VlcAX90zwdvK_ypjZ0wUcEldD6QT_5yc7RnNXXHTxe4n7lIgcfhvjTfCg_pss_jVf0pDoH92fBXC
M.wu5XYG3UTpeSO_k3X7WzTuFCZnTbTnGmxcdxYf1Oyawneuc9ujKP0oRpKgrdabkmidanveJZ1p
WRLFmRT4-
Received: from sonic.gate.mail.ne1.yahoo.com by sonic305.consmr.mail.sg3.yahoo.com with HTTP; Mon, 3 Jun 2019 19:16:37 +0000
Date: Mon, 3 Jun 2019 19:16:36 +0000 (UTC)
From: MoneyGram Transfer <[email protected]>
Reply-To: MoneyGram Transfer <[email protected]>
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_2913600_1500476461.1559589396188"
References: <[email protected]>
X-Mailer: WebService/1.1.13634 YMailNorrin Mozilla/5.0 (Windows NT 6.1; rv:67.0) Gecko/20100101 Firefox/67.0
Content-Length: 25634
X-Spam-Status: Yes, score=13.2
X-Spam-Score: 132
X-Spam-Bar: +++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: MONEY GRAM MONEY TRANSFER . ATTENTION BENEFICIARY WE THE MONEY
GRAM REMITTING OFFICE, HERE TO LET YOU TO KNOW THAT WE HAVE SENT YOUR FULL
COMPENSATION PAYMENT OF $2,500.000.00, TO YOU THROUGH MONEY GRAM, YOU WILL
BE RECEIVING $15.000.00 PER DAY, NOW WE HAVE SEND THE FIRST PAYMENT TO YOU.
[...]
Content analysis details: (13.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(fbiinvestigationz[at]yahoo.com)
1.0 MISSING_HEADERS Missing To: header
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.3 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[106.10.241.83 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
trust
[106.10.241.83 listed in list.dnswl.org]
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
X-Spam-Flag: YES
Subject: ***SPAM*** MONEY GRAM TRANSFER NOTIFICATION
MONEY GRAM MONEY TRANSFER .
ATTENTION BENEFICIARY
WE THE MONEY GRAM REMITTING OFFICE, HERE TO LET YOU TO KNOW THAT WE HAVE SENT YOUR
FULL COMPENSATION PAYMENT OF $2,500.000.00, TO YOU THROUGH MONEY GRAM, YOU WILL BE
RECEIVING $15.000.00 PER DAY, NOW WE HAVE SEND THE FIRST PAYMENT TO YOU.
SO CONTACT OUR DIRECTOR MR FRED MICHAEL AND ASK HIM TO GIVE YOU THE MONEY GRAM
PAYMENT INFORMATION SO YOU WILL PICK UP YOUR FUNDS THROUGH MONEY GRAM WITHOUT ANY
PROBLEM.
EMAIL ADDRESS TO CONTACT
( [email protected] )
PHONE NUMBER +1 602-552-8689,
CONTACT HIM WITH YOUR FULL INFORMATION FOR CONFIRMATION IS YOU.
YOUR NAME:....
COUNTRY:......
PHONE NO:.....
ADDRESS:......
CITY:.........
AGE:..........
SEX:..........
CALL OR SMS OR EMAIL HIM NOW SO THAT HE CAN PROVIDE THE MONEY GRAM INFORMATION TO
YOU AS SOON AS YOU POSSIBLE.
YOURS SINCERELY
MR. GILBERT EDWARD
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
