by buried under 419s
Return-Path: <3NoyyXx4JAB0BGM7KG3EK7O7GN7.L7KOB57NL3VTUb9F3BE.5HF@trix.bounces.google.com>
Delivered-To:
Received: from
by with LMTP
id rD5VHGCMsl/JPgAAibB4EA
(envelope-from <3NoyyXx4JAB0BGM7KG3EK7O7GN7.L7KOB57NL3VTUb9F3BE.5HF@trix.bounces.google.com>)
for <>; Mon, 16 Nov 2020 14:27:44 +0000
Return-path: <3NoyyXx4JAB0BGM7KG3EK7O7GN7.L7KOB57NL3VTUb9F3BE.5HF@trix.bounces.google.com>
Envelope-to:
Delivery-date: Mon, 16 Nov 2020 14:27:44 +0000
Received: from mail-qv1-f71.google.com ([209.85.219.71]:44448)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <3NoyyXx4JAB0BGM7KG3EK7O7GN7.L7KOB57NL3VTUb9F3BE.5HF@trix.bounces.google.com>)
id 1kefTr-0004AQ-Fw
for ; Mon, 16 Nov 2020 14:27:44 +0000
Received: by mail-qv1-f71.google.com with SMTP id v1so7596336qvf.11
for <>; Mon, 16 Nov 2020 06:27:23 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:message-id
subject:from:to;
bh=uGgjRcVwNRL12UcIzBeQu7SFQTtSEtXCZVOMSOzRBZ0=;
b=TADkblcmH6ibuFWU3xvzYFEYgoIMsV1ywI6f2CLC63IDYHiWvBHnvE6JxbW90R/6no
PmmGROli6L14dYXVAcpCsxAr3RDxHTjda/DVmDe+CGOqoL4z2vgez/92RF3D4aVoBKu8
PVx5F9kaKq5oCSfAIH1GS1EU1L5XvMyelBPH8V0jGyPp9ho/IUoM/SfccBEocVb+ApHs
QhyJNvYXN6iVA5rQrhymCCyu6O/gZ6hR16UfAjrkMocclzSFveYYJk4X3W0l4dSL5mDA
1UifpFoESztLHZ7rxkYuShEmP0iQo262CJvxTAm6TdR/Zkaa1YpLpbxrsSQOGsRmEYrH
J+bA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:message-idsubject
:from:to;
bh=uGgjRcVwNRL12UcIzBeQu7SFQTtSEtXCZVOMSOzRBZ0=;
b=jXTzotSIGocqs5hG/iGPIgEGV3zKGRWSrK4C+jejdCdeCLQsf0ovIX/KE5nifxBMMj
9uzxIv46/QL7wzksWqgTQKWXGwI96MkigoLFgScJZUGH9nNT3X2yhaNElQXo8v45PV3b
uI1Ja52S8T7kycG9j1vFx9jrG6ZRsRzOx8Yuuk+Rxm1/NcMAhXzGyiZ1nGWhKTfBRdsQ
Ab4iDsi41yTm4jSNbzePNLVffu3Bxm7JkHxwIiYNYinsY9yhgUVckTb+CxxWe96WeSMu
3dFnaz8vkJEDviV3IaeClRQ8n8Cwg4k6ZsGTpLfSEW4qfW450HBJpiWtaQJ4WjYduYS/
a36Q==
X-Gm-Message-State: AOAM532FI8N2Do6RPGADlNRwDkxJhn8ssXQwCWbZKH1+qz/urC2uNrP9
PwGZ+1Setnkgd3PYd3Fo5xinzRcfUtB1WkHz6gpO
MIME-Version: 1.0
X-Received: by 2002:aed
: with SMTP id m60mt4717780qte.286.1605536822067;
Mon, 16 Nov 2020 06:27:02 -0800 (PST)
Reply-To: [email protected]
X-No-Auto-Attachment: 1
Message-ID: <[email protected]>
Date: Mon, 16 Nov 2020 14:27:02 +0000
From: [email protected]
To:
Content-Type: multipart/alternative; boundary="000000000000fd80c405b43a2bf2"
X-Spam-Status: Yes, score=12.5
X-Spam-Score: 125
X-Spam-Bar: ++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I've invited you to fill in the following form: Untitled form
To fill it in, visit: https://docs.google.com/forms/d/e/1FAIp ... _form_link
Content analysis details: (12.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[internalrevenue.serviceusa2018[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.5 SUBJ_ALL_CAPS Subject is all capitals
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[internalrevenue.serviceusa2018[at]gmail.com]
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
1.8 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.5 GOOGLE_DOC_SUSP Suspicious use of Google Docs
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** RE-GOOD NEWS
From The Desk of: Mr.Lewis Jerome,
Credit/Telex Department,
First State Bank,
12/B13 Kingston Drive,
New York.
PAYMENT NOTICE OF YOUR OUTSTANDING US$10.5MILLION
Based on bilateral agreement reached between the American President and some foreign debtor nations who owe huge amounts of funds to our citizens and foreigners alike, which has brought untold financial difficulties to these individuals, succor and reprieve have been brought their way as the First State Bank New York has been vested with the authority to immediately ensure that these individual beneficiaries are paid their fund as quickly as possible.
From the files made available to this office, your name is contained among those beneficiaries who have outstanding claims which has for years been unpaid. We believe the financial hardship this undue delay has brought to you and family including your business can better be imagined than real and we want to assure you that we will not delay in effecting the immediate release of your fund once we receive a confirmation from you.
At the point of carrying out the release of the fund, we received a letter from Mr. Robert Redding from Florida requesting the release of the fund to the account below;
ACCOUNT NUMBER 257668-09-100145
KOOKMIN BANK (kb bank),
5TH FL.KOOKLMIN BANKBLDG.
84 NAMDAEMUN-RO JUNG-GU
SEOUL, SOUTH KOREA
ACCOUNT NAME: MING ZOEN LEE
Did you authorize him to submit the account on your behalf as claimed? Do confirm to us immediately as First State Bank wants to be very careful in order to avoid payment to a wrong account. We are making this confirmation because we have a responsibility to protect our customers.
If you did not authorize this action of Mr. Robert, we hereby advise that in your own very best interest, you should forthwith stop any further communication with any person(s) regarding your fund payment to avoid criminal diversion of your fund that might result from you divulging very useful information to bad elements and thereby jeopardize your payment.
In view of the development, payment will be Via online account to avoid loss of fund. The online account guarantees that you manage the account and direct transactions from your base. To facilitate this, you are directed to forward to us immediately a passport photo of you as well as a copy of your Personal ID for the account opening. Once opened, your fund will be lodged in the account.
The only obligation required from you is $550 account opening processing charge. The account opening charge is NOT deductible from source. So if you are able, willing and ready to comply with this directive, you should revert to us with the requirements for the account opening otherwise we will NOT entertain unnecessary waste of work time arguing over our official guidelines and procedure.
Your immediate reply is being awaited as all protocol for the immediate payment of the $10.5Million has been finalized before Mr. Redding came with the change of account.
Treat as very important and urgent.
Regards,
J. Lewis
First State Bank
New York.
Delivered-To:
Received: from
by with LMTP
id rD5VHGCMsl/JPgAAibB4EA
(envelope-from <3NoyyXx4JAB0BGM7KG3EK7O7GN7.L7KOB57NL3VTUb9F3BE.5HF@trix.bounces.google.com>)
for <>; Mon, 16 Nov 2020 14:27:44 +0000
Return-path: <3NoyyXx4JAB0BGM7KG3EK7O7GN7.L7KOB57NL3VTUb9F3BE.5HF@trix.bounces.google.com>
Envelope-to:
Delivery-date: Mon, 16 Nov 2020 14:27:44 +0000
Received: from mail-qv1-f71.google.com ([209.85.219.71]:44448)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <3NoyyXx4JAB0BGM7KG3EK7O7GN7.L7KOB57NL3VTUb9F3BE.5HF@trix.bounces.google.com>)
id 1kefTr-0004AQ-Fw
for ; Mon, 16 Nov 2020 14:27:44 +0000
Received: by mail-qv1-f71.google.com with SMTP id v1so7596336qvf.11
for <>; Mon, 16 Nov 2020 06:27:23 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:message-id
subject:from:to;bh=uGgjRcVwNRL12UcIzBeQu7SFQTtSEtXCZVOMSOzRBZ0=;
b=TADkblcmH6ibuFWU3xvzYFEYgoIMsV1ywI6f2CLC63IDYHiWvBHnvE6JxbW90R/6no
PmmGROli6L14dYXVAcpCsxAr3RDxHTjda/DVmDe+CGOqoL4z2vgez/92RF3D4aVoBKu8
PVx5F9kaKq5oCSfAIH1GS1EU1L5XvMyelBPH8V0jGyPp9ho/IUoM/SfccBEocVb+ApHs
QhyJNvYXN6iVA5rQrhymCCyu6O/gZ6hR16UfAjrkMocclzSFveYYJk4X3W0l4dSL5mDA
1UifpFoESztLHZ7rxkYuShEmP0iQo262CJvxTAm6TdR/Zkaa1YpLpbxrsSQOGsRmEYrH
J+bA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:message-id
subject:from:to;
bh=uGgjRcVwNRL12UcIzBeQu7SFQTtSEtXCZVOMSOzRBZ0=;
b=jXTzotSIGocqs5hG/iGPIgEGV3zKGRWSrK4C+jejdCdeCLQsf0ovIX/KE5nifxBMMj
9uzxIv46/QL7wzksWqgTQKWXGwI96MkigoLFgScJZUGH9nNT3X2yhaNElQXo8v45PV3b
uI1Ja52S8T7kycG9j1vFx9jrG6ZRsRzOx8Yuuk+Rxm1/NcMAhXzGyiZ1nGWhKTfBRdsQ
Ab4iDsi41yTm4jSNbzePNLVffu3Bxm7JkHxwIiYNYinsY9yhgUVckTb+CxxWe96WeSMu
3dFnaz8vkJEDviV3IaeClRQ8n8Cwg4k6ZsGTpLfSEW4qfW450HBJpiWtaQJ4WjYduYS/
a36Q==
X-Gm-Message-State: AOAM532FI8N2Do6RPGADlNRwDkxJhn8ssXQwCWbZKH1+qz/urC2uNrP9
PwGZ+1Setnkgd3PYd3Fo5xinzRcfUtB1WkHz6gpO
MIME-Version: 1.0
X-Received: by 2002:aed
: with SMTP id m60mt4717780qte.286.1605536822067;Mon, 16 Nov 2020 06:27:02 -0800 (PST)
Reply-To: [email protected]
X-No-Auto-Attachment: 1
Message-ID: <[email protected]>
Date: Mon, 16 Nov 2020 14:27:02 +0000
From: [email protected]
To:
Content-Type: multipart/alternative; boundary="000000000000fd80c405b43a2bf2"
X-Spam-Status: Yes, score=12.5
X-Spam-Score: 125
X-Spam-Bar: ++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I've invited you to fill in the following form: Untitled form
To fill it in, visit: https://docs.google.com/forms/d/e/1FAIp ... _form_link
Content analysis details: (12.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[internalrevenue.serviceusa2018[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.5 SUBJ_ALL_CAPS Subject is all capitals
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[internalrevenue.serviceusa2018[at]gmail.com]
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
1.8 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.5 GOOGLE_DOC_SUSP Suspicious use of Google Docs
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** RE-GOOD NEWS
From The Desk of: Mr.Lewis Jerome,
Credit/Telex Department,
First State Bank,
12/B13 Kingston Drive,
New York.
PAYMENT NOTICE OF YOUR OUTSTANDING US$10.5MILLION
Based on bilateral agreement reached between the American President and some foreign debtor nations who owe huge amounts of funds to our citizens and foreigners alike, which has brought untold financial difficulties to these individuals, succor and reprieve have been brought their way as the First State Bank New York has been vested with the authority to immediately ensure that these individual beneficiaries are paid their fund as quickly as possible.
From the files made available to this office, your name is contained among those beneficiaries who have outstanding claims which has for years been unpaid. We believe the financial hardship this undue delay has brought to you and family including your business can better be imagined than real and we want to assure you that we will not delay in effecting the immediate release of your fund once we receive a confirmation from you.
At the point of carrying out the release of the fund, we received a letter from Mr. Robert Redding from Florida requesting the release of the fund to the account below;
ACCOUNT NUMBER 257668-09-100145
KOOKMIN BANK (kb bank),
5TH FL.KOOKLMIN BANKBLDG.
84 NAMDAEMUN-RO JUNG-GU
SEOUL, SOUTH KOREA
ACCOUNT NAME: MING ZOEN LEE
Did you authorize him to submit the account on your behalf as claimed? Do confirm to us immediately as First State Bank wants to be very careful in order to avoid payment to a wrong account. We are making this confirmation because we have a responsibility to protect our customers.
If you did not authorize this action of Mr. Robert, we hereby advise that in your own very best interest, you should forthwith stop any further communication with any person(s) regarding your fund payment to avoid criminal diversion of your fund that might result from you divulging very useful information to bad elements and thereby jeopardize your payment.
In view of the development, payment will be Via online account to avoid loss of fund. The online account guarantees that you manage the account and direct transactions from your base. To facilitate this, you are directed to forward to us immediately a passport photo of you as well as a copy of your Personal ID for the account opening. Once opened, your fund will be lodged in the account.
The only obligation required from you is $550 account opening processing charge. The account opening charge is NOT deductible from source. So if you are able, willing and ready to comply with this directive, you should revert to us with the requirements for the account opening otherwise we will NOT entertain unnecessary waste of work time arguing over our official guidelines and procedure.
Your immediate reply is being awaited as all protocol for the immediate payment of the $10.5Million has been finalized before Mr. Redding came with the change of account.
Treat as very important and urgent.
Regards,
J. Lewis
First State Bank
New York.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
