by buried under 419s
Fri Nov 20, 2020 9:09 am
Return-Path: <3uJG3Xw0JCr0pdfnd1pdufho4jpdlo.frpdedqqlvwhuvkrzerdwll.frp@trix.bounces.google.com>
Delivered-To:
Received: from
by with LMTP
id FlmuL+KRt1/5WwAAibB4EA
(envelope-from <3uJG3Xw0JCr0pdfnd1pdufho4jpdlo.frpdedqqlvwhuvkrzerdwll.frp@trix.bounces.google.com>)
for <>; Fri, 20 Nov 2020 09:52:34 +0000
Return-path: <3uJG3Xw0JCr0pdfnd1pdufho4jpdlo.frpdedqqlvwhuvkrzerdwll.frp@trix.bounces.google.com>
Envelope-to:
Delivery-date: Fri, 20 Nov 2020 09:52:34 +0000
Received: from mail-vk1-f197.google.com ([209.85.221.197]:47039)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <3uJG3Xw0JCr0pdfnd1pdufho4jpdlo.frpdedqqlvwhuvkrzerdwll.frp@trix.bounces.google.com>)
id 1kg35l-000672-RO
for ; Fri, 20 Nov 2020 09:52:34 +0000
Received: by mail-vk1-f197.google.com with SMTP id g3so3930822vkl.13
for <>; Fri, 20 Nov 2020 01:52:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:message-id:date:subject:from:to;
bh=mjiPNhW5vxR2JrEs13Wr7oqnMnn/BoxS5dWCw+cCLUw=;
b=T0iW8PqJoh1wBDaA3tv18rPK2Du8SVF6U2KMPDlftkouqdtEPxlv3rY/7RQ8d+P7Wi
TsgCeS8IZntNAi5FAONDs5pOPyJ53Ujv2dxUAKxpHfP0LAWj6xZ9rBB3xdILyyhrXAPM
nQ8c+5sOsmnbDQIxh8EyTBMiwwQPBIgc0oBnv81Dfb7dILk6REpd7mDhJYLDP9joloLJ
Xx6t64IU+MyCyLH8YZ5LC3RG3uFnYgt6wCGctOPSobHp6fTrDZd3Qpxyx0GZBDn5pYHC
ps33ZLMGZiWKg0d7XAtbhbMsPw5mKG8qWtPd3W/RaupBC6mXq771G/zCZvZw6NQawYp+
rubA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:message-id:date:subject
:from:to;
bh=mjiPNhW5vxR2JrEs13Wr7oqnMnn/BoxS5dWCw+cCLUw=;
b=R6JLKSszYuVV0KiX0txnVRuc2MV1+gJZ2sRyD+0c8L+WYsC+WXy51hRtW33cfxlHAp
V72mK9QUyBvMZLp6aZ8rxUlzHI2PofwNKogHQVgT4fEtERWtNDvug6Q1UdzIEQQ24jd9
1Rda7NTmMWpZGmQ/5EyvCmT6SH4E2rfLP3vKrGes6U/rcNhJZ4Nf8dOjzq66wi3ru0iT
g1l21EZah4hc2US5YPFp6Q2NmcZLTCa8dPlI3ZsdDqYCOs3t8GXQ0keUSkzvQwcWsfRP
YOQCy0M5lSr2n+XsRKthBZjCYMoLNkHCV3ka0j52Ff2yK2TpqHgXD7mGsKT43HKtOmhU
3Ikg==
X-Gm-Message-State: AOAM530GkCCCP76Cheevp9yJ0iSaaXCMnaTgiP+PGz363xnDs+sSaSFc
7bT2xrIPzqBOgGYYFjHzOo/XvTnl+27YX+Baq+Gr
MIME-Version: 1.0
X-Received: by 2002:a67:2ec1:: with SMTP id u184mt12845977vsu.9.1605865912274;
Fri, 20 Nov 2020 01:51:52 -0800 (PST)
Reply-To: [email protected]
X-No-Auto-Attachment: 1
Message-ID: <[email protected]>
Date: Fri, 20 Nov 2020 09:51:52 +0000
From: [email protected]
To:
Content-Type: multipart/alternative; boundary="00000000000049050105b486cb5d"
X-Spam-Status: Yes, score=7.7
X-Spam-Score: 77
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I've invited you to fill out the following form: Event RSVP
To fill it out, visit: https://docs.google.com/forms/d/e/1FAIp ... _form_link
Content analysis details: (7.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[mackaymarcel1[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[mackaymarcel1[at]gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** Your Funds
Dear Beneficiary
We have contacted You several time regards to the claim of your funds,
you should understand that we coming to closure of the 2020 financial fiscal year , you are advised to follow our instruction so that you
will have Your money released to you.
Furthermore, we did not ask you for any fees. Kindly read our mail carefully so that you do not bring complications into your fund
release process. We will clarify that our paying bank does not charge fees for account opening nor account activations. In line with this
practice as explained, they will set up your online account and your account will be activated, with your full amount lodged therein and
all these we did at NO COST whatsoever from you. You are advised to contact Mr.Andrew Smith,
Mr. Andrew Smith
Head of Unit European Union.
Email : [email protected]
They Transaction Authorization Code(TAC)/Fund Release Codes on your behalf as required by the Central Bank of Malaysia(Bank Negara)
regulatory guidelines, and the codes are issued by the Central Bank of Malaysia(Bank Negara) through our internal bank network, and will be
forwarded to you accordingly as soon as we obtain them.
Please reconfirm your details asap.
Awaiting Your Response
Thank You For Your Co operation.
Your Faithfully
Mr Larry Salaz
Event RSVP
Delivered-To:
Received: from
by with LMTP
id FlmuL+KRt1/5WwAAibB4EA
(envelope-from <3uJG3Xw0JCr0pdfnd1pdufho4jpdlo.frpdedqqlvwhuvkrzerdwll.frp@trix.bounces.google.com>)
for <>; Fri, 20 Nov 2020 09:52:34 +0000
Return-path: <3uJG3Xw0JCr0pdfnd1pdufho4jpdlo.frpdedqqlvwhuvkrzerdwll.frp@trix.bounces.google.com>
Envelope-to:
Delivery-date: Fri, 20 Nov 2020 09:52:34 +0000
Received: from mail-vk1-f197.google.com ([209.85.221.197]:47039)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <3uJG3Xw0JCr0pdfnd1pdufho4jpdlo.frpdedqqlvwhuvkrzerdwll.frp@trix.bounces.google.com>)
id 1kg35l-000672-RO
for ; Fri, 20 Nov 2020 09:52:34 +0000
Received: by mail-vk1-f197.google.com with SMTP id g3so3930822vkl.13
for <>; Fri, 20 Nov 2020 01:52:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:message-id:date:subject:from:to;
bh=mjiPNhW5vxR2JrEs13Wr7oqnMnn/BoxS5dWCw+cCLUw=;
b=T0iW8PqJoh1wBDaA3tv18rPK2Du8SVF6U2KMPDlftkouqdtEPxlv3rY/7RQ8d+P7Wi
TsgCeS8IZntNAi5FAONDs5pOPyJ53Ujv2dxUAKxpHfP0LAWj6xZ9rBB3xdILyyhrXAPM
nQ8c+5sOsmnbDQIxh8EyTBMiwwQPBIgc0oBnv81Dfb7dILk6REpd7mDhJYLDP9joloLJ
Xx6t64IU+MyCyLH8YZ5LC3RG3uFnYgt6wCGctOPSobHp6fTrDZd3Qpxyx0GZBDn5pYHC
ps33ZLMGZiWKg0d7XAtbhbMsPw5mKG8qWtPd3W/RaupBC6mXq771G/zCZvZw6NQawYp+
rubA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:message-id:date:subject
:from:to;
bh=mjiPNhW5vxR2JrEs13Wr7oqnMnn/BoxS5dWCw+cCLUw=;
b=R6JLKSszYuVV0KiX0txnVRuc2MV1+gJZ2sRyD+0c8L+WYsC+WXy51hRtW33cfxlHAp
V72mK9QUyBvMZLp6aZ8rxUlzHI2PofwNKogHQVgT4fEtERWtNDvug6Q1UdzIEQQ24jd9
1Rda7NTmMWpZGmQ/5EyvCmT6SH4E2rfLP3vKrGes6U/rcNhJZ4Nf8dOjzq66wi3ru0iT
g1l21EZah4hc2US5YPFp6Q2NmcZLTCa8dPlI3ZsdDqYCOs3t8GXQ0keUSkzvQwcWsfRP
YOQCy0M5lSr2n+XsRKthBZjCYMoLNkHCV3ka0j52Ff2yK2TpqHgXD7mGsKT43HKtOmhU
3Ikg==
X-Gm-Message-State: AOAM530GkCCCP76Cheevp9yJ0iSaaXCMnaTgiP+PGz363xnDs+sSaSFc
7bT2xrIPzqBOgGYYFjHzOo/XvTnl+27YX+Baq+Gr
MIME-Version: 1.0
X-Received: by 2002:a67:2ec1:: with SMTP id u184mt12845977vsu.9.1605865912274;
Fri, 20 Nov 2020 01:51:52 -0800 (PST)
Reply-To: [email protected]
X-No-Auto-Attachment: 1
Message-ID: <[email protected]>
Date: Fri, 20 Nov 2020 09:51:52 +0000
From: [email protected]
To:
Content-Type: multipart/alternative; boundary="00000000000049050105b486cb5d"
X-Spam-Status: Yes, score=7.7
X-Spam-Score: 77
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I've invited you to fill out the following form: Event RSVP
To fill it out, visit: https://docs.google.com/forms/d/e/1FAIp ... _form_link
Content analysis details: (7.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[mackaymarcel1[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[mackaymarcel1[at]gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject: ***SPAM*** Your Funds
Dear Beneficiary
We have contacted You several time regards to the claim of your funds,
you should understand that we coming to closure of the 2020 financial fiscal year , you are advised to follow our instruction so that you
will have Your money released to you.
Furthermore, we did not ask you for any fees. Kindly read our mail carefully so that you do not bring complications into your fund
release process. We will clarify that our paying bank does not charge fees for account opening nor account activations. In line with this
practice as explained, they will set up your online account and your account will be activated, with your full amount lodged therein and
all these we did at NO COST whatsoever from you. You are advised to contact Mr.Andrew Smith,
Mr. Andrew Smith
Head of Unit European Union.
Email : [email protected]
They Transaction Authorization Code(TAC)/Fund Release Codes on your behalf as required by the Central Bank of Malaysia(Bank Negara)
regulatory guidelines, and the codes are issued by the Central Bank of Malaysia(Bank Negara) through our internal bank network, and will be
forwarded to you accordingly as soon as we obtain them.
Please reconfirm your details asap.
Awaiting Your Response
Thank You For Your Co operation.
Your Faithfully
Mr Larry Salaz
Event RSVP
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces