by buried under 419s
Wed Dec 23, 2020 9:30 am
Return-path: <3kM_iXxcJAL8tkknhj.tkknhjn22222226Blrfnq.htr@trix.bounces.google.com>
Envelope-to:
Delivery-date: Wed, 23 Dec 2020 05:03:58 +0000
Received: from mail-qv1-f80.google.com ([209.85.219.80]:51462)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <3kM_iXxcJAL8tkknhj.tkknhjn22222226Blrfnq.htr@trix.bounces.google.com>)
id 1krwJZ-0003os-BM
for ; Wed, 23 Dec 2020 05:03:58 +0000
Received: by mail-qv1-f80.google.com with SMTP id i20so11817619qvk.18
for <>; Tue, 22 Dec 2020 21:03:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:message-id:date:subject:from:to;
bh=aRnHHv0Urn9qo4M3lS4o+Eg8eRob7Gbfh+qkEv2vUEQ=;
b=Dyk9uHt7Dzh3ztucvgHeIiwz2jRXBnVu3Q6mjEB+35ZHQl0DTA2RXYqb9suINF1NHk
Mvd/iz4TfWrCaRBVCQnO/zDUGjwBbVMyV5xxhigAKjyWC4Ex1BqeKPprEBHyAqMMdXDp
dpz3DdkjqDHS0uURAP7Hs4oB5MfCp47EWv4Hs/fJdKMFI3ZZhVeg1SREIpBtd8LChkfR
E5Q1tKZZiEOgji3C8HUkMIqSIk26sl8fhzZoAWuu3L20JOO1rbv2DmFWQKqcAxFBDLwe
GQjnT/h+309qPkFI4k/ufXIP4EizTRDMK+8TdLHSLXxK2gPBdrzznaVsL5WKXliZ5iEb
aREg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:message-id:date:subject
:from:to;
bh=aRnHHv0Urn9qo4M3lS4o+Eg8eRob7Gbfh+qkEv2vUEQ=;
b=HDK36BrDbtBx+DKgRxULVC3QJNAXT1uiKmorRa8Kw7wwnS+Ifo1cMkkVJGlPt9s4S7
LGQcgONoGHD4i4LPRNPXdAJ8Q4Az2iz4QA9pP3a/Y8XZtuqUE+X5yPJ4qHkWo8YpnuHQ
otNFiOMUi52YuxJH7STQJQxpvo0u/GAj4BALeFtFInRnUFxnO6wS4DPQtUcYOMhmD3OH
OoziFkb7fqw+iTKwdURnNJ+C2WwkI7oo+Es2I/Akmpqy1naMBiyVuLlcdH89mlya4dLH
CwO/p2XhloL/f+DDqXme35Njz+KJVi+bBWMt/Ar5mZClXWz7YbDRI3QcTty+Z+UL1vHo
PXbA==
X-Gm-Message-State: AOAM533CqZhtmE+yqjQvvqw1KyTGTAA8Kjhs34m/CyWltuxGZkMHHWsB
La+vLwMKWgvYISFvW5fXpY+dKjwqLLGGZheCBBNq
MIME-Version: 1.0
X-Received: by 2002:ac8:5750:: with SMTP id 16mt24917723qtx.305.1608699792168;
Tue, 22 Dec 2020 21:03:12 -0800 (PST)
Reply-To: [email protected]
X-No-Auto-Attachment: 1
Message-ID: <[email protected]>
Date: Wed, 23 Dec 2020 05:03:16 +0000
From: [email protected]
To:
Content-Type: multipart/alternative; boundary="000000000000eb71ef05b71a9b3b"
X-Spam-Status: Yes, score=18.1
X-Spam-Score: 181
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I've invited you to fill in the following form: Untitled form
To fill it in, visit: https://docs.google.com/forms/d/e/1FAIp ... _form_link
Content analysis details: (18.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel
letters
0.0 HK_RANDOM_FROM From username looks random
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[office.officeixxxxxxx16[at]gmail.com]
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[office.officeixxxxxxx16[at]gmail.com]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 LOTS_OF_MONEY Huge... sums of money
0.6 URG_BIZ Contains urgent matter
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
0.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
3.0 GOOGLE_DOC_SUSP Suspicious use of Google Docs
3.1 MONEY_FRAUD_5 Lots of money and many fraud phrases
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** NOTIFICATION
--000000000000eb71ef05b71a9b3b
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Attention: Beneficiary:
Dear Sir/Ms, Ref: FCPSXMUSGUK
RE-PAYMENT GAZETTE OF THE SHORTLISTED" COMPENSATION PAYMENT
NOTIFICATION" OF USD$3,700,000.00.
This is a compensation was authorized by the United Nation to all Victimized bonafide beneficiaries who executed contracts/inheritance,Lotteries funds which tour details was inclusive but before we can proceed further we need you to provide us with your details as stated below so we can verify with the details we have here on our database for confirmation.
Kindly reconfirm your details to us as stated below.
1.YOUR NAME:..................
2.YOUR FULL ADDRESS..........
3.YOUR MOBILE PHONE NUMBER:...........
4.FAX NUMBER:......
5.AGE...............
6.SEX:.......
7.YOUR OCCUPATION:........
Upon confirmation of this details and proper verification we will proceed further to release your funds to you without any delays or hitch.
We await your diligent and urgent response with confirmation.
Write us back on this Email:- [email protected]
Warm Regards,
Yours Sincerely,
Andrew Tweedie (Dr.).
Finance Department Director.
Envelope-to:
Delivery-date: Wed, 23 Dec 2020 05:03:58 +0000
Received: from mail-qv1-f80.google.com ([209.85.219.80]:51462)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <3kM_iXxcJAL8tkknhj.tkknhjn22222226Blrfnq.htr@trix.bounces.google.com>)
id 1krwJZ-0003os-BM
for ; Wed, 23 Dec 2020 05:03:58 +0000
Received: by mail-qv1-f80.google.com with SMTP id i20so11817619qvk.18
for <>; Tue, 22 Dec 2020 21:03:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:message-id:date:subject:from:to;
bh=aRnHHv0Urn9qo4M3lS4o+Eg8eRob7Gbfh+qkEv2vUEQ=;
b=Dyk9uHt7Dzh3ztucvgHeIiwz2jRXBnVu3Q6mjEB+35ZHQl0DTA2RXYqb9suINF1NHk
Mvd/iz4TfWrCaRBVCQnO/zDUGjwBbVMyV5xxhigAKjyWC4Ex1BqeKPprEBHyAqMMdXDp
dpz3DdkjqDHS0uURAP7Hs4oB5MfCp47EWv4Hs/fJdKMFI3ZZhVeg1SREIpBtd8LChkfR
E5Q1tKZZiEOgji3C8HUkMIqSIk26sl8fhzZoAWuu3L20JOO1rbv2DmFWQKqcAxFBDLwe
GQjnT/h+309qPkFI4k/ufXIP4EizTRDMK+8TdLHSLXxK2gPBdrzznaVsL5WKXliZ5iEb
aREg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:message-id:date:subject
:from:to;
bh=aRnHHv0Urn9qo4M3lS4o+Eg8eRob7Gbfh+qkEv2vUEQ=;
b=HDK36BrDbtBx+DKgRxULVC3QJNAXT1uiKmorRa8Kw7wwnS+Ifo1cMkkVJGlPt9s4S7
LGQcgONoGHD4i4LPRNPXdAJ8Q4Az2iz4QA9pP3a/Y8XZtuqUE+X5yPJ4qHkWo8YpnuHQ
otNFiOMUi52YuxJH7STQJQxpvo0u/GAj4BALeFtFInRnUFxnO6wS4DPQtUcYOMhmD3OH
OoziFkb7fqw+iTKwdURnNJ+C2WwkI7oo+Es2I/Akmpqy1naMBiyVuLlcdH89mlya4dLH
CwO/p2XhloL/f+DDqXme35Njz+KJVi+bBWMt/Ar5mZClXWz7YbDRI3QcTty+Z+UL1vHo
PXbA==
X-Gm-Message-State: AOAM533CqZhtmE+yqjQvvqw1KyTGTAA8Kjhs34m/CyWltuxGZkMHHWsB
La+vLwMKWgvYISFvW5fXpY+dKjwqLLGGZheCBBNq
MIME-Version: 1.0
X-Received: by 2002:ac8:5750:: with SMTP id 16mt24917723qtx.305.1608699792168;
Tue, 22 Dec 2020 21:03:12 -0800 (PST)
Reply-To: [email protected]
X-No-Auto-Attachment: 1
Message-ID: <[email protected]>
Date: Wed, 23 Dec 2020 05:03:16 +0000
From: [email protected]
To:
Content-Type: multipart/alternative; boundary="000000000000eb71ef05b71a9b3b"
X-Spam-Status: Yes, score=18.1
X-Spam-Score: 181
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I've invited you to fill in the following form: Untitled form
To fill it in, visit: https://docs.google.com/forms/d/e/1FAIp ... _form_link
Content analysis details: (18.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel
letters
0.0 HK_RANDOM_FROM From username looks random
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[office.officeixxxxxxx16[at]gmail.com]
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[office.officeixxxxxxx16[at]gmail.com]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 LOTS_OF_MONEY Huge... sums of money
0.6 URG_BIZ Contains urgent matter
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
0.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
3.0 GOOGLE_DOC_SUSP Suspicious use of Google Docs
3.1 MONEY_FRAUD_5 Lots of money and many fraud phrases
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** NOTIFICATION
--000000000000eb71ef05b71a9b3b
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Attention: Beneficiary:
Dear Sir/Ms, Ref: FCPSXMUSGUK
RE-PAYMENT GAZETTE OF THE SHORTLISTED" COMPENSATION PAYMENT
NOTIFICATION" OF USD$3,700,000.00.
This is a compensation was authorized by the United Nation to all Victimized bonafide beneficiaries who executed contracts/inheritance,Lotteries funds which tour details was inclusive but before we can proceed further we need you to provide us with your details as stated below so we can verify with the details we have here on our database for confirmation.
Kindly reconfirm your details to us as stated below.
1.YOUR NAME:..................
2.YOUR FULL ADDRESS..........
3.YOUR MOBILE PHONE NUMBER:...........
4.FAX NUMBER:......
5.AGE...............
6.SEX:.......
7.YOUR OCCUPATION:........
Upon confirmation of this details and proper verification we will proceed further to release your funds to you without any delays or hitch.
We await your diligent and urgent response with confirmation.
Write us back on this Email:- [email protected]
Warm Regards,
Yours Sincerely,
Andrew Tweedie (Dr.).
Finance Department Director.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces