by buried under 419s
Sat Jul 27, 2013 7:29 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 27 Jul 2013 15:07:08 -0700
Received: from [81.169.137.156] (port=57627 helo=h1836512.stratoserver.net)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1V3Cdl-0003kJ-DU
for ; Sat, 27 Jul 2013 15:07:08 -0700
Received: by h1836512.stratoserver.net (Postfix, from userid 33)
id D6646C3CB1; Sun, 28 Jul 2013 00:05:41 +0200 (CEST)
Received: from 5.104.105.85 ([5.104.105.85]) by webmail.muellers-web.com
(Horde Framework) with HTTP; Sun, 28 Jul 2013 00:05:40 +0200
Message-ID: <[email protected]>
Date: Sun, 28 Jul 2013 00:05:40 +0200
From: "Mr. Louis Charles Gass." <[email protected]>
Reply-to: [email protected]
To: undisclosed-recipients:;
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-1;
DelSp="Yes";
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
User-Agent: Internet Messaging Program (IMP) H3 (4.3.11)
X-Spam-Status: Yes, score=14.9
X-Spam-Score: 149
X-Spam-Bar: ++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Attention Customer: We have officially received your $19.500.000
fund release Authorisation approval letter from the united nation office.
Meanwhile, you should forward to us your receiving bank account details to
enable us transfer your fund into your bank account without any further delay.
[...]
Content analysis details: (14.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(charleslouisga[at]seznam.cz)
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[81.169.137.156 listed in bb.barracudacentral.org]
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
1.8 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4988]
0.0 LOTS_OF_MONEY Huge... sums of money
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_HK_NAME_FM_MR_MRS T_HK_NAME_FM_MR_MRS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
3.4 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.4 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Re: From Mr. Louis Charles Gass.
Attention Customer:
We have officially received your $19.500.000 fund release=A0
Authorisation approval letter
from the united nation office.
Meanwhile, you should forward to us your receiving bank account details to
enable us transfer your fund into your bank account without any further del=
ay.
once i get your information as started above i would send you an
attachment of my united nation official
identity card, my States driver?s license, my States
international
passport and Your Payment Authorisation Letter from UN.
I look forward hearing from you,
Yours Faithfully
Mr. Louis Charles Gass.
Assistant Auditor general
Fund Payment & Auditing Unit
Envelope-to:
Delivery-date: Sat, 27 Jul 2013 15:07:08 -0700
Received: from [81.169.137.156] (port=57627 helo=h1836512.stratoserver.net)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1V3Cdl-0003kJ-DU
for ; Sat, 27 Jul 2013 15:07:08 -0700
Received: by h1836512.stratoserver.net (Postfix, from userid 33)
id D6646C3CB1; Sun, 28 Jul 2013 00:05:41 +0200 (CEST)
Received: from 5.104.105.85 ([5.104.105.85]) by webmail.muellers-web.com
(Horde Framework) with HTTP; Sun, 28 Jul 2013 00:05:40 +0200
Message-ID: <[email protected]>
Date: Sun, 28 Jul 2013 00:05:40 +0200
From: "Mr. Louis Charles Gass." <[email protected]>
Reply-to: [email protected]
To: undisclosed-recipients:;
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-1;
DelSp="Yes";
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
User-Agent: Internet Messaging Program (IMP) H3 (4.3.11)
X-Spam-Status: Yes, score=14.9
X-Spam-Score: 149
X-Spam-Bar: ++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Attention Customer: We have officially received your $19.500.000
fund release Authorisation approval letter from the united nation office.
Meanwhile, you should forward to us your receiving bank account details to
enable us transfer your fund into your bank account without any further delay.
[...]
Content analysis details: (14.9 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(charleslouisga[at]seznam.cz)
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[81.169.137.156 listed in bb.barracudacentral.org]
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
1.8 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4988]
0.0 LOTS_OF_MONEY Huge... sums of money
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_HK_NAME_FM_MR_MRS T_HK_NAME_FM_MR_MRS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
3.4 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.4 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Re: From Mr. Louis Charles Gass.
Attention Customer:
We have officially received your $19.500.000 fund release=A0
Authorisation approval letter
from the united nation office.
Meanwhile, you should forward to us your receiving bank account details to
enable us transfer your fund into your bank account without any further del=
ay.
once i get your information as started above i would send you an
attachment of my united nation official
identity card, my States driver?s license, my States
international
passport and Your Payment Authorisation Letter from UN.
I look forward hearing from you,
Yours Faithfully
Mr. Louis Charles Gass.
Assistant Auditor general
Fund Payment & Auditing Unit
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces