by buried under 419s
Sun Jan 04, 2015 3:03 am
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 03 Jan 2015 22:08:54 -0800
Received: from 109.120.142.146.addr.datapoint.ru ([109.120.142.146]:57269 helo=mfc-amur.ru)
by with smtp (Exim 4.80)
(envelope-from <[email protected]>)
id 1Y7eMv-0002ru-JW
for ; Sat, 03 Jan 2015 22:08:54 -0800
Received: from User ([81.136.225.200])
by mfc-amur.ru
; Sat, 3 Jan 2015 10:23:42 +0900
Message-ID: <[email protected]>
Reply-To: <[email protected]>
From: "Dr James Hanson"<[email protected]>
Date: Sat, 3 Jan 2015 01:27:08 -0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
X-Spam-Status: Yes, score=15.2
X-Spam-Score: 152
X-Spam-Bar: +++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Good Day This is to inform you that your funds of US$15.5
Million is in your country and will be handed over to you in the next 24 hours.
The funds is in a United Nations Storage facility in your country and arrangements
have been finalized to have it driven to your designated address with a United
Nations Chauffeur car. [...]
Content analysis details: (15.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 TVD_RCVD_IP Message was received from an IP address
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[109.120.142.146 listed in bb.barracudacentral.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(<drjameshanson777[at]yahoo.com.ph>
)
1.0 MISSING_HEADERS Missing To: header
2.0 BAYES_80 BODY: Bayes spam probability is 80 to 95%
[score: 0.8540]
1.0 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_DR T_HK_NAME_DR
1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_USER From misspaced, from "User"
1.3 AXB_XMAILER_MIMEOLE_OL_1ECD5 Yet another X header trait
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.4 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
2.2 MONEY_FORM_SHORT Lots of money if you fill out a short form
X-Spam-Flag: YES
Subject: ***SPAM*** Please Read This Important Message Carefully
Good Day
This is to inform you that your funds of US$15.5 Million is in your country and will be handed over to you in the next 24 hours.
The funds is in a United Nations Storage facility in your country and arrangements have been finalized to have it driven to your designated address with a United Nations Chauffeur car.
The delivery is scheduled to be effected within the next few hours and we have ensured that everything is done legally.
Please send the folowing information
1. Address Where you want the fund delivered
2 Telephone/Cell Phone Number
As soon as you provide the information stated above, the delivery will be concluded.
Dr James Hanson
Envelope-to:
Delivery-date: Sat, 03 Jan 2015 22:08:54 -0800
Received: from 109.120.142.146.addr.datapoint.ru ([109.120.142.146]:57269 helo=mfc-amur.ru)
by with smtp (Exim 4.80)
(envelope-from <[email protected]>)
id 1Y7eMv-0002ru-JW
for ; Sat, 03 Jan 2015 22:08:54 -0800
Received: from User ([81.136.225.200])
by mfc-amur.ru
; Sat, 3 Jan 2015 10:23:42 +0900
Message-ID: <[email protected]>
Reply-To: <[email protected]>
From: "Dr James Hanson"<[email protected]>
Date: Sat, 3 Jan 2015 01:27:08 -0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
X-Spam-Status: Yes, score=15.2
X-Spam-Score: 152
X-Spam-Bar: +++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Good Day This is to inform you that your funds of US$15.5
Million is in your country and will be handed over to you in the next 24 hours.
The funds is in a United Nations Storage facility in your country and arrangements
have been finalized to have it driven to your designated address with a United
Nations Chauffeur car. [...]
Content analysis details: (15.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 TVD_RCVD_IP Message was received from an IP address
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[109.120.142.146 listed in bb.barracudacentral.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(<drjameshanson777[at]yahoo.com.ph>
)
1.0 MISSING_HEADERS Missing To: header
2.0 BAYES_80 BODY: Bayes spam probability is 80 to 95%
[score: 0.8540]
1.0 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_DR T_HK_NAME_DR
1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_USER From misspaced, from "User"
1.3 AXB_XMAILER_MIMEOLE_OL_1ECD5 Yet another X header trait
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.4 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
2.2 MONEY_FORM_SHORT Lots of money if you fill out a short form
X-Spam-Flag: YES
Subject: ***SPAM*** Please Read This Important Message Carefully
Good Day
This is to inform you that your funds of US$15.5 Million is in your country and will be handed over to you in the next 24 hours.
The funds is in a United Nations Storage facility in your country and arrangements have been finalized to have it driven to your designated address with a United Nations Chauffeur car.
The delivery is scheduled to be effected within the next few hours and we have ensured that everything is done legally.
Please send the folowing information
1. Address Where you want the fund delivered
2 Telephone/Cell Phone Number
As soon as you provide the information stated above, the delivery will be concluded.
Dr James Hanson
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces