Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#382103 by buried under 419s Mon Feb 25, 2019 10:07 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id GCTBOe7Bc1wUeAAAjbubUg
for <>; Mon, 25 Feb 2019 02:22:38 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 25 Feb 2019 02:22:38 -0800
Received: from smtp-4.metronet.cz ([95.85.195.62]:46250 helo=smtp.metronet.cz)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1gyDPB-0007zJ-Cz
for ; Mon, 25 Feb 2019 02:22:38 -0800
Received: from User (unknown [95.85.215.253])
by smtp.metronet.cz (Postfix) with SMTP id 1CBDB404FA;
Mon, 25 Feb 2019 11:21:37 +0100 (CET)
Reply-To: <[email protected]>
From: "PACIFIC WESTERN BANK"<[email protected]>
Date: Mon, 25 Feb 2019 11:21:52 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=28.6
X-Spam-Score: 286
X-Spam-Bar: ++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: Dear Beneficiary, The sum of $11.5 Million Dollars has been
deposited in our bank under your name. According to the Depositor he said
his name is John Johnson and also a diplomat agent assigned by the United
Nation to deliver the said fund to you. He said he has tried reaching you
several times but you have refused to comply with his directives. I am please
to inform you that your fund is safe and will be release to you through our
online payment system which you will be required to open an online account
with us and account details would be provided to you after to access your
account and conduct transfers. [...]

Content analysis details: (28.6 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[95.85.215.253 listed in zen.spamhaus.org]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?95.85.215.253>]
1.5 SUBJ_ALL_CAPS Subject is all capitals
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.8 KAM_ASCII_DIVIDERS Spam that uses ascii formatting tricks
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 MISSING_MID Missing Message-Id: header
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 FROM_MISSP_PHISH Malformed, claims to be from financial organization
- possible phish
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.9 MONEY_FRAUD_3 Lots of money and several fraud phrases
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** FUND DEPOSITED

Dear Beneficiary,

The sum of $11.5 Million Dollars has been deposited in our bank under your name.
According to the Depositor he said his name is John Johnson and also a diplomat
agent assigned by the United Nation to deliver the said fund to you. He said he has
tried reaching you several times but you have refused to comply with his directives.
I am please to inform you that your fund is safe and will be release to you through
our online payment system which you will be required to open an online account with
us and account details would be provided to you after to access your account and
conduct transfers.

You are advised as a matter of urgency to get back to us immediately.

Sincerely,

Kori L. Ogrosky
CORPORATE SECRETARY/INTERNET BANKING

---------------------------------------------------------------------------------------------------------------------------
2019 Pacific Western Bank All Rights Reserved.
****DISCLAIMER: If you are NOT the intended recipient and you receive this message
by mistake either electronically or mechanically, kindly delete it from your list or
notify the Pacific Western Bank by Email:[email protected]

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
Advertisement

#384752 by buried under 419s Sat Apr 27, 2019 2:40 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id eEtqBJTtw1y+ZwAAjbubUg
for <>; Fri, 26 Apr 2019 22:50:12 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Fri, 26 Apr 2019 22:50:12 -0700
Received: from smtp.bsisp.co.za ([154.73.139.2]:47223 helo=smtprelay.bsisp.co.za)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1hKGDy-0006tR-Jh
for ; Fri, 26 Apr 2019 22:50:11 -0700
Received: from User (unknown [197.231.198.172])
by smtprelay.bsisp.co.za (Postfix) with SMTP id 4F0259F99D;
Sat, 27 Apr 2019 07:51:06 +0200 (SAST)
Reply-To: <[email protected]>
From: "PACIFIC WESTERN BANK"<[email protected]>
Date: Sat, 27 Apr 2019 06:49:26 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=26.7
X-Spam-Score: 267
X-Spam-Bar: ++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: Dear Beneficiary, I wish to inform you that we have been mandated
by our corresponding bank to carry out your payment valued $11.5 Million
Dollars henceforth and ensure your fund is released to you without any further
delay. I am please to inform you that your fund is safe and will be release
to you through our online payment system which you will be required to open
an online account with us and account details would be provided to you after
to access your account and conduct transfers. [...]

Content analysis details: (26.7 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
0.0 NSL_RCVD_FROM_USER Received from User
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?197.231.198.172>]
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[197.231.198.172 listed in zen.spamhaus.org]
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 LOTS_OF_MONEY Huge... sums of money
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 MISSING_MID Missing Message-Id: header
0.0 FROM_MISSP_USER From misspaced, from "User"
0.8 KAM_ASCII_DIVIDERS Spam that uses ascii formatting tricks
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSP_PHISH Malformed, claims to be from financial organization
- possible phish
1.5 FAKE_REPLY_C No description available.
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
2.1 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Deposited Fund


Dear Beneficiary,

I wish to inform you that we have been mandated by our corresponding bank to carry
out your payment valued $11.5 Million Dollars henceforth and ensure your fund is
released to you without any further delay. I am please to inform you that your fund
is safe and will be release to you through our online payment system which you will
be required to open an online account with us and account details would be provided
to you after to access your account and conduct transfers.

You are advised as a matter of urgency to get back to us immediately.

Sincerely,

Kori L. Ogrosky
CORPORATE SECRETARY/INTERNET BANKING

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces
#403726 by buried under 419s Sat Jan 25, 2020 3:57 am
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP
id L9N6KotJK14dugEAibB4EA
(envelope-from <[email protected]>)
for <[email protected]>; Fri, 24 Jan 2020 14:46:19 -0500
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Fri, 24 Jan 2020 14:46:19 -0500
Received: from mail8136c14.megamailservers.com ([66.226.81.36]:45744)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.92)
(envelope-from <[email protected]>)
id 1iv4uH-000TQa-3n
for ; Fri, 24 Jan 2020 14:46:19 -0500
Received: from User (d192-186-113-138.static.comm.cgocable.net [192.186.113.138])
by mail8136c14.megamailservers.com (mail8136c14) with SMTP id EF0E6923F4146;
Fri, 24 Jan 2020 14:34:46 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cogeco.ca; s=email;
t=1579894606; bh=N3YOmUaisSFUjas6X3X7SjydxTjmOgtLEoL4x62gf0A=;
h=Reply-To:From:Subject:Date:From;
b=YSresHwHg3M940rWcUuZ6SHh78GwFiAGSQdb7+kg1dFE9PUaOnFyq3YPcZ0VCAIJE
1kmT6rZghbxYQOa2S84DOd0N9WCqUNXahJEB+8T5RVoblTOFakP0ID26L2KW9Pllqs
XC7KI26wUdZPceK7G4yOWlHA+NOdMA2aYbd1cBEo=
Feedback-ID:[email protected]
Reply-To: <[email protected]>
From: "Pacific Western Bank"<[email protected]>
Date: Fri, 24 Jan 2020 20:36:46 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-CSC: 0
X-CHA: v=2.3 cv=Vtpd/N+n c=1 sm=1 tr=0 a=C/GDr0ANcbQ6brfVBYcZJg==:117
a=C/GDr0ANcbQ6brfVBYcZJg==:17 a=9cW_t1CCXrUA:10 a=HpEJnUlJZJkA:10
a=Dyoqhi_TatcA:10 a=Cfj4BQAnxiAA:10 a=4xMbIKiAWSwA:10 a=R6GfHaLKAAAA:8
a=OQB07Bx8eL6LfYH9EHQA:9 a=9g-RsTbC9UsQb5Yu:21 a=cdrARtUSDnGc6g8T:21
a=Ft8UYL4EG9YA:10 a=Am4aLTmdj0wA:10 a=dM2NcM6pg6sA:10 a=O0Nu9MrloXIA:10
a=Nqsw2DYimI8LW6mPU8LU:22 a=pHzHmUro8NiASowvMSCR:22
a=n87TN5wuljxrRezIQYnT:22
X-CTCH-RefID: str=0001.0A020210.5E2B474E.004E,ss=2,re=3.500,recu=0.000,reip=0.000,cl=2,cld=1,fgs=64
X-CTCH-VOD: Unknown
X-CTCH-Spam: Suspect
X-CTCH-Score: 3.500
X-CTCH-Rules: FSL_CTYPE_WIN1251,
X-CTCH-Flags: 64
X-CTCH-ScoreCust: 0.000
X-Origin-Country: CA
X-Spam-Status: Yes, score=19.2
X-Spam-Score: 192
X-Spam-Bar: +++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Pacific Western Bank 776 East Shaw Avenue, Ste 101 Fresno,
CA 93710. United States. Dear Beneficiary, We wish to remind you that your
payment is still intact and waiting for you to comply for disbursement.
Content analysis details: (19.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.8 NSL_RCVD_FROM_USER Received from User
3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[192.186.113.138 listed in zen.spamhaus.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/,
no trust
[66.226.81.36 listed in list.dnswl.org]
1.0 MISSING_HEADERS Missing To: header
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
1.3 FSL_NEW_HELO_USER Spam's using Helo and User
0.8 KAM_ASCII_DIVIDERS Spam that uses ascii formatting tricks
0.0 FROM_MISSP_USER From misspaced, from "User"
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.5 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
X-Spam-Flag: YES
Subject: ***SPAM*** Kindly acknowledge the receipt of this email

Pacific Western Bank
776 East Shaw Avenue, Ste 101
Fresno, CA 93710.
United States.


Dear Beneficiary,

We wish to remind you that your payment is still intact and waiting for you to comply for disbursement.

Kindly acknowledge the receipt of this email.

Thank you.


Sincerely,

Customer Care Service
Pacific Western Bank.
800.654.7962
800.236.2442
Available 24/7 for general inquiries
---------------------------------------------------------------------------------------------------------------------------
2020 Pacific Western Bank All Rights Reserved.
****DISCLAIMER: If you are NOT the intended recipient and you receive this message by mistake either electronically or mechanically, kindly delete it from your list or notify the Pacific Western Bank by Email:[email protected]

Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces

Who is online

Users browsing this forum: No registered users and 35 guests