#397028 by buried under 419s
Fri Sep 13, 2019 8:35 pm
Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id QIUkDLeze12oPAAAjbubUg
for <>; Fri, 13 Sep 2019 08:20:23 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Fri, 13 Sep 2019 08:20:23 -0700
Received: from mail.uptimesales.com ([198.57.195.114]:65059)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1i8nMw-00040w-0b
for ; Fri, 13 Sep 2019 08:20:22 -0700
Received: from User (h170.0.140.40.ip.windstream.net [40.140.0.170]) by mail.uptimesales.com with SMTP;
Fri, 13 Sep 2019 05:00:22 -0400
Reply-To: <[email protected]>
From: "Robert Russell"<[email protected]>
Date: Fri, 13 Sep 2019 10:00:22 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=52.1
X-Spam-Score: 521
X-Spam-Bar: +++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: UNITED NATIONS OFFICE 1750 Pennsylvania Avenue NW Suite 300
Washington, DC 20006 USA. [...]
Content analysis details: (52.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
1.8 DEAR_BENEFICIARY BODY: Dear Beneficiary:
4.2 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
2.2 NSL_RCVD_FROM_USER Received from User
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.5 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(robertrussell01[at]emailn.de)
0.5 SUBJ_ALL_CAPS Subject is all capitals
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
4.3 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 MISSING_MID Missing Message-Id: header
1.6 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.5 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.3 FROM_MISSP_USER From misspaced, from "User"
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
2.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.1 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
2.0 FROM_MISSPACED From: missing whitespace
1.2 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
2.1 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_3 Fill a form and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** VERY URGENT.
UNITED NATIONS OFFICE
1750 Pennsylvania Avenue NW
Suite 300 Washington, DC 20006 USA.
OUR REF: UN / US / 021.7XXVX / 901
YOUR REF: UNA / USA / 255-U7 / 2019
Attention:Beneficiary,
NOTICE TO PAY YOU.
Following the Resolution of the World Bank Economic Forum with the
Directors of International Monitoring Fund (IMF) passed at the United
Nations Assembly Conference held in Washington DC USA recently, It was
unanimously agreed that all outstanding debts relating to Share Bond,
Contract Payment, Lottery/Inheritance Fund owed to Foreign Contractors and
Corporate Individuals should be settle before the 3rd Quarter of the year
runs out.
As one of the Beneficiary affected in the list submitted to United Nations
Assembly by the World Bank Auditors for consideration, we hereby notify
you that the sum of $10.5 million US Dollars has been approved for you.
Please furnish us with your full name,address and telephone number for
immediate payment. For your information we have only 3 months to complete
this payment exercise, and upon receipt of your mail you will be notify
the corresponding bank to receive the money from.
We look forward to hear from you soonest.
Robert Russell.
UN Audit Officer.
Delivered-To:
Received: from
by with LMTP id QIUkDLeze12oPAAAjbubUg
for <>; Fri, 13 Sep 2019 08:20:23 -0700
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Fri, 13 Sep 2019 08:20:23 -0700
Received: from mail.uptimesales.com ([198.57.195.114]:65059)
by with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1i8nMw-00040w-0b
for ; Fri, 13 Sep 2019 08:20:22 -0700
Received: from User (h170.0.140.40.ip.windstream.net [40.140.0.170]) by mail.uptimesales.com with SMTP;
Fri, 13 Sep 2019 05:00:22 -0400
Reply-To: <[email protected]>
From: "Robert Russell"<[email protected]>
Date: Fri, 13 Sep 2019 10:00:22 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=52.1
X-Spam-Score: 521
X-Spam-Bar: +++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: UNITED NATIONS OFFICE 1750 Pennsylvania Avenue NW Suite 300
Washington, DC 20006 USA. [...]
Content analysis details: (52.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
1.8 DEAR_BENEFICIARY BODY: Dear Beneficiary:
4.2 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
2.2 NSL_RCVD_FROM_USER Received from User
1.0 MISSING_HEADERS Missing To: header
1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.5 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(robertrussell01[at]emailn.de)
0.5 SUBJ_ALL_CAPS Subject is all capitals
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
4.3 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.6 MISSING_MID Missing Message-Id: header
1.6 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.5 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.3 FROM_MISSP_USER From misspaced, from "User"
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
2.0 FSL_NEW_HELO_USER Spam's using Helo and User
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.1 MONEY_FROM_MISSP Lots of money and misspaced From
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.5 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
1.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
2.0 FROM_MISSPACED From: missing whitespace
1.2 FROM_MISSP_EH_MATCH From misspaced, matches envelope
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
2.1 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_3 Fill a form and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** VERY URGENT.
UNITED NATIONS OFFICE
1750 Pennsylvania Avenue NW
Suite 300 Washington, DC 20006 USA.
OUR REF: UN / US / 021.7XXVX / 901
YOUR REF: UNA / USA / 255-U7 / 2019
Attention:Beneficiary,
NOTICE TO PAY YOU.
Following the Resolution of the World Bank Economic Forum with the
Directors of International Monitoring Fund (IMF) passed at the United
Nations Assembly Conference held in Washington DC USA recently, It was
unanimously agreed that all outstanding debts relating to Share Bond,
Contract Payment, Lottery/Inheritance Fund owed to Foreign Contractors and
Corporate Individuals should be settle before the 3rd Quarter of the year
runs out.
As one of the Beneficiary affected in the list submitted to United Nations
Assembly by the World Bank Auditors for consideration, we hereby notify
you that the sum of $10.5 million US Dollars has been approved for you.
Please furnish us with your full name,address and telephone number for
immediate payment. For your information we have only 3 months to complete
this payment exercise, and upon receipt of your mail you will be notify
the corresponding bank to receive the money from.
We look forward to hear from you soonest.
Robert Russell.
UN Audit Officer.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces