Delivered-To: REDACTED Received: by 2002:a4a:9e97:0:0:0:0:0 with SMTP id u23csp3430306ook; Tue, 14 May 2019 07:19:35 -0700 (PDT) X-Google-Smtp-Source: APXvYqxN5GRLmgwGwy/u4a3EUvGEFag/f/+fOlV9zQ1mBZf8ktIMiqpO7/xnxfczGb1wlYnYubJE X-Received: by 2002:ab0:6983:: with SMTP id t3mr16730007uaq.142.1557843575817; Tue, 14 May 2019 07:19:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1557843575; cv=none; d=google.com; s=arc-20160816; b=KuvfjVGtB6lCtj9Fm0gGHBuSLNjRPqMdSGYaXJzOwU85ooZFPLdjLDAURY9RgyVbfU vw2oggwCDhAtrNStpKpsvQWlH6ZKHTEenKxlYDDsPDIQ2Kt4Adxw3+yrbJKxW9h/SouP sysViYNrkqq2RvYtXXjKvTqqUmeVKqG+LxnpBVK1uMd0abkcuNW7tjZi9/HcBYI3KI7d cR3PcXNu+5eyFSwl2S2RQezx5n9/ytYNrjYpPW/pPyoQwhaDcqgC9EioCG5sU/G5Xlmr eirAoiUNgaGYjEJ+aN1fnB4mrFc8u4TMJy5gn1Y1kd4HFCB0nVIzPLO7UoLaV8EQ//jN 3UBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:content-transfer-encoding:mime-version:date:subject:from :reply-to; bh=FSxBLjnRBl47+u62CqoUUHE6bT1/TwYiaI5Ps3MMCSE=; b=0bWe7mR241eSZmILFK2e/ejHBrlmV+aNMBlCPYSqEbGU77Z5ddHK6cS4J/kenzEx5Z xEttIhXAobx45qXetPScUXxi1xS9dihzvI8E9S6gwjlq/HONNLczlgbwZ02uxRes70CW tJvCsJ7bKe/uHCEn193UDcr/7l67JQZDTfNB0uvX7lArgZYQtsbXizZJ2NB2rmHTog5X EvjN3YVmE6tIWDV4vZq7RtXPCud2eTRooo4RRnEm1LMmLCXRKq05EIDeRLZTT9I/pRnV +IBYN95FWpjCwfqV1KAJ9BX/rq7jsitTEDexw4d6Sm/2WXaALC4ls2KIg24ApKFpkH6C akpA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of [email protected] designates 190.92.127.32 as permitted sender) [email protected] Return-Path: <[email protected]> Received: from ns1.alinet.cu (ns1.alinet.cu. [190.92.127.32]) by mx.google.com with ESMTP id r19si2466475vsn.51.2019.05.14.07.19.35; Tue, 14 May 2019 07:19:35 -0700 (PDT) Received-SPF: pass (google.com: domain of [email protected] designates 190.92.127.32 as permitted sender) client-ip=190.92.127.32; Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 190.92.127.32 as permitted sender) [email protected] Received: by ns1.alinet.cu (Servidor Mail POSTFIX - 13.0.0 ::, from userid 116) id E521CE1D98; Tue, 14 May 2019 10:19:34 -0400 (CDT) X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ns1.alinet.cu X-Spam-Flag: YES X-Spam-Level: ******************************** X-Spam-Status: Yes, score=32.4 required=3.0 tests=ADVANCE_FEE_4_NEW, ADVANCE_FEE_5_NEW,ADVANCE_FEE_5_NEW_MONEY,ALL_TRUSTED,BAYES_99, DEAR_BENEFICIARY,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS, FROM_MISSPACED,FROM_MISSP_MSFT,FROM_MISSP_NO_TO,FROM_MISSP_USER,HK_SCAM_N2, HTML_IMAGE_ONLY_28,HTML_MESSAGE,LOTS_OF_MONEY,MIME_HTML_ONLY,MISSING_HEADERS, MISSING_MID,MONEY_FRAUD_5,MONEY_FRAUD_8,MONEY_FROM_MISSP,NSL_RCVD_FROM_USER, REPLYTO_WITHOUT_TO_CC,TO_NO_BRKTS_FROM_MSSP,T_HK_NAME_MR_MRS,T_REMOTE_IMAGE, URI_HEX,XMAILER_MIMEOLE_OL_1ECD5 autolearn=unavailable version=3.3.2 X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% * [score: 1.0000] * 2.0 NSL_RCVD_FROM_USER Received from User * 1.0 MISSING_HEADERS Missing To: header * 3.1 HK_SCAM_N2 BODY: HK_SCAM_N2 * 1.8 DEAR_BENEFICIARY BODY: Dear Beneficiary: * 1.1 URI_HEX URI: URI hostname has long hexadecimal sequence * 1.4 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format * 0.5 MISSING_MID Missing Message-Id: header * 0.0 LOTS_OF_MONEY Huge... sums of money * 0.0 T_HK_NAME_MR_MRS T_HK_NAME_MR_MRS * 1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC * 0.5 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool * 2.3 FROM_MISSP_NO_TO From misspaced, To missing * 2.8 XMAILER_MIMEOLE_OL_1ECD5 XMAILER_MIMEOLE_OL_1ECD5 * 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only * 1.2 FROM_MISSP_USER From misspaced, from "User" * 3.0 FROM_MISSPACED From: missing whitespace * 0.0 MONEY_FROM_MISSP Lots of money and misspaced From * 1.0 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors * 0.0 T_REMOTE_IMAGE Message contains an external image * 1.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419) * 1.5 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419) * 1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook * 0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money * 0.5 MONEY_FRAUD_5 Lots of money and many fraud phrases * 1.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases Received: from User (unknown [129.205.112.146]) by ns1.alinet.cu (Servidor Mail POSTFIX - 13.0.0 ::) with ESMTPA id 986DBE1D14; Tue, 14 May 2019 10:19:02 -0400 (CDT) Reply-To: [email protected] From: "Mr. Braunwalder Garland" <[email protected]> Subject: *****SPAM***** Did You Authorize Her? Date: Tue, 14 May 2019 15:19:16 +0100 MIME-Version: 1.0 Content-Type: text/html; charset="_iso-2022-jp$ESC" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-Antivirus: Avast (VPS 190514-2, 05/14/2019), Outbound message X-Antivirus-Status: Clean X-Spam-Prev-Subject: Did You Authorize Her? Message-Id: <[email protected]>
<HTML><HEAD><TITLE></TITLE> </HEAD> <BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5> <FONT size=2 color=#000000 face="Arial"> <DIV> Attention: Beneficiary</DIV> <DIV> </DIV> <DIV> </DIV> <DIV> I am Mr. Braunwalder Garland of IMF Head Office.</DIV> <DIV> </DIV> <DIV> </DIV> <DIV> Your email appeared among the beneficiaries, who will receive a part-payment of your contractual sum of USD$950,000 and has been approved already for months. You are requested to get back to me for more direction and instruction on how to receive your fund.</DIV> <DIV> </DIV> <DIV> </DIV> <DIV> However, we received an email from one Mrs. Rose Donald who told us that she is your next of kin and that you died in a car accident last week. She has also submitted her account for us to transfer the fund to her. We want to hear from you before we can make the transfer to confirm if you are</DIV> <DIV> dead or not.</DIV> <DIV> </DIV> <DIV> </DIV> <DIV> Please in confirmation that you are still alive, you are advised to reconfirm the below listed information to enable us facilitate an immediate payment for you.</DIV> <DIV> </DIV> <DIV> </DIV> <DIV> 1 Your full names</DIV> <DIV> 2 Your present contact address.</DIV> <DIV> 3 Your telephone & Fax numbers.</DIV> <DIV> 4 Your Occupations/age/sex.</DIV> <DIV> 5 Your Private E mail Address.</DIV> <DIV> </DIV> <DIV> </DIV> <DIV> </DIV> <DIV> </DIV> <DIV> Once again, I apologize to you on behalf of IMF (International Monetary Funds) for failure to pay your funds in time, which according to records in the system had been long overdue.</DIV> <DIV> </DIV> <DIV> </DIV> <DIV> </DIV> <DIV> Thanks,</DIV> <DIV> </DIV> <DIV> </DIV> <DIV> </DIV> <DIV> Mr. Braunwalder Garland</DIV> <DIV> </DIV> </FONT> <div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br /> <table style="border-top: 1px solid #D3D4DE;"> <tr> <td style="width: 55px; padding-top: 13px;"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=icon" target="_blank"><img src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;" /></a></td> <td style="width: 470px; padding-top: 12px; color: #41424e; font-size: 13px; font-family: Arial, Helvetica, sans-serif; line-height: 18px;">Virus-free. <a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=link" target="_blank" style="color: #4453ea;">www.avast.com</a> </td> </tr> </table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"> </a></div></BODY></HTML>
(0 overlaps with other emails)