fake winning SPAM email, requesting PII 01-November-2020

Return-Path: <audit@gmail.com>
Received: from mx4.mi.net ([unix socket])
	 by stor3 (Cyrus 2.5.10-Debian-2.5.10-3) with LMTPA;
	 Fri, 30 Oct 2020 16:23:34 +0200
X-Sieve: CMU Sieve 2.4
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on stor3.stor3
X-Spam-Flag: YES
X-Spam-Level: *****************************
X-Spam-Status: Yes, score=29.7 required=5.0 tests=AXB_XMAILER_MIMEOLE_OL_024C2,
	BAYES_999,DKIM_ADSP_CUSTOM_MED,FAKE_REPLY_C,FORGED_GMAIL_RCVD,
	FORGED_MUA_OUTLOOK,FREEMAIL_FROM,FREEMAIL_REPLYTO,
	FREEMAIL_REPLYTO_END_DIGIT,FROM_MISSP_FREEMAIL,FROM_MISSP_MSFT,
	FROM_MISSP_REPLYTO,FROM_MISSP_XPRIO,FSL_CTYPE_WIN1251,
	FSL_NEW_HELO_USER,LOTS_OF_MONEY,MISSING_HEADERS,MISSING_MID,
	MONEY_FRAUD_8,MONEY_FROM_MISSP,NML_ADSP_CUSTOM_MED,RCVD_IN_MSPIKE_BL,
	RCVD_IN_MSPIKE_L5,RCVD_IN_PSBL,RCVD_IN_RP_RNBL,REPLYTO_WITHOUT_TO_CC,
	SPF_SOFTFAIL,SPOOFED_FREEM_REPTO,TO_NO_BRKTS_FROM_MSSP,
	TO_NO_BRKTS_MSFT,TVD_PH_BODY_META,T_HK_NAME_FM_FROM,T_MONEY_PERCENT
	shortcircuit=no autolearn=no autolearn_force=no version=3.4.2
X-Spam-Report:
	*  0.0 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
	*      [124.158.10.150 listed in bl.mailspike.net]
	*  1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
	*      https://senderscore.org/blacklistlookup/
	*      [124.158.10.150 listed in bl.score.senderscore.com]
	*  2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
	*      [124.158.10.150 listed in psbl.surriel.com]
	*  0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
	*  1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
	*      headers
	*  0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override
	*      is CUSTOM_MED
	*  0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
	*      provider (audit[at]gmail.com)
	*  4.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
	*  1.0 MISSING_HEADERS Missing To: header
	*  0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
	*      digit (stevekon39[at]rediffmail.com)
	*  0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
	*      [score: 1.0000]
	*  0.0 T_HK_NAME_FM_FROM No description available.
	*  1.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
	*  0.0 FSL_NEW_HELO_USER Spam's using Helo and User
	*  0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
	*  0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
	*  2.0 LOTS_OF_MONEY Huge... sums of money
	*  1.2 MISSING_MID Missing Message-Id: header
	*  0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
	*  1.6 REPLYTO_WITHOUT_TO_CC No description available.
	*  0.0 TVD_PH_BODY_META No description available.
	*  1.5 FAKE_REPLY_C No description available.
	*  0.0 MONEY_FROM_MISSP Lots of money and misspaced From
	*  1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
	*      different freemails
	*  2.5 FROM_MISSP_REPLYTO From misspaced, has Reply-To
	*  0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
	*  0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing
	*       list
	*  0.0 T_MONEY_PERCENT X% of a lot of money for you
	*  1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
	*  1.9 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
	*  2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail
	*      reply-to
	*  0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
	*  1.2 MONEY_FRAUD_8 Lots of money and very many fraud phrases
Received-SPF: softfail (gmail.com ... _spf.google.com: Sender is not authorized by default to use 'audit@gmail.com' in 'mfrom' identity, however domain is not currently prepared for false failures (mechanism '~all' matched)) receiver=mx4.mi.net; identity=mailfrom; envelope-from="audit@gmail.com"; helo=mail.topasia.com.vn; client-ip=124.158.10.150
Received: from mail.topasia.com.vn (mail.topasia.com.vn [124.158.10.150])
	by mx4.mi.net (Postfix) with ESMTP id 6163BB8D42
	for <urmom@mi.net>; Fri, 30 Oct 2020 16:23:34 +0200 (EET)
Received: from User (unknown [156.96.115.152])
	by mail.topasia.com.vn (Postfix) with SMTP id C96684D32A91;
	Wed, 28 Oct 2020 00:33:54 +0700 (+07)
Reply-To: <stevekon39@rediffmail.com>
From: "From : Steve Odonkon"<audit@gmail.com>
Subject: RE: STRICTLY CONFIDENTIAL (Respond Immediately)
Date: Tue, 27 Oct 2020 10:34:09 -0700
MIME-Version: 1.0
Content-Type: text/plain;
	charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <cmu-lmtpd-12401-1604067814-1@stor3>

Esteem Complement,    Tuesday October 27th 2020

Hello, my name is Steve Odonkon, Audit Accounting Officer of Siliva valley bank, London, United Kingdom. (https://silivallechk.com/uk) I got your information when I was searching for an oversea partner among other names, I ask for your pardon if my approach is offensive as I never meant to invade your privacy through this means, and also i believe this is the best and secured means I can pass my message across to you in clear terms. I have sent you this proposal before now; I do hope this will get to you in good health.


As the Audit Accounting Officer of the bank, I have access to lots of documents because I handle some of the bank's sensitive files. On the course of the last year 2019 business report, I discovered that my branch in which I am the Audit Accounting Officer made (�5,720,000.00). Million British pounds from some past government contractors in which my head office are not aware of and will never be aware of. I have placed this funds on what we call escrow call account with no beneficiary.


As an officer of this bank I cannot be directly connected to this money, so my aim of contacting you is to assist me receive this money in your bank account and get 50% of the total funds as commission. There are practically no risks involved, it will be a bank-to-bank transfer, and all I need from you is to stand claim as the Original depositor of these funds who made the deposit with my branch so that my head office can order the transfer to your designated bank account.

Send me your contact details below to enable me furnish you with more relevant details that will help you understand the transaction.

Full Name...

Telephone Number...


Thank you in advance and May God bless you and your family.

Yours truly,
Steve Odonkon
E-mail:  stevekon39@rediffmail.com
Call OR WhatsAPP +44 7926062919