Scam email #44906 - ATTENTION FOR YOUR FUNDS:
The email was sent on 2013-07-08 19:14:08 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 22.214.171.124 in Unspecified, Benin
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] via 126.96.36.199; Mon, 08 Jul 2013 11:14:08 -0700|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||188.8.131.52|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||none (domain of yahoo.co.nz does not designate permitted sender hosts)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||MgFm_TkWLDtvsjbPV5D4293abnza7pHmFiGg8PX8tSNTIT8v dQrITn1kKxJPfNqmjLAjhyYRw4PMFTj6SxEavIjMc93tvXYQMa.Og.O8_hL5 brtL_E7yzyrd9xSdF1yogJoImpzA_W8abjjX4jsPrSEEAeuxm8k1tJHyP8tX .mkUF0KI0cw6jrktBInHN9eP4bS6EaZvOv42Whec5h_XwZbFuS5ZA5IdsVXA NBxP_XJA5RSuSYGemnfgR9PAxxtOeQc5LxcNlUulrY0ARhh_Nm5zZNzY4sds Z35PG79Q8lYl2LnYasyt8xUecfArDSi0DnbR59.FjuLae_QOXzRAUVJVXXBh u4dw2XiMdJ3sApBll1Di0LSu6CFO8hvBsu8e1chc4ANcXx3VnZrmntQb_zQH Vn8VEkYvEngFGj3CX2yZxDNrVoF_sI.zw_u0RXI.7fVGlh.EtccfT5qrXIhm FuauRP.zYhxJH8cFaOOfds01YGm1ydyZ.zclzNSZ3L6WAdzYJQB4Acv42BmV 27Ej9iOVznYmGBHx6iJnlPIDTP.0xgKxgdB0fkqSqOwBvq8CXTiqx0hCx9S8 g8ZNuF7_SvcPWJruNiCqBq1TIrlCD8zx0eF59Yp6RQ7PHykFN91O9CW3t8po b1pm.5JpZlIalacamIelnvOEkYUfWp0lScOVdT0SeQIo_wNSu_Ys4L8rqY3G 66pu_02qaaX1OGM_S4DWP59mWkSYLPL68.7qJTehi8pk60YtCpjIgcH95obh jCNxxvQ1q7AF7olIDG6b2i9nImysrZeBdKqYcu9KhhK6fTMc1nojyGcsS1qp W_OAoPyYQ.2knzvihE9VbFER0i7EKTPk7jotP8oLCI6KbkvqknBMg1psjJYS WSu3D9tRch8.VfJXXTEIcz.3VbSv4eTT7jiVZcCppt988aUEgMisblYA6b7B MfK1AX1Llyp3EZXq5RKMDntARSYfnA6rccevwDDKEzBWzXyuvwTMBbSlv1ds EXb97c8FL5dd8S2EYEZNlQECF0YVh64zfvWbocCCRx3x4djE7sbGQy5XtKkf RI_2oFr_bYdraGpNBerBqggF_2bqubU0RKYFt6bfldWouFgWxGoHWaSTA4Gl c8YH6FDlmQefg7lNPQICA3hvkqWgfhqCa.ihGK4sbhhmGkM1bMG9Q7JMPjZp awwGwbc0yX0x5u8kHyUrmSgj2UFPb993Bgpo7Q.j2VMt6b5GDWc_Qjeonpsj 9z2wj0KIQG_WvN3hZ3RaKwE3jzkjMyjX.OmXzUA3wWB8JDN4baP4n3CUUCNa QHWMq54jv7XlTTL82rbAEOMhbx1GZqrT7SudyiVHOK0IUwKSQaGKdBu819u5 CjkJEg--|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[184.108.40.206]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta1258.mail.bf1.yahoo.com from=yahoo.co.nz; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO nm9-vm6.bullet.mail.gq1.yahoo.com) (220.127.116.11) by mta1258.mail.bf1.yahoo.com with SMTP; Mon, 08 Jul 2013 11:14:07 -0700|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from [18.104.22.168] by nm9.bullet.mail.gq1.yahoo.com with NNFMP; 08 Jul 2013 18:14:06 -0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from [22.214.171.124] by tm17.bullet.mail.gq1.yahoo.com with NNFMP; 08 Jul 2013 18:14:06 -0000|
|Received:||from [127.0.0.1] by omp1088.mail.gq1.yahoo.com with NNFMP; 08 Jul 2013 18:14:06 -0000|
|X-Yahoo-Newman-Property:||Custom Yahoo header for version information||ymail-3|
|X-Yahoo-Newman-Id:||A message ID applied by Yahoo for reference||[email address removed]|
|Received:||(qmail 8961 invoked by uid 60001); 8 Jul 2013 18:14:06 -0000|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1373307246; bh=ZiYsKUAfOfu+v31P9lqihpwTeCixQdIcvRsobT0VyEM=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=n7KtBreKJcr4Zj/Lpz8KzorBN9Lv1j9BEuaDlyV0xZU7ixPy83UAzGJllLggniS06BpKq/MLEG2+LGUcGaxR7loEqK2YRII2vgV0TwM0l/3Lhjff2jN50lRDw8MWSzRu46/rLrcFfiPPvx1s4PIW+r9MVPaE8G7Cb7AINDRsY64=|
|DomainKey-Signature:||Used to verify message integrity||a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.nz; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=ZlgM05dK6HpdpSrQcffThBrRukNeIfaYwszCaRRrv6sWbkv+vKLJSysB55oi0lWRYosR6XqyXODEwfq0J04v6NdCo0Ukm5DCT+gPEYlKpEb6N2kibxIDJReWFIKXOLa9AwfQJ1YcHsB2gx+tS0vjlI8NIfa+0qY8KZLcM6jlW98= ;|
|X-YMail-OSG:||A unique ID added by the Yahoo Outbound Spam Guard||BT8czr8VM1ml3IMXMuW_YnFokE84fW9.w9ATM65NFKdFtjC GE.mKmrld6n843LNsUrRR|
|Received:||from [126.96.36.199] by web163905.mail.gq1.yahoo.com via HTTP; Mon, 08 Jul 2013 11:14:06 PDT|
|X-Mailer:||The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters||YahooMailClassic/223 YahooMailWebService/0.8.148.557|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|Date:||The date/time the email was sent||Mon, 8 Jul 2013 11:14:06 -0700 (PDT)|
|From:||This is the address the email was apparently sent from||Mr paul roberto [email address removed]|
|Reply-To:||This is the email address any reply would be sent to by default||[email address removed]|
|Subject:||The subject of the email||ATTENTION FOR YOUR FUNDS:|
|To:||The email address(es) the email was sent to||undisclosed recipients: ;|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||text/plain; charset=utf-8|
|Content-Transfer-Encoding:||How the email has been encoded to comply with regulations (e.g. maximum characters per line)||quoted-printable|
|Content-Length:||The size of the email, in bytes||2722|
Your content is below the advert
FROM HEAD QUARTER POLICE STATION ZOGBO COTONOU INSPECTOR GENERAL OF POLICE BENIN REPUBLIC WEST AFRICA FROM Paul Roberto.
ATTENTION FOR YOUR FUNDS:
My name is Mr.Paul Roberto,the Inspector General of Police Benin Republic,This is to inform you that the government of this Country Benin Republic are sending you the sum of ($1.5M USD) One Five Million Us Dollars which you have lost in before because you have been waiting to receive since From Money Gram And Western Union Money Transfer.
We got them arrested today because they did not follow the instruction we given to them by the Federal Government of Benin. This government is rewarding this funds to you as one of the scam victim because your email was through by those that extort money from you when we got them arrested, One of them gave us your email address. The president of this country His Excellency Mr.Yayi Boni has sent aside the sum of ($1.5M USD) in consignment box to send to you through DHL Courier Company.
We thereby have made a concrete arrangement with the DHL Courier Company for a safe delivery to your door-step once the beneficiary meets up the demand of the conveyance.
Note that all the delivery fee has been paid on your behalf but you shall required to send only $48,00usd immediately to our office for your clearance certificate because our agent will proceed to Du Benin High Court first thing tomorrow morning to obtain the certificate before your consignment will leave this country.
The DHL Courier agent will use the certificate to obtain the transaction. So you advice to confirm your information immediately for delivery of your consignment and also to enable our office confirm that you are the real owner of this Email address to avoid any mistake. If you know that you are not the owner of this consignment box don t try to contact us,
RE-CONFIRM THE FOLLOWING INFORMATION;
Your Full Name. . . .
Your Country. . . .
Your City. . . . . .
Your Telephone Number.
Your Passport. .
Below is where you can send the $48,00usd to our protocol officer.
Receiver s Name:..... PAUL CHIOZIE
Country. . . . . . . .-BENIN REPUBLIC
City. . . . . . . . COTONOU
Text Question. . . . . God
Answer. . . . . . .NOW
Amount. $48,00usd .only,
Your senders name and Address. . . . ....
MTCN#. . . ................................
Here are those SCAMPERS that were arrested; Mr. Arinze Chukwu, Chief Mrs Amanda Morgan, Mrs Calister Ekwueme,Mark Ibe, Mr. Morgan Adam and Prince John Anderson in case you will recognize them.
Inspector General Of Police
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)