Scam email #53467 - National Economic Intelligence Committee (NEIC)
The email was sent on 2013-10-09 11:37:42 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 126.96.36.199 in Unspecified, Nigeria
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] via 188.8.131.52; Wed, 09 Oct 2013 10:37:42 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||none (domain of yahoo.com.ph does not designate permitted sender hosts)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||NIY3xAgWLDsH.ggPrfQEEU6jV2M6GUBLz.YRw7tNiuOOJRIT hwJyRKfdmIwP2R0mKJ1riP2eqPLL7_10MJiZPDXVrr4ASekh1EpW8ynr0iC9 jTNFpMCTKCvk65DReD1rFbAOd0A9I.G8_52WKCN25y37yC0WLtZRTgHDXaOq 1JHq6CUcL1T1ahykIrDXJt4amCV5XA6p5AA_i7N_kRPb2Pi_Xky6S3VLycAE evJG1MVi1FLVuxGZ0IUx8EQ5TgcQJLlu2YIvRwZcuGAo5oI7lL9xUNoef_Tn .fAGetQcE.s3Dl9v9uUhkY2EDdn2q5xDO4bxG7Yg8c7cB0yjyiHOHkkRmBdN V69WvvNZCCKCLLAUsWqSMIUNn6.IeqqDu5r31zd_qSJ3uSjTYPP9FHV3htGa 3BmezGjk_6fnhHrLisBwsZhpFlLQW9L61V7MahqUeR5sWuC6RPXWs9vWmdrD sfq2yynXGXMaVRdTNxlWoWIV3M7CwTuJA0uiAKy4yTjxHZBGLN.2DuaLb1LN MYJgofCeEyfAmDeLmTP4sou5ppZrDp4pgoogQWC_y0XpH_ozofRjJqk6kNJy yFrNsexQJZgmYbwok1lqeovkkZ1Bc1.9YsL17yn73P6qOA80_CHQYQpgyOyS xhuiFZNVU_kLtn1ayAcJorG7lHqqtuO7aULLIgfZxeAPv80S_qs81UcD6o79 .7glSwP2z51922L7g8R.i_5un9oRlsbJYfZFM8Jntdpwi_cnOu5ie8I84u3. t91QYz1.0tnXpHufT2WrBi7Zxike.5X21IXwHGn5JFVqcGBmT6lFxBWF7lHu 9Etf_QCEXU.f2PD6b39U4I9uV3pF2qqJZs0Cmm26BoiZ8D.lp6mE0jYHrJNM K6m4_BFMWu621bDs7x5vv1OzL0QALlacln7F_S8R5UMskxK7YYySffFmpNrN TckQgSBLpv0SDA0qD5w5_HQmep6Uihx1vC3tuz.C9R0rXLNBvLX2NT82OcaT LcOAUeGzQGeTzlOhArhMBp_Cq8hMen7rndPlbJeOxcet3i8S42Uq_Bpsoq0Y HMN8d4iWaX.cWeNBmxmWJd7L40sOVBUTuocbMyO8v2iTIYYtvwZDaIQkFzrj RSvvtw7qzV2pSOeBx3FqHZEQrT9qfO4ANqMbObCCL7nkEjD.FAYBgKiRZOR2 ZiLh7GyJ_68a2MQOAZO.mEaBKqUFOdTYkPrkbPUtTm2Evgx0gfC0v6RYzU.w puRqMD.E_e0kM6c8WC6v6u3HOKVFsYfvFaegXVuUn2hEhVLzKBP7_dYQ4ZM7 B7C9_.3QA8ljUCL.xEStfKDL5LuR2JCPXwwBFJMlIbEhTC3VIIwF15TCuEkz Zs_bSEyNgkffKZmZnreweR_61rxq_7AIByAHGhE-|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[184.108.40.206]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta1433.mail.gq1.yahoo.com from=yahoo.com.ph; domainkeys=pass (ok); from=yahoo.com.ph; dkim=pass (ok)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO nm13-vm5.bullet.mail.sg3.yahoo.com) (220.127.116.11) by mta1433.mail.gq1.yahoo.com with SMTP; Wed, 09 Oct 2013 10:37:41 +0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from [18.104.22.168] by nm13.bullet.mail.sg3.yahoo.com with NNFMP; 09 Oct 2013 10:37:39 -0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from [22.214.171.124] by tm11.bullet.mail.sg3.yahoo.com with NNFMP; 09 Oct 2013 10:37:39 -0000|
|Received:||from [127.0.0.1] by omp1004.mail.sg3.yahoo.com with NNFMP; 09 Oct 2013 10:37:39 -0000|
|X-Yahoo-Newman-Property:||Custom Yahoo header for version information||ymail-3|
|X-Yahoo-Newman-Id:||A message ID applied by Yahoo for reference||[email address removed]|
|Received:||(qmail 50346 invoked by uid 60001); 9 Oct 2013 10:37:39 -0000|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com.ph; s=s1024; t=1381315059; bh=k1pMfikSIP7CKxieWk8R3Xb0HpmSZRA+SEhkPsuGcIE=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=1+oOmYO7IhIZVU6dXAYU7czpkJPAh+525wQFHE60C1AmEdddx5kFooCU6v7GSp2/sgAbc62mKGDILBq5NopsjEB/7AKKM+YtwGkwlgF0uSzokhUoFtVaLqFlne1AauRiYraBEqfIfQTlxrADvvfb1NKwXxOb3rf2dTw/Jd73I0w=|
|DomainKey-Signature:||Used to verify message integrity||a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com.ph; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=JixS+bQvdup2VsCsMdkdqwlVMsR2FuZ85DsiTHCRCQCNSzdmcMnyM+iiAifw58kVUJD/HOi/aHRsZZpUqa2kZ33rM38fXxndJrsVyEj4ianHmNiv/0I3r0cNgbA5i6qDBAJHFDpBkNhaNwrBsBqEZReiIwCMSID1ZVp+fnhHW0M=;|
|X-YMail-OSG:||A unique ID added by the Yahoo Outbound Spam Guard||KHjOTDsVM1mxs4kmQ.8cG8HZYoIace9N_EVBgOorqYhFcSu b0HUacIOJzxDXdGtqdcmUGkc1Ex6EOoxvdsL_PGfh0P2XVZsvoBCIFfr02H9 FqzVwBaoC6JkKO0GwTZrAplEbNPK4TitssYoIafDsno7H.k740wqMOR7v7Py yTa224b18uoi33dMgZSRMv09PgqlYGW.BH0ztdLW31YgEVNTjKenkb8BP51t eWC8srkqqb_BY7tkzS2V2ZEAqw6CLEaOdoKg3qbgIIG7ID_uPF9CI23q5vb1 Yi60Kq848p76M.9z_yDtPUOk51UiKYp6qxKdtHNL8FTtSuzcCu_HRfIFhFJ0 pVfp1rMJmw9BA0hxhGLsyexi3lx0yLDv_sSsUzBypMzIqARcp2ZFpwRULapc bCLIGvl2qC0R2soWTsQqMeMOR8SJKv3VKH01jCIH70hARxmD.t5ZmRN95VGr fEPBEkKtFW0NA.YYsQoxLw1u.T7_jpgIl3UbHkiKAcKSbjA--|
|Received:||from [126.96.36.199] by web193903.mail.sg3.yahoo.com via HTTP; Wed, 09 Oct 2013 18:37:39 SGT|
|X-Mailer:||The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters||YahooMailWebService/0.8.160.587|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|Date:||The date/time the email was sent||Wed, 9 Oct 2013 18:37:39 +0800 (SGT)|
|From:||This is the address the email was apparently sent from||Allen Woods [email address removed]|
|Reply-To:||This is the email address any reply would be sent to by default||Allen Woods [email address removed]|
|Subject:||The subject of the email||National Economic Intelligence Committee (NEIC)|
|To:||The email address(es) the email was sent to||undisclosed recipients: ;|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||multipart/alternative; boundary="9011043-440072049-1381315059=:49648"|
|Content-Length:||The size of the email, in bytes||4638|
Your content is below the advert
The Presidency 7th
New Federal Secretariat Complex
PMB 298 Garki-Abuja
part of an ongoing annual Foreign Payments Reconciliation
Exercise(FPRE), The committee was instituted by the Federal Ministry of
Finance with a mandate to review cases of pending international payments
and make settlements as appropriate. Our investigations reveal that
you have been through various bureaucratic difficulties in a bid to
secure the release of your funds, especially as it concerns payment of
Consequently we advice that you stop further
communication with any local representatives concerning same, We know
your representatives here in Nigeria or anywhere will advise you to
still go ahead with them, which will be on your own risk, if you proceed
As it is evident that you have met the requirements. An
initial sum only will be paid to you as part of your pending payment.
Please contact Kelvin Williams of FBI for Africa representative email email@example.com you should please re-confirm these details for purposes of verification.
1) Full Name..................
2) Contact Address............
4) Fax number for direct communication.........
that this is the second and final notice on this subject. Your funds
will reflect in your nominated Bank Account within three Bank working
National Economic Intelligence Committee,
Abuja In Conjunction With Federal Bureau of Investigation (FBI)
Anti-Terrorist And Monitory Crime Division. J.Edgar.Hoover Building Washington Dc
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)