Scam email #54109 - YOUR FUND DETAILS WITH CITIBANK?
The email was sent on 2013-10-18 02:04:59 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 188.8.131.52 in Unknown, Canada
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] via 184.108.40.206; Fri, 18 Oct 2013 01:04:59 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||220.127.116.11|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||fail (domain of citibank.org does not designate 18.104.22.168 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||evdtY0MWLDvZY0ZoVCcNWK1MK61g9xfHC38sdJu5qDJaKW9w cbhc_pOKyHTb5XA69PDn82NaEd4owVGTGlsxmm4KnmSUd6AP78N3deNOSgM1 nOp2xMwyceJoWnpMswTAcLGSxWYA869isdi3tv_v91lkeo0n2ezWTaBEr.MQ atGhA1tybzcPvja6KN03CTZTUKXIRLD96OQG1id02RO3NP3EfAXgboR_DkD4 oRjq5qqmsLGj_lCyjHksj8DgFs2YDgev6e.KZKBtSDXIoKSs8doz20nK6Vg6 qw8hHqjlD243fNJBZDWmxyPgB0hg8aEEGXMKwJjW39M8yVzouswOW84g4K8C 9JWg7qPLwCXwQvqdUgtLEuSRnOXlSZVrjED_IZcs1GnHNUCQUjTx6Cb1CtaD XhI2fOpnsjHFvV_14_K5erWwnn9ImDlQEy31RivAQK7XUgZsEWNvlgoOPuvK hLtcUS_Wd.o.OnqIB6XC2tV16T4_LJwKwj5Zij7WxEXcVIMirJq3zP.EiHIY lboLx.zjNY59s58QB3Jn43YIirMz5Qx.XD.VPgB8AgIwTJDZ7EOyRSI.qvhj kuoAxzDaSVvqkXwWjx6ricZ2Mxi2nuiQYlTbJX4HoUyX82nQ1kvKKmihECql PofvwWRnfk2JzK8_gtC3ueG9WDxIcWORRUJtgRo4dp73OsoyV0SQZVrwAV4A g.v98veNYi0rbEsjJBBMS6A3pFdenvTB1ClqUQwoveyuwTjVP7sXRMHJdHOO Ck.nxY5QP.mEP3K4ya09dap4h.drCBqOKVLN5GiWx8V2YNkSQOeHDZUbHJzL _Q33DFxE2vjoyjPWvupSqNs3i8X427zfsJ88J33C6IlJQTMg9J.EJEAo3A4D m4kJAqZSg_dba_Rdr3kTSgBQd3UbGv4NSEsaoAd44cbHXwLQ1k8CeioYqIAI OQwWFbsReTrkPJja3zkfhwK1OYzEZZUA0CRAqekkQkLt6rL57oTadFwcjHf1 __JfSCLWN8.i.VjIQtOo4QStXWBUFWm8R2idaOGAJ6.U5NNaY5GnxU7wp.eb FartY5AYnjp_iAh_XEur3.HzO4MxME4pJldRLFv7CsuCmhHJDg2r8wDtIhan ZqKEFkM0alP.QsEZM2CopJekijqcAQFdXV7Qn2p_8kHNU61em9e1x26TB8mL wHhpStmXgpYMMJA3uaGedNifitQtY9_Btcr.JEBSVsLQRMnqsYKvkI9Rl2SX kCfBMicqRi8Jl61NR2C.MXmAljdFGht0|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[22.214.171.124]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta1468.mail.gq1.yahoo.com from=citibank.org; domainkeys=neutral (no sig); from=citibank.org; dkim=neutral (no sig)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO nm35-vm6.bullet.mail.gq1.yahoo.com) (126.96.36.199) by mta1468.mail.gq1.yahoo.com with SMTP; Fri, 18 Oct 2013 01:04:58 +0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from [188.8.131.52] by nm35.bullet.mail.gq1.yahoo.com with NNFMP; 18 Oct 2013 01:04:58 -0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from [184.108.40.206] by tm17.bullet.mail.gq1.yahoo.com with NNFMP; 18 Oct 2013 01:04:58 -0000|
|Received:||from [127.0.0.1] by smtp203.mail.gq1.yahoo.com with NNFMP; 18 Oct 2013 01:04:58 -0000|
|X-Yahoo-Newman-Id:||A message ID applied by Yahoo for reference||[email address removed]|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|X-Yahoo-Newman-Property:||Custom Yahoo header for version information||ymail-3|
|X-YMail-OSG:||A unique ID added by the Yahoo Outbound Spam Guard||Q6TpPscVM1kJqxEYow7_1LAYY7AdtHejU9a2gzv3lp_.YTR je0IaoCGgPe439ihK3oMMytAZsYhlldxZXq8cgPJa1GgBsuIep_fkOZprm40 DpEGt.w76BujT1fwCeBmpU4POkbNVL7Zt66inMbTrre25PEOqTNB7Wl.v6GT .9GkSxrWRhBA4.Dfvc1PKP2BCT9nR.o9c4or3MzKQDHyXB_6urrJZ0OGIl.O 5CUHZgWHaAdHB7eBNyaYOLQklmdIiGeVNm6gxk9VaIYWlfMXSYU.i.3J3WOU hR47i_oKFpVzlHVyW0nZYr_v50v2I_5_4gNbRgGTUsJe5mRghiVWcLbBwW1X bpMsif1PPuhhei._khQEMXmNoObH3c9Gsmc_6fC635qSOkFzCXCFwp0JDivb MVMpXOXL.WvUpG7LzJudXdXEg_llYHsBppg9wNw6f.p.JfD1VgCAwzQgZOOs xeUDdzKfDa91YR7vwOJ3W4eMfjK8weiJWH1yqKnjz4jHUKQH0bE.sn8CGKrD seauwPDTqm760lF3Al6g7BlHCboYCSG4WfAN7QahZjnyxRFS71LsptGV0DCV 9Nw--|
|X-Yahoo-SMTP:||A unique ID/signature added by the Yahoo SMTP server||Tg2GaceswBCjfBni4F7jhQmCeZXo72OehDYBrMdy|
|Reply-To:||This is the email address any reply would be sent to by default||[email address removed]|
|From:||This is the address the email was apparently sent from||"Citibank International [email address removed]|
|Subject:||The subject of the email||YOUR FUND DETAILS WITH CITIBANK?|
|Date:||The date/time the email was sent||Fri, 18 Oct 2013 02:04:41 -0700|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||text/html; charset="Windows-1251"|
|Content-Transfer-Encoding:||How the email has been encoded to comply with regulations (e.g. maximum characters per line)||7bit|
|X-Priority:||Email priority, as a number. 1 is highest, 3 is normal, 5 is lowest.||3|
|X-MSMail-Priority:||Word equivalent of the x-priority header, High Medium and Low match up with x-priority 1, 3 and 5 respectively||Normal|
|X-Mailer:||The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters||Microsoft Outlook Express 6.00.2600.0000|
|X-MimeOLE:||If the x-mailer is a Microsoft product, there would usually be one of these x-mimeOLE header fields too, just giving the MimeOLE version used by the software. Many spam email headers miss this out if they faked Microsoft Outlook headers and thus get detected as spam||: Produced By Microsoft MimeOLE V6.00.2600.0000|
|Content-Length:||The size of the email, in bytes||2339|
Your content is below the advert
Citibank International Plc.
Head Office 33 Canada Square
Canary Wharf London
E14 5LB United Kingdom
Direct Office Line +44 7005 9311 92
Direct Office Fax: +44 7005 9311 26
I AM VERY AMAZED THAT, YOU CAN MADE PROMISED AND FAILED, AFTER WE HAVE CONCLUDED WITH YOUR COUNTRY GOVERNMENT AUTHORITY AND INTERNATIONAL MONETARY FUND TO ALLOWED YOU OPERATE YOUR CITIBANK ONLINE ACCOUNT FROM YOUR COUNTRY AND ALSO USE YOUR CITIBANK MASTER CARD FROM ANY ATM IN YOUR COUNTRY
YOU TOLD ME TO GIVE YOU INFORMATION, WHICH I DID AND YOU DID NOT RESPOND SINCE THEN.
NOW, WE ARE APPROACHING THE FINAL QUARTER PAYMENT OF PHYSICAL YEAR 2013 AND MY BANK HAS QUESTIONED ME TO KNOW IF YOUR FUND SHOULD BE MOVE INTO UNITED KINGDOM GOVERNMENT TREASURY AND ADD MORE TO UK ECONOMY OR YOU STILL WANT TO CLAIM YOUR FUND AS THE RIGHTFUL BENEFICIARY???
PLEASE, REPLY TODAY TO ENABLE ME GIVE YOU MORE DETAILS AND WHAT TO DO AND GET THIS DONE BEFORE END OF THIS MONTH.
Thanks for choosing to bank with us
If you have any Further question, please call
+44) 703 595 7229 DIRECT LINE
=> Switch Board Line +44 7005 9311 92
=> Direct Fax: +44 7005 9311 26
James C. Cowles
Managing Director and Chief Operating Officer
for Europe, Middle East & Africa (EMEA) and
Head of Western Europe at Citibank International Plc.
Head Office 33 Canada Square
Canary Wharf London
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)