SCAMS | EMAIL | PHONE | MAP | TAGS | EMAIL ANALYSIS | IP LOCATOR
Click to go to Scammed.by homepage
Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD


Scam email #230227 - Invitation: Hello Dear

Email info

The email was sent on 2017-07-10 11:53:10 and appeared to be from forwardinggar@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to forwardinggar@yahoo.com which was the scammer's actual email address.
It was probably sent from 98.138.226.172 in Unknown, Benin

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Your content is below the advert

The scam

JUL
10
"Hello Dear"
When Monday, 10 July 2017
09:30 PM to 10:30 PM
(GMT) Greenwich Mean Time - Dublin / Edinburgh / Lisbon / London
Message I have registered your ATM MASTER CARD worth sum of $4.5,000USD with FEDEX COMPANY this morning and we agreed upon that, the delivery of your ATM Card will take off tomorrow morning, So reconfirm your delivery address to FEDEX New Director Dr.Larry Cowest Email (fedexcouriercompany234@gmail.com ) or Telex +22961778524) reconfirm your delivery address such as (1)Your Full Name============(2)Mobile Phone Number=====(3)Current Home Address=======(4)Age===============(5)Country===================(6)State=====================(7)Occupation============(8)Marital Status ======(9)Gender ========= Best Regards
Invitees herewego420024@gmail.com
Doctorrodneysoul@gmail.com
oldacre84@gmail.com
Penelope.Harpendale@gmail.com
jarmolatvalaho@gmail.com
35 more...
This Event invitation was sent from   Yahoo Calendar



Attachment content - invite.ics:

BEGIN:VCALENDAR PRODID://Yahoo//Calendar//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT SUMMARY:Hello Dear DESCRIPTION:I have registered your ATM MASTER CARD worth sum of $4.5\,000US D\nwith FEDEX COMPANY this morning and we agreed upon that\, the delivery of your\nATM Card will take off tomorrow morning\, So reconfirm your del ivery address to\nFEDEX New Director Dr.Larry Cowest Email (fedexcourierco mpany234@gmail.com ) or\nTelex +22961778524)\nreconfirm your delivery addr ess such as\n\n(1)Your Full Name=============\n(2)Mobile Phone Number===== =\n(3)Current Home Address========\n(4)Age================\n(5)Country==== ================\n(6)State======================\n(7)Occupation=========== ==\n(8)Marital Status =======\n(9)Gender ==========\n\nBest Regards CLASS:PUBLIC DTSTART;TZID=Europe/London:20170710T223000 DTEND;TZID=Europe/London:20170710T233000 PRIORITY:0 SEQUENCE:57 STATUS:CONFIRMED UID:ce7723ba-110f-4ce5-b048-019fa94b13dd DTSTAMP:20170710T085305Z Censored Censored Censored Censored m Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored ATTENDEE;ROLE=REQ_PARTICIPANT;RSVP=TRUE:mailto:[censored]@yahoo.com Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored Censored ORGANIZER;CN=forwarding gar;SENT-BY="mailto:forwardinggar@yahoo.com":mailto :forwardinggar@yahoo.com X-YAHOO-YID:ufc5mj3ynl2lz3lvbt4vqer5rj3se2jcmyhgr3qm TRANSP:OPAQUE STATUS:CONFIRMED X-YAHOO-USER-STATUS:BUSY X-YAHOO-EVENT-STATUS:BUSY BEGIN:VALARM ACTION:DISPLAY DESCRIPTION: TRIGGER;RELATED=START:-PT30M END:VALARM END:VEVENT BEGIN:VTIMEZONE TZID:Europe/London TZURL:http://tzurl.org/zoneinfo/Europe/London X-LIC-LOCATION:Europe/London BEGIN:DAYLIGHT TZOFFSETFROM:+0000 TZOFFSETTO:+0100 TZNAME:BST DTSTART:19810329T010000 RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU END:DAYLIGHT BEGIN:STANDARD TZOFFSETFROM:+0100 TZOFFSETTO:+0000 TZNAME:GMT DTSTART:19961027T020000 RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU END:STANDARD BEGIN:STANDARD TZOFFSETFROM:-000115 TZOFFSETTO:+0000 TZNAME:GMT DTSTART:18471201T000000 RDATE:18471201T000000 END:STANDARD BEGIN:DAYLIGHT TZOFFSETFROM:+0000 TZOFFSETTO:+0100 TZNAME:BST DTSTART:19160521T020000 RDATE:19160521T020000 RDATE:19170408T020000 RDATE:19180324T020000 RDATE:19190330T020000 RDATE:19200328T020000 RDATE:19210403T020000 RDATE:19220326T020000 RDATE:19230422T020000 RDATE:19240413T020000 RDATE:19250419T020000 RDATE:19260418T020000 RDATE:19270410T020000 RDATE:19280422T020000 RDATE:19290421T020000 RDATE:19300413T020000 RDATE:19310419T020000 RDATE:19320417T020000 RDATE:19330409T020000 RDATE:19340422T020000 RDATE:19350414T020000 RDATE:19360419T020000 RDATE:19370418T020000 RDATE:19380410T020000 RDATE:19390416T020000 RDATE:19400225T020000 RDATE:19460414T020000 RDATE:19470316T020000 RDATE:19480314T020000 RDATE:19490403T020000 RDATE:19500416T020000 RDATE:19510415T020000 RDATE:19520420T020000 RDATE:19530419T020000 RDATE:19540411T020000 RDATE:19550417T020000 RDATE:19560422T020000 RDATE:19570414T020000 RDATE:19580420T020000 RDATE:19590419T020000 RDATE:19600410T020000 RDATE:19610326T020000 RDATE:19620325T020000 RDATE:19630331T020000 RDATE:19640322T020000 RDATE:19650321T020000 RDATE:19660320T020000 RDATE:19670319T020000 RDATE:19680218T020000 RDATE:19720319T020000 RDATE:19730318T020000 RDATE:19740317T020000 RDATE:19750316T020000 RDATE:19760321T020000 RDATE:19770320T020000 RDATE:19780319T020000 RDATE:19790318T020000 RDATE:19800316T020000 END:DAYLIGHT BEGIN:STANDARD TZOFFSETFROM:+0100 TZOFFSETTO:+0000 TZNAME:GMT DTSTART:19161001T030000 RDATE:19161001T030000 RDATE:19170917T030000 RDATE:19180930T030000 RDATE:19190929T030000 RDATE:19201025T030000 RDATE:19211003T030000 RDATE:19221008T030000 RDATE:19230916T030000 RDATE:19240921T030000 RDATE:19251004T030000 RDATE:19261003T030000 RDATE:19271002T030000 RDATE:19281007T030000 RDATE:19291006T030000 RDATE:19301005T030000 RDATE:19311004T030000 RDATE:19321002T030000 RDATE:19331008T030000 RDATE:19341007T030000 RDATE:19351006T030000 RDATE:19361004T030000 RDATE:19371003T030000 RDATE:19381002T030000 RDATE:19391119T030000 RDATE:19451007T030000 RDATE:19461006T030000 RDATE:19471102T030000 RDATE:19481031T030000 RDATE:19491030T030000 RDATE:19501022T030000 RDATE:19511021T030000 RDATE:19521026T030000 RDATE:19531004T030000 RDATE:19541003T030000 RDATE:19551002T030000 RDATE:19561007T030000 RDATE:19571006T030000 RDATE:19581005T030000 RDATE:19591004T030000 RDATE:19601002T030000 RDATE:19611029T030000 RDATE:19621028T030000 RDATE:19631027T030000 RDATE:19641025T030000 RDATE:19651024T030000 RDATE:19661023T030000 RDATE:19671029T030000 RDATE:19711031T030000 RDATE:19721029T030000 RDATE:19731028T030000 RDATE:19741027T030000 RDATE:19751026T030000 RDATE:19761024T030000 RDATE:19771023T030000 RDATE:19781029T030000 RDATE:19791028T030000 RDATE:19801026T030000 RDATE:19811025T020000 RDATE:19821024T020000 RDATE:19831023T020000 RDATE:19841028T020000 RDATE:19851027T020000 RDATE:19861026T020000 RDATE:19871025T020000 RDATE:19881023T020000 RDATE:19891029T020000 RDATE:19901028T020000 RDATE:19911027T020000 RDATE:19921025T020000 RDATE:19931024T020000 RDATE:19941023T020000 RDATE:19951022T020000 END:STANDARD BEGIN:DAYLIGHT TZOFFSETFROM:+0100 TZOFFSETTO:+0200 TZNAME:BDST DTSTART:19410504T020000 RDATE:19410504T020000 RDATE:19420405T020000 RDATE:19430404T020000 RDATE:19440402T020000 RDATE:19450402T020000 RDATE:19470413T020000 END:DAYLIGHT BEGIN:DAYLIGHT TZOFFSETFROM:+0200 TZOFFSETTO:+0100 TZNAME:BST DTSTART:19410810T030000 RDATE:19410810T030000 RDATE:19420809T030000 RDATE:19430815T030000 RDATE:19440917T030000 RDATE:19450715T030000 RDATE:19470810T030000 END:DAYLIGHT BEGIN:STANDARD TZOFFSETFROM:+0100 TZOFFSETTO:+0100 TZNAME:BST DTSTART:19681027T000000 RDATE:19681027T000000 END:STANDARD BEGIN:STANDARD TZOFFSETFROM:+0000 TZOFFSETTO:+0000 TZNAME:GMT DTSTART:19960101T000000 RDATE:19960101T000000 END:STANDARD END:VTIMEZONE END:VCALENDAR


SpamAssassin Report (spam score: 3.3)


 pts rule name               description
---- ---------------------- --------------------------------------------------
 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                            See
                            http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                             for more information.
                            [URIs: lavabit.com]
 0.0 TVD_RCVD_IP4           Message was received from an IPv4 address
 0.0 TVD_RCVD_IP            Message was received from an IP address
-0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
                            trust
                            [98.138.229.74 listed in list.dnswl.org]
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                            (forwardinggar[at]yahoo.com)
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                            CUSTOM_MED
-0.0 SPF_PASS               SPF: sender matches SPF record
 1.0 FORGED_YAHOO_RCVD      'From' yahoo.com does not match 'Received' headers
 0.0 MISSING_MIME_HB_SEP    BODY: Missing blank line between MIME header and
                            body
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 0.1 MISSING_MID            Missing Message-Id: header
 0.5 REPTO_QUOTE_YAHOO      Yahoo! doesn't do quoting like this
 0.0 LOTS_OF_MONEY          Huge... sums of money
 0.0 T_DKIM_INVALID         DKIM-Signature header exists but is not valid
 1.2 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing list
 1.0 MIME_NO_TEXT           No (properly identified) text body parts
 0.0 FILL_THIS_FORM         Fill in a form with personal information
 0.0 T_FILL_THIS_FORM_LONG  Fill in a form with personal information
 0.0 T_FILL_THIS_FORM_LOAN  Answer loan question(s)



Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)

Comments

Where the scam probably came from



theScamBaiter freight bait archive, theFailure Cole baits   theFAILURE freight bait from theScamBaiter - Cole v2.0   theFAILURE freight bait from theScamBaiter - Rebait at Cole's   theFAILURE freight bait from theScamBaiter - the Martins Cole saga   theFAILURE Butch Driveshaft telemarketer phone baiting   theFAILURE freight bait from theScamBaiter - Anus Laptops commercial made by scammer   theFAILURE freight bait from theScamBaiter - script of Anus Laptops commercial made by scammer