Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #254785 - BL & Shipping document

Email info

The email was sent on 2018-10-09 07:46:16 and appeared to be from fusen@upp.co.id but this address could have been spoofed.
If you replied to this email, your reply would have been sent to fusen@upp.co.id which was the scammer's actual email address.
It was probably sent from 45.126.133.67 in Jakarta, Indonesia

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Tue, 09 Oct 2018 04:46:16 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	45.126.133.67
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of upp.co.id designates 45.126.133.67 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	j6cR11IWLDvIoxMYMQg.dk59LaNHU5yjI8y9vHfiLuiY6v7G tNra02VeWUTk8nyTw.eoelXGcIJZ06NuRT.tQI6bfTSK8uBpGBsEgc_eN2Rh ZwpZ_DmiO9rhoTqspLvSmafM8IZBPOkXsFtBMYVXcdznheUHR2jRjOMuHQl0 uHmZzhnB_OU872ePKnXJVSHAbisS8IaQL4m69B4iFnRwGOl0ajUjDJvuI2po Rao7DY.lIcZ_zlftAVw7V5kmHlTX86SMUP9lXXBJFBHrBjgFP6_voCciPMwI j3Zns.U.K1FCb9kKoetB5BO562Jufd0jRHsQbsjaY5tIi8nfQNB.cNAyLglb xd9610HTOJ3hLkKJ2DiJWVdAMeoIyPraGYC7ancj6iU9CXhj0JRPAAk0jRzF 2htViqqW5chwcmHf.u1oLjoo.4dkzpjXzv943SisFzM1Tm6Qm9QdL7Uq3Mx8 eX.5JxacNTYdUMapfA8BraWPSBERp0dLZkFkR98.Xu4M5m0RHfg2tCxBQQI. Ho3i1i5uDFtF59cvCeaFMWlaKzyonJeKEFQQeEffkALS4UTQUi7_Y64CAZ0q fAMFPp1NqC17yyTuXv36FOevC3uL8up0kPgYejIWXzFi.Nb3n8kEwZio2qwB JCHpaBPdekHrGMaVraP9b7QXM6LsjE5Pyu44ZiZ_WP_35DP0tCHRveFq1.gI mhuQvzp8MspGFljcMH67y_.n.Ck8ovlYTqwyDujKWAEBbQdECSQwrAQU2a2g 6e2xHBzXELJSwpjGqVGj25HQ_Q5H8xRGP_JS63DrXU5rWumc3KD8ki_OE3Sh M7JOItMica8o_nTRVzGhdfSXYkWEN4VUXteUQG0veNACuk9UCBNZ5vYsfIJ8 rIF4AU9pa9gvmyZ_pJUJoDKkLly_WG8Af6V8SMTEXH.5UpM.gtGI.jitc0gj oleMp2.1soLgGj8kP0MTVFKRqurBVXESKvlXoRvZUgzQ1F4Mz0a1bCNuH2WV
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[45.126.133.67]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4423.mail.bf1.yahoo.com from=upp.co.id; domainkeys=neutral (no sig); from=upp.co.id; dkim=permerror (bad sig)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO mail.upp.co.id) (45.126.133.67) by mta4423.mail.bf1.yahoo.com with SMTPS; Tue, 09 Oct 2018 04:46:14 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=upp.co.id; s=default; h=Message-ID:Subject:To:From:Date:Content-Type:MIME-Version: Sender:Reply-To:
Cc:	Email addresses the email was copied into	Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-
Cc:	Email addresses the email was copied into	Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=IRBlBc/kGkfVFby1WbdtucKGAfFgqyxF1Hqs1LZ05/o=; b=MJFSZPkKyLnRTbbEX/GVveTHDu C8uVikGvB/kFIgVcnUMkISRs0Eh9JTSXY1nPEaGIXoEuXvxfNcDToREZgHOraTmOca/WK4WXSj1kC lBNjBxJNMZqJNUcr/Aeri9lg9AM/ga8cpujGiXv5XTsUWd/LzKsSKQrqXzfevfhgTOeABSIOmcuHo 4K2jxZ7Wr1IOS7Do/urSwV4tn+M2R3f72TMUsOmjgCaAKxs8RXLiUtdbScNM3VgvjmyB/mkwi5Dle 7T/poljATw58Co/Z5lsjPgwoNTJ7sk6jRbKzBSvh1awW5SQKpOvznvxNIEWdjpjHeDcKo2X7q4fke RqhgISrg==;
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from [::1] (port=44908 helo=mail.upp.co.id) by mail.upp.co.id with esmtpa (Exim 4.91) (envelope-from [email address removed] id 1g9jlW-0002xe-8f; Tue, 09 Oct 2018 04:37:02 +0000
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	multipart/mixed; boundary="=_c4c0463b7f8bf247bd071ac7b8e50b3e"
Date:	The date/time the email was sent	Tue, 09 Oct 2018 04:37:01 +0000
From:	This is the address the email was apparently sent from	Amanda white [email address removed]
To:	The email address(es) the email was sent to	[email address removed]
Subject:	The subject of the email	BL & Shipping document
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
X-Sender:	Further information on the sender of an email	[email address removed]
User-Agent:	What was used to send the email, e.g. a webmail client or Microsoft Outlook	Roundcube Webmail/1.3.3
X-AntiAbuse:	If this email was sent through a web hosting account the host will have added these lines in case the email is forwarded to them to report abuse. They contain personally identifiable information which the host would use to identify the sender	This header was added to track abuse, please include it with any abuse report
X-AntiAbuse:	If this email was sent through a web hosting account the host will have added these lines in case the email is forwarded to them to report abuse. They contain personally identifiable information which the host would use to identify the sender	Primary Hostname - mail.upp.co.id
X-AntiAbuse:	If this email was sent through a web hosting account the host will have added these lines in case the email is forwarded to them to report abuse. They contain personally identifiable information which the host would use to identify the sender	Original Domain - yahoo.com
X-AntiAbuse:	If this email was sent through a web hosting account the host will have added these lines in case the email is forwarded to them to report abuse. They contain personally identifiable information which the host would use to identify the sender	Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse:	If this email was sent through a web hosting account the host will have added these lines in case the email is forwarded to them to report abuse. They contain personally identifiable information which the host would use to identify the sender	Sender Address Domain - upp.co.id
X-Get-Message-Sender-Via:	The server the email was sent from, complete with username (this field is often added by web hosting control panels like Cpanel)	mail.upp.co.id: authenticated_id: [email address removed] X-Authenticated-
Sender:	The official sender of the email, can be different from the 'from' (e.g. if a company wishes to maintain that the email was officially sent by them)	mail.upp.co.id: [email address removed]
X-Source:	Server path to the PHP installation used by the script
X-Source-Args:	Server path to PHP script used to send this email
X-Source-Dir:	Web address of the PHP script used to send this email
Content-Length:	The size of the email, in bytes	203937

Your content is below the advert

The scam

good day,

Attached to the bill of lading inspection.

Looking forward to your reply.

Amanda White

3rd Floor, No. 217, Section 3, Nanjing East Road, Zhongshan District,
Taipei
Phone: +886 2 87127070

Fax: +886 2 87160088

Attachment content - Shipping Document & Draft BL.ace:

ClamAV for Windows - Antivirus report:

Known viruses: 6626722 Engine version: 0.99.4 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 0.29 MB Data read: 0.14 MB (ratio 2.06:1) Time: 22.906 sec (0 m 22 s) LibClamAV Warning: ************************************************** LibClamAV Warning: *** The virus database is older than 7 days! *** LibClamAV Warning: *** Please update it as soon as possible. *** LibClamAV Warning: **************************************************

SpamAssassin Report (spam score: -0.7)

 pts rule                    description                                       
---- ----------------------  --------------------------------------------------
0.29 MB                      Data read: 0.14 MB (ratio 2.06:1) Time: 22.906 sec
                             (0 m 22 s) LibClamAV Warning: LibClamAV Warning:  
                             *** The virus database is older than 7 days! ***  
                             LibClamAV Warning: *** Please update it as soon as
                             possible. *** LibClamAV Warning: [...]            
-1.9 BAYES_00                BODY: Bayes spam probability is 0 to 1% [score:   
                             0.0028]                                           
 0.0 TVD_RCVD_IP4            Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP             Message was received from an IP address           
-0.0 SPF_PASS                SPF: sender matches SPF record                    
 1.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII but isn't
 0.1 DKIM_SIGNED             Message has a DKIM or DK signature, not           
                             necessarily valid                                 
 0.1 DKIM_INVALID            DKIM or DK signature exists, but is not valid

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)