Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #254794 - Please I will like you to keep this proposal

Email info

The email was sent on 2018-10-10 12:34:16 and appeared to be from ubadirectorofficebn@gmail.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to justicecollinsjnr@gmail.com which was the scammer's actual email address.
Although the email apparently came from Sunnyvale, this is where Gmail, Yahoo and Outlook are. They probably hid the actual sender's IP address and put their own in instead.

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Wed, 10 Oct 2018 09:34:16 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	98.137.66.148
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	softfail (transitioning domain of gmail.com does not designate 98.137.66.148 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	49_5_3cWLDvgKFWB1yI9duDIEl9Mw_5_LvJHt.PylHUoh.cI hc_BJ4INtXuHw9cbHf0o0PcdKZY6GKOGDbKH8V1tc_4h3mcar86O6mfWoaZQ lQhgi01sSXeb1cUlHLSfg.O0F2JqYH5KFUwsyVSeMA9r6Df64XsdVWPXkWHk icgYyRrz.n57G1dRUVvUBJR1mtOHnOiMUBTDwkyt54kZhW33CfFwenJGTpeo 1a9I9pzg4HiLcgrnvhfgbPlAimjg9jbXZkewgRnyBoeggAu1pMDMg8VVTIq3 tmyjsORu5Ivt5TD1qbRh0wu5CCrtGA2l1IvIxHqhq4_gkvQWpVyfcV.9YYVL My73e_fUtvMUmVByNzTAPsUpeMAq3F6o_p1g_GZM80Ma1kEkqPjHw3o0XT3W 0qvWWHVSOOo6qD_SPI89_CISQ4BCWR0.FtYDf0DmpfJPxkgiVNL1Jcrd7Lqf M8ua.Xq.6iFbKq.ZXZgvObHk_NzSaXwReT6..pBzoT7ZA6Uj8evLRUx29M7E 3Hy3_ZMZhIVmSM3ePH_lTbdC4GHwAGzhlPZISd1_MI3hVQF87nkdVn1pz7UR INoDo7jTGwsp9ULlPs_FD3pp5msXpc.dQgbZADTpEqsL3HVuLQTuUpiF086G 3SaDglYOBADMKeANk9Ew5.dl9S_wkt.RzI3eefg4Ax2as5Jh13T_9G5UI7ZL Tc1HsIOg0vaFiwu.O1NBBhrH03WC0bT7pMjCoDCKb56.CPYb9VtPThcp6iAC fx61AnYdqSTSSNbFeXeRr7ZjnF2P3PCq3nG5yiaB3BblVWdc.9f5sru1bSyj dPGQzc9OqsH5r4mm6HmuCXqF5lZxiaL7Ad3w5FPRlREQuqjovQxRMGxIwdsK vY5eHNs3bxVTBtzJ_s_T_gq0refhHnqJoH5RCrox.Atbtv3BlRInHR4.Ibhr quFe2qCrxICNWtJ372IkHvDnPFwo8NXmgh9WEC9U39XdhoN5oCCfMZ3Uo0OS bpYaOswy0EHAxa0S2y84H7ynIENLiY8PyRXflpyo09viZY2iKxWLHfPase2G jJJ4CN4c5mWPP0HZOgYoa2JtXSq3Q6SIAk9E3i7gs8EZoX_82QRw0DKeJeTl hhXabc5jf2u_2ZucZdwLt5WJJUl1_T5mXz5UyigoIboh5R8m9wF2KMq936bk pbzcWcbCIdvCYfYsxgUHSGBO1aqTsH3tOrb.NgWBNoMJGbOMRYbMiQTuonml y2IxVUb1uFGABRp58hP5
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[98.137.66.148]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4213.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic317-22.consmr.mail.gq1.yahoo.com) (98.137.66.148) by mta4213.mail.bf1.yahoo.com with SMTPS; Wed, 10 Oct 2018 09:34:15 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1539164054; bh=F8vOXtuas+KlT1qvGCcnnH5CISifsgXXFXa2AYlTL7I=; h=Date:From:Reply-To:Subject:References:From:Subject; b=SVHEAHmf+6hd/PxWiOlc1ooItoAkeZVw1xIlWBpNBs2urtQmLMnznwf13d9SwMp0pnaur3Z5Uhm4UiFl68IB5XMeVnwyXoOQxb6Gx5AnZwdpTrml2eohYtcAWZJYnqxdDsCvTEz3dVA8VJ2bRjhS5/CJivRZO6CREA2bW+vLQ8ErA6PqnZl3HHjYCJdfsikz+sS/m95r+P9/k2fVcXCt63e+K5HupyfQ9YD17qaqceo7vk5LKSk8/YyJ1eO0mBJjEi44DXAjkCicxZDaHXceNfTNvfoPbuPFVZngGL0SjczI8nJbQ+ZAlXbUYI+pe0xVvZJz+QxJz50amDYflGaQwA==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	RsN45aEVM1m8Ia7DGP6vkGLXvnKsIVuaSYrmH3mhl2RRSDXGKxjZfwvFXa2g6lT Ek3oAwhF10gPK2rHKB8U8_c5OBK0jtlp6ENnJqqq01zkhGcLB5jwG0CRpwX5yC9K9GAXyc1q.9Bn jFX.8MstMsNZA_0o3Af22O54KTP5EAR3Q_EZuYJWGhaFEYjdrF5f4RTo.XlUtOnBxdaLTt5ZM1up NdDc4adJdkUSaSRSg2X__0.Ceo.L6.trQpITvDXEKPZHd3T2fXg2Sm_plYGUuZoLux28GpvLaGEM O6Z9md.6SVfmf8MgX2ATc.TU8EbpI7TQ6ggY0srNdu0fWmBR2Tnknkp_A3CliqLUFrm46HLQfQRc OoVMMu1XCPaXgixfnKxrJEKFPRHE_J_.sqRgvUged_18jOvemd4solnKiu6Fu4NMHMoVdzQbkJUK P95IL3ZmsR9SSn.edGLCzGIrhBRi5oKwi92PI_TQLUAYd3VcxKMx2TgfyDPtuZWHFsBucJZLRuvs m0TZz7nWnPIxCV_MjxpSDItv1YUpSQT3iyspwBxxsB4I7lkc5UHYbzViN296LogS_Ads7oH8plNZ uS0f33.03QRPUXmBaCMjTy5xXvVgaaDvJ8ZvUiLg1XtRxwcqXfgwO7nHnUUBLDr6N1rtwlYba_c_ UA8_yjQ0QoH2RKllrpTyzhfHB_vfSyrYcWAXjoavbvzD2Kn87f2uyFYRBhJMlJQhz8JserSMlG8C aiNqS9YiFBTHDV74ukLdcwKaJICf3Ei2lJ53n0TzB2L13qeo8D_cVxDkNh9tGbesnP6MXnbcFy76 Z6gMgd98s8B1Gxuyrymo922ZpIaG88ome34wk0H_PRppvrwwPA9XNQHmInC9qxnuYrGAVpthNSgQ oW_xLp8QyfFJvy0Br_zo8oBT8SdXpHmSDeL9KsSJuIyxkovbbvqbPmr_f9Vy03ANXwFnmJlA1QwV tVQ7pnufJqRdcwevuPEJrhd.jIuU15P2txaJxSA4zVKTPFxdNgMsoe_5pGdS0KfGWN5nYJ07rssY IvPK2eN4pLG2L1NgzRg0-
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic317.consmr.mail.gq1.yahoo.com with HTTP; Wed, 10 Oct 2018 09:34:14 +0000
Date:	The date/time the email was sent	Wed, 10 Oct 2018 09:34:13 +0000 (UTC)
From:	This is the address the email was apparently sent from	"Mr. Justice Collins" [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	"Mr. Justice Collins" [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Please I will like you to keep this proposal
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	quoted-printable
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.12512 YahooMailBasic Mozilla/5.0 (Windows NT 6.1; rv:62.0) Gecko/20100101 Firefox/62.0
Content-Length:	The size of the email, in bytes	1053

Your content is below the advert

The scam

Hello My Dear Friend, with due respect to your person and much sincerity of purpose, It?s my pleasure to write you today, I am Mr. Mr. Justice Collins, I work in a bank. and I get your contact from internet search I hope that you will not expose or betray this trust and confident that am about to repose in you for the benefit of our both families am in need of your help as a foreigner to transfer Ten Million Three Hundred and Fifty Thousand Usd ($10.350 Million) into your account, risk is completely %100 free.

Please I will like you to keep this proposal as a top secret or delete it from your mail box, if you are not interested. Also note that you will have 40% of the above mentioned sum, if you agree to transact this business with me, while 60% will be for me. I will give you full details of this transaction immediately you notify me your interest by sending your data.

Your Full Name,
You?re Country.
You?re Age.
Phone Number

Waiting for your urgent response.
Mr. Justice Collins,

SpamAssassin Report (spam score: 7.1)

 pts rule                    description                                       
---- ----------------------  --------------------------------------------------
-1.9 BAYES_00                BODY: Bayes spam probability is 0 to 1% [score:   
                             0.0008]                                           
 0.0 TVD_RCVD_IP             Message was received from an IP address           
 0.0 TVD_RCVD_IP4            Message was received from an IPv4 address         
 1.0 MISSING_HEADERS         Missing To: header                                
 0.0 DKIM_ADSP_CUSTOM_MED    No valid author signature, adsp_override is       
                             CUSTOM_MED                                        
 0.0 FREEMAIL_FROM           Sender email is commonly abused enduser mail      
                             provider (ubadirectorofficebn[at]gmail.com)       
 0.7 SPF_SOFTFAIL            SPF: sender does not match SPF record (softfail)  
 0.6 URG_BIZ                 BODY: Contains urgent matter                      
 0.0 MIME_QP_LONG_LINE       RAW: Quoted-printable line longer than 76 chars   
 0.1 DKIM_SIGNED             Message has a DKIM or DK signature, not           
                             necessarily valid                                 
-0.0 RCVD_IN_DNSWL_NONE      RBL: Sender listed at http://www.dnswl.org/, no   
                             trust [98.137.66.148 listed in list.dnswl.org]    
 0.1 DKIM_INVALID            DKIM or DK signature exists, but is not valid     
 0.0 LOTS_OF_MONEY           Huge... sums of money                             
 0.0 T_HK_NAME_FM_MR_MRS     No description available.                         
 1.6 REPLYTO_WITHOUT_TO_CC   No description available.                         
 1.0 FREEMAIL_REPLYTO        Reply-To/From or Reply-To/body contain different  
                             freemails                                         
 0.9 NML_ADSP_CUSTOM_MED     ADSP custom_med hit, and not from a mailing list  
 0.0 T_MONEY_PERCENT         X% of a lot of money for you                      
 3.1 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)