Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #254795 - Your Abandoned Consignment

Email info

The email was sent on 2018-10-10 13:16:08 and appeared to be from wi8e9erwww@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to airportauthorities@seznam.cz which was the scammer's actual email address.
It was probably sent from 87.248.110.31 in California, Location found from phone number in email

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Wed, 10 Oct 2018 10:16:08 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	87.248.110.31
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of yahoo.com designates 87.248.110.31 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	0ao8sqUWLDvuapC7DwLit044U3ZsSfsgPFSmuzOSmxsGlZeE SyVRKc1sxWSxwJpCml.fovz9qrMywVgGoh6XytuRvNkaYQODSb.d1HwLje9Y jkeFk39bpBYMwKHZD3yY.RppTppSKvRvWTQH82.1R0vdybrP_hQNFg3l7iWO 1iyvaolYDPemKknQdO97w57adcIiR9ZZ.dzmk_P19QVglA3OxA1MzJEz315U _t4RxMDkHMlhmw6QpzVRoo7v0yOmRWSPH5vI9t23nmMAzA.CUEhKw6eIVMMz vl91HaKHi2KhWkpKx6MXjyKz4CZifSX0R3Kk3dW1EUMPpYC.R3088_Dal399 YmlZgazz3PXVi4iqTFyLeMWGKV_xKb4hSXu3MXoStPziqskhe5sAf8gxOcnn vXfh.41PjqVM_uov8PxGviUUjgPP.j33KE766D0xnNaqYYu_1Y7EF3Fs4NgN C6ggcR9aeyard81xXMlodz8yr2D6t8qqGPuELJ1GVxS4hqAFUMGpi34R4btM PGebzjhuqijb5ZVzmI3auglg.czbAiYQ4blbBtekTrWqNq6MsjEbUPkyCu_R bazNfKueF8kj1hgtfgZ34TMFuwdiwkVEg7bAvjlv5XeiEw305S45DKxD.vfY 5gaX.3_XKFX0L7DHywX4RPIul_FTOP7t6TCh96GYn5kc9ihZcpGrzwqgSXn4 k2A0CyD.FVbGkK1HnI2G_0FPO0iE1G6R0yKBeJsPSli5oEPwdzN_3a8ZBkc4 WCYMtfDwh6UHMW5aumIHXEQVtp96Hq8J9fZzFW.sBPzxyBTkwy_IYv1mcysy bgt67Jy9ajFJI7l.JojZukZ93ODrt6okFPLcFYHM5bx4XY2angfUcHoZP8ez k.wCI0VnEXVi6vcvldDU9wlTJejlBdA5tfMh_RPZJf25v0aaTX74SqOh0ytQ jXXxDljeHxrYvqy9kg.ODWj65VqKmm9z2lcCvRMHT3Ad.BZ9ArxLAselfuzb BSqiuKO2ityPY6ZyCAD09xn.GcAafoziNWqmxmuDWrHEignMpZaNry3aooDZ B8mOdG_rrcCvNitikNRfiJNszqOdYD_OWvkjaYrY6CjU4Nm1cExeNFjAFJGm ut5tgbmvDzDuUDosvpjimC3uj6WxzMZINW19voEgWjENcrMmg76VR9AOUVg6 raAsju6eihkPuzektqhea8MhLnruGwdwnix1R_R0SdmjWjHXjWKONq2v_GMU df5nOCZcVjw3Cu7M1Sd43A5Y8lAuk3zWhZzn2f1ouMAEqlSn1g--
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[87.248.110.31]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4396.mail.ne1.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic307-54.consmr.mail.ir2.yahoo.com) (87.248.110.31) by mta4396.mail.ne1.yahoo.com with SMTPS; Wed, 10 Oct 2018 10:16:08 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1539166566; bh=qMh8GEMqqLi98/GUqZk8Abxsz+AHCF2lWxemh4RRL3Y=; h=Date:From:Reply-To:Subject:References:From:Subject; b=kRU8VwS0hYy4W7q/aZBEIV/V2LOHLhVlcjRue4rwSsk5+QTXSsNMs25t8uKEt7QHy6S3sRJeY65xDS3bBnMM3uGGk3OuuK/wsvFVPEjivPdxew0NtMJzS9qD5mLUwt/JyVsC8QicuNf3GSDKqff4CvuTuqY/d1aDZ/nAo9w9vZUOtypmFAF7oJt26lr5GT8m2elj2wKqS5pegT5exDwEbVCHPmy2IQ0WZRzoAQhfqBm6fpmUWxEFdxSTTHps5ITDYwscf8apeNImuVmPAhldq7I87GAibpf5IBStDVhc1fDxdRUte8dFZxSLvjGZUweRBe8XFPqZPxesPeoEj9N5+g==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	ygXww3MVM1kqMxpsvQTxz_QZvAVZbmF4HRUNiu31sYbzA6DkJaUhPcIobD_UOok PGoFDEAyVwRJtHDe6SAifTvAWihfw7v5lA6M74PKegCPkRc7kFbZNfJCXf87YIa0f2irYF8RqJmh IrQ.6On10fbldKCPypqV.Uarq.sLeBTV8t7V6SiSfUJEFQZB9cBQFEtlsvbwbBjOdH5IXqTxmnqq EUOz6Fvzok6EPC_oGorn6pLygLTWhdMfbzzCsH45.lv8p6Ev8oC8r9E_Y1XuUykcgF8Kb4_XV0ao 2NUUGNQYivbjKMOFG65Su.fsSBGozgAYJ8p0b2HuU3DEtw6a3VstA5osV4.t1jgDrvVpOTultJed Qi9SMG_HfVafuTCoAvTStEwYwbrwO8ItOBvv9Bo2fsVc3qOmNXMIALkvtb4nDB_9vtdeRW_aT9hU vwLSPLLrwoZehzCsdceIzAkuxEJBdvQdFawJt3PL_6jzSR5IENLpVFlOYXcuQanfzbGckHfzuOOC N7N.wboPR_TIbKFYQhlEJzSrsH7Sdun6hkPLlE74iHAg.JRkRcv4BbAcVW.175ROjbz7vFd3QpC. 3YvfhYjXMS3rTmh2Qxe8.GpGEHHM0gK7QDdaB4rQvCIMRpnYsfvMy.uGdWgVnBSRkiN3qdYoyMJC dEdVCW53SAKsN1WgUI6NDDSpqBTLbvZAIy2VK6ieW.SB9AoYBb8Zg9_._5V8el7dnL6.NXRQd_7j hWINf01ZPnyXObU0v8BMlrd0G.12wbBLkMjC3NX5v8u4VWoFv7p2OGF9TWfNvUArmNUPM69IHXtU oj2f4bcvEU4n30lUjP6p19WZ.MO63To.87tj0xrIMIGKfBulSo9ID1eVO0B9CYGm5tJvOQ2dihCl cLlBC_U6iivw.L732WwWgH6eo0NPUoJZhT8CD.T5elqcqOAD7BBx7wtNpVXU4no.qwC15wwauc7T 5qcXOdrp6GB8k9hdK_KsCs.KxzOY8oC4.1XXykihFPVLJj5Dj2Ifu9qzpSuUshfDGAEAXatzwbHZ PFa6Euxwc_AJy_XLbaqRwvIu8CDLFGnNMpDPya3tQruYYL0kRV76.MAb7jvg-
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.ir2.yahoo.com with HTTP; Wed, 10 Oct 2018 10:16:06 +0000
Date:	The date/time the email was sent	Wed, 10 Oct 2018 10:16:04 +0000 (UTC)
From:	This is the address the email was apparently sent from	Your Abandoned Consignment [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	Your Abandoned Consignment [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Your Abandoned Consignment
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	quoted-printable
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.12579 YahooMailBasic Mozilla/5.0 (Windows NT 6.1; rv:62.0) Gecko/20100101 Firefox/62.0
Content-Length:	The size of the email, in bytes	3597

Your content is below the advert

The scam

Mr. Peter Anderson
Interim Assistance General Manager, Des Moines International Airport
(IATA: DSM, ICAO: KDSM, FAA LID: DSM)United States of America

Re: Your Abandoned Consignment for Delivery $15, 000, 000, 00, USD.

I am Mr. Peter Anderson, head of Consignment/baggage storage facilities (Operations, Maintenance, Transportation) here at the Des Moines International Airport (IATA: DSM, ICAO: KDSM, FAA LID: DSM) United States of America. During my recent withheld Consignment routine check at the Airport Storage Vault, I discovered an abandoned shipment from a Diplomat agent,Mr.Smith Thomas and when Luggage was scanned, it revealed an undisclosed sum of money in a Metal Consignment weighing approximately 47kg,while the Consignment was abandoned because the Contents of the Consignment was not properly declared by the consignee as ?MONEY? rather it was declared as personal effect to avoid interrogation and also the inability of the diplomat to pay for the United States Non Inspection Charges, which is $350USD.On my assumption, the Consignment was still left in our Storage house here at the Des Moines International Airport (IATA: DSM, ICAO: KDSM till date. The details of the Luggage stated your information, but none knew if you still alive or dead, Noted, your urgent response is highly needed right now, if reference below fund would be delivered to you by reconfirming your details to us now.

However, to enable confirm if you are the actual recipient of this Consignment as the assistant director of the Inspection Unit, I will advise you to provide your current full address if you still using your normal one or you have changed a new once, in other to help us cross check if it corresponds with your address on the official stamp including the name of nearest Airport around your city. Please note that this Consignment is supposed to have been returned to the United States Treasury Department as unclaimed delivery due to the delays, in concluding the clearance processes so as a result of this, I will not be able to receive your details on my official email account. So in order words to enable cross check your details, I will advise you to send the required details to my private email address for quick processing and response. Once I confirm you as the actual recipient of the Consignment, I can get everything concluded within 48hours upon your acceptance and proceed to your address for delivery, if all your full details information receipt.

Lastly, be informed that the reason I have taken it upon myself to contact you personally about this abandoned Consignment is because I want you to have this fund and since the Consignment has not yet been returned to the United States Treasury Department, after being abandoned by the diplomat Agent Mr. Smith Thomas, so immediately the confirmation is made, I will go ahead and make the arrangement, for you to receive your Consignment, once you paid for the United States Non Inspection Fee of $250 dollars and arrange for the parcel to be delivered to your doorstep Or I can bring it by myself to avoid any more trouble.

I wait to hear from you urgently if you are still alive and I will appreciate if we can keep this deal confidential. Quickly get back to me via my private
Email (airportauthorities@seznam.cz)for further directives: You can call me on my
Telephone number and drop a message.

Mr. Peter Anderson
Tel+1(323471-1926
Direct Email (airportauthorities@seznam.cz)
E-mail (wwusaauthority@usa.com)

SpamAssassin Report (spam score: 6.9)

 pts rule                   description                                       
---- ---------------------- --------------------------------------------------
-0.0 BAYES_40               BODY: Bayes spam probability is 20 to 40% [score: 
                            0.2823]                                           
 0.0 TVD_RCVD_IP            Message was received from an IP address           
 0.0 TVD_RCVD_IP4           Message was received from an IPv4 address         
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail      
                            provider (wi8e9erwww[at]yahoo.com)                
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is       
                            CUSTOM_MED                                        
-0.0 SPF_PASS               SPF: sender matches SPF record                    
 1.6 FORGED_YAHOO_RCVD      'From' yahoo.com does not match 'Received' headers
 1.0 MISSING_HEADERS        Missing To: header                                
 0.6 URG_BIZ                BODY: Contains urgent matter                      
 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was      
                            blocked. See                                      
                            http://wiki.apache.org/spamassassin/DnsBlocklists…
                            #dnsbl-block for more information. [URIs: usa.com]
-0.0 RCVD_IN_MSPIKE_H2      RBL: Average reputation (+2) [87.248.110.31 listed
                            in wl.mailspike.net]                              
 0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76 chars   
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not           
                            necessarily valid                                 
-0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/, no   
                            trust [87.248.110.31 listed in list.dnswl.org]    
 1.6 REPLYTO_WITHOUT_TO_CC  No description available.                         
 0.0 LOTS_OF_MONEY          Huge... sums of money                             
 0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid     
 1.0 FREEMAIL_REPLYTO       Reply-To/From or Reply-To/body contain different  
                            freemails                                         
 0.9 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing list  
 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)