Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255257 - Re: Investment opportunity

Email info

The email was sent on 2018-11-19 15:02:14 and appeared to be from moatazhegab.kfic@gmail.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to mrs.muniramustafaalqadi@gmail.com which was the scammer's actual email address.
It was probably sent from 209.85.210.171 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Mon, 19 Nov 2018 12:02:14 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	209.85.210.171
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of gmail.com designates 209.85.210.171 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	I728NQ0WLDtlNXS5pAw_qDit06yGCAP6y5YXACPB.GP6RriC hFIpBPN85ogVs6XKICI3uekhVbPK.BgtVuMMMCkymEl1At6anKeI4LjtioHn g.21dZATAsM.Ih2_n18Qenzf6pNj8l2axmWOqrXFSPTNvsBs7soJ6Ku5_K7C XhokFMKSrn6Z7pjdKFXTBL0AK7rDH0KDT_MVmGqaO8QMb.9Sp2xVcoeEj1Cz MSBG2OnAKvffcmoP.nJpF2Yb7dh.ezmFFyg2CJvWGh_RcmqLd_gaxpn4ZMMa SgnC.SG78iqQV1j_P6MBR4xihjZG0QQ5TbKp4wLZfI75fjik39VGpoWB8VrE AU_eLhUAY1LxFlgs68uNqkR7qDndl.fGnU1PM9nhgw4nF9CkwXG4c2lNQiUg Xc_GVevWdWbWtGjraysW.TxvGFcIO8sBiLMrVhG.iwPvSs6ReunXGCal9ydH pLZ2BZLg8lASTt.gijL9uBv6vTuuE2Y4Z8P99r0zKWVyXWbJkk.9qBCm2j_d ScnQHr5zbKZydcZctXHu_aSX4RRuFP9HdwLTAGzzRD4sYoVSBX.0EdNScB1D K90zqHJIePijZFmk1FbZ3Jg3YT3ihO0vunwDiv9umSH5saGL99iE9sf77G3o AdSmMg5mtqjk3cj_dZcT6PbLBHCWXmAaZ9E8v5BakYh7i1vBSPFk11HBwiZc 4M6ve1JB7DKRoP1aGxi3T49QuQX1MU_vuDLAuWloOLRmuy9kac2Ffy_lqCPD dysApD0YpQ.UXG4C33UbvBHpaaxpdJaEG13jOtAgEXGkekr6oQoiVjtYbDhh 2WnzwWkjYAlbGpO_6NuUZX1s2.MMhIm0Uahymo6qNsrB0WGUT74jYDFfitQn y8Asjk_el25kNoS1EwXAy3dKzkI5HMeb6CaVn0QGEGh5ckknYPUYli235Ta4 uM9O9UUhSCAX0XC_h6_tnFqsu7acb.CPimcIGQVnicfsdubBrnW5i08xvHIg wF2JPAzOuXZdKaBeL5Nj2mfMfQ5ZuY9MO0buuaYckqzIb9uaTOSnRSeJs5Ue KZeLW4YazpiReOKhCNmqbwiXORR.Td9.2eTTQJsmO923Pm.Nxgr.y9SUTFts pKgJT4ftAiKPmHezpnIHbDv1t5XEBgwvxFwvNGk9Vj3eyqLrmrWRVxCJIj3i Jr_sjfHr.C672VuC7.xYwX0.1QGmopZhBiNj3JMgj0l5uzFQZKf.Vg--
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[209.85.210.171]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4290.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO mail-pf1-f171.google.com) (209.85.210.171) by mta4290.mail.bf1.yahoo.com with SMTPS; Mon, 19 Nov 2018 12:02:14 +0000
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by mail-pf1-f171.google.com with SMTP id z9so267100pfi.2 for [email address removed] Mon, 19 Nov 2018 04:02:14 -0800 (PST)
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:reply-to:from:date:message-id:subject:to; bh=O3Ecv5BQWAhN4t5r0FuCMoqGSpSRCk882H/fbig/v3Q=; b=IZyJkhOSiapgTXf0y8pHu0icmVEKkKVMO8tasnugHC+36cnD5kX4AMNfB4ADtmmMUJ RG6Sgf5TJ5jbCoiyio6U5UBZSuN3XWgj8q4LUirYLNWrOljoDo0QDhT+6qiWAM4SQjJK NV9VI0AkWegKkPBToW0dSJRWX+gH1D/P9PwaWODrE6fcs5IvrLsO0d3DxLaZhAYl6xVz z/TtkE3damk/z+9kU2WYQiV8QFrKLoLuFkgIbyQVCy4B4bs/BWq0jG/Wz4xGaC6b36Fr qST9yAaVNgHWiP8GRxGDqidpjCxONl2yrq5Tslurs1boNsw67reko2RuGWbJtHnwyZJD V94g==
X-Google-DKIM-Signature:	Google Mail adds this to all their headers, it is used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:from:date:message-id :subject:to; bh=O3Ecv5BQWAhN4t5r0FuCMoqGSpSRCk882H/fbig/v3Q=; b=TzZ+oUziQg27M30nYySRQBHP8FAGtl+p9cYp9si9Z61noJAgO27WwelgPxb3DxPiRy lOJqlR1KBePSjhae/KWos8hlgRyT+luAhgctZdzzuxoZE6kqO6uzPDnKXivj9QM8eYKx D0u78q/NSGH64iGaoB/SNPjcPb+bInWNcELMiBoupPXrvZKqsFdJbMjYOs87VcvnNSte P3ZcscKMZih8BA7YC9chdkifK2Jq4S4BtkM5W/tzSL8QXhkxcKfLWI7UJYq2L6nf6xG8 Iwss0zFL9qrNgWN5Pj6csUeFHjj2L1f58yDDEQKw7m8Miy2PAoyJv94+ZG9n9EYuu6he hczw== X-Gm-Message-State: AGRZ1gKx7+uzY1f8RdrlhhhftAgsbKmJLqIYt38jrIaajSwwgXLSumNj 0cim1iExjj3JLZ4kYAAP6cmduHjgUAMrRb2WPelcfmRLV3kNPg== X-Google-Smtp-Source: AJdET5f8r51lp6sY9Nth4ktV5A15uHkNa/oi6nH8GJHNoQ8AkQxQ/GjxWiflUH5/hEBL5+pDD0OPCU97M3ZG6UOCxw8=
X-Received:	Just like 'Received'. Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a62:81c1:: with SMTP id t184mr15655010pfd.246.1542628933700; Mon, 19 Nov 2018 04:02:13 -0800 (PST)
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Reply-To:	This is the email address any reply would be sent to by default	[email address removed]
From:	This is the address the email was apparently sent from	"Mrs. Munira Mustafa Al-Qadi" [email address removed]
Date:	The date/time the email was sent	Mon, 19 Nov 2018 04:02:13 -0800
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Re: Investment opportunity
To:	The email address(es) the email was sent to	undisclosed-recipients:;
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	multipart/alternative; boundary="0000000000009d12e8057b0349e9"
Bcc:	Email addresses the email was secretly copied into, this field is usually blanked so even by viewing the email header you can't see who was secretly copied into the email	[email address removed]
Content-Length:	The size of the email, in bytes	1724

Your content is below the advert

The scam

Peace be upon you

I am looking for an opportunity to invest in your country and I need a
committed partner to guide me. I will provide the money, while you will
provide your expertise and local content. Percentage Benefits shall be on a
70/30 Sharing Arrangement.

Could you please give me a call, or give me your number and I will call you
from a secure phone for a verbal discussion from a secure phone/ or send me
an email and I will give you full details.

Thanking you sincerely for your kind attention.

Wasslam,
Mrs. Munira Mustafa Al-Qadi
(Wife of General Sami Anan, Former Egyptian Army Chief of Staff, now
imprisoned in Egypt)+33 182 883 865(If off, pls send email)

SpamAssassin Report (spam score: 0.7)

 pts rule                    description                                       
---- ----------------------  --------------------------------------------------
-1.9 BAYES_00                BODY: Bayes spam probability is 0 to 1% [score:   
                             0.0000]                                           
 0.0 TVD_RCVD_IP4            Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP             Message was received from an IP address           
 0.0 FREEMAIL_FROM           Sender email is commonly abused enduser mail      
                             provider (moatazhegab.kfic[at]gmail.com)          
 0.0 DKIM_ADSP_CUSTOM_MED    No valid author signature, adsp_override is       
                             CUSTOM_MED                                        
-0.0 SPF_PASS                SPF: sender matches SPF record                    
 0.5 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII but isn't
 0.1 DKIM_SIGNED             Message has a DKIM or DK signature, not           
                             necessarily valid                                 
-0.0 RCVD_IN_MSPIKE_H2       RBL: Average reputation (+2) [209.85.210.171      
                             listed in wl.mailspike.net]                       
-0.0 RCVD_IN_DNSWL_NONE      RBL: Sender listed at http://www.dnswl.org/, no   
                             trust [209.85.210.171 listed in list.dnswl.org]   
 0.0 T_HK_NAME_FM_MR_MRS     No description available.                         
 0.1 DKIM_INVALID            DKIM or DK signature exists, but is not valid     
 1.0 FREEMAIL_REPLYTO        Reply-To/From or Reply-To/body contain different  
                             freemails                                         
 0.9 NML_ADSP_CUSTOM_MED     ADSP custom_med hit, and not from a mailing list

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)