The email was sent on 2018-12-01 18:29:41 and appeared to be from firstname.lastname@example.org but this address could have been spoofed.
If you replied to this email, your reply would have been sent to email@example.com which was the scammer's actual email address.
It was probably sent from 22.214.171.124 in Unknown, United States
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Sat, 01 Dec 2018 15:29:41 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||126.96.36.199|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||softfail (transitioning domain of gmail.com does not designate 188.8.131.52 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||UTvChdMWLDsiMwRIh6ZIm75v77l7KrhsUKpcMKdDQjzumP8Z iy7.ffVu7aG7IVZQEGiqweFP0NN0NVo0S1k0E7u4F9Ev965iIgGLE9evJaGh v7FOb7PpTJ1Es2qTBtZtiOFrMhc_BKtJAuIpC71d9sLz2xWwTiagh6jYPRiV KydZXMH43tfkgxCychCLpMalPZ1eA3dCd1LNqhI1w5UZ_g3jYjOHNFbmzo_r 7EtO_W0xKHjQx4Xcci_neHR3Apc4530yBCuQhk9TTb5KKuufEeujxe91fTGj 117MoGGw2Y89W3QUq5RDGnruGLhINshymQC.8uskZtC6RHPGrJXazNjBpJP4 fjjr2l3cROvFgVrYFIJ4vn8NXNXSPKEvYifuOJwifsEnQ1cdpfIaE.PP5juW .8niBpJYhSSAUFeBrKkRJRRDYznFVkccFQnmpMYSVI7A1H_yc5GYZpBd1EBs K71PVSzJUoeUDyXJObgzMTQeRay2MbdWn1hgOvMLxDl8XGMhdOWNAKKPIZtL qodJNElP5gH68hN6OkNp.hKHCyWdHl5aiWVBVWyOoZwkgrlR6OF8ruHnDVkb R7swyNbC5_Prs5fF3mM199BlHGvI7DTy9cy02vKvx_eaZ5ahrllhg87S2l5w YgBTBUgy.LTl_BH_53vYJWtez2d6VQjRM9S2uKcql4XhjfhkH._QQEVI1GAI D1gM15mEzYnhaGBDwKh3ZDIV_NHa1a7uYG5AtzuPq3f63QzmqvHR6RrpEi44 PN0rJSYyL6q9B.iF2XRCCSoY0jJ9fcaEiz1uZ3MTy8.IZoJF3awj8gqo5O6m 2y.jOkRQyRvaI_z4lBdek_AVK.BfqKD5a1uCGexFTwOL3ISBWVq_sw6PeDs7 4St9TWiaQ15wbf.wVYwS6larnVKQWRwXsp7Sf4R9SV7XhMNL6PDSk4ra23n8 Qhihka6xhfVGVEZUyNBFjW3J68P08ain4CkeAoJteFi6R8y88u8gcaXc9SPJ pUIcjVnrsPstNmYyb3AOacisRdocfeRDo5MlkekXVbBdlW4OivW28AQ8EXAm b51FFEZCW1dAoI5mAQIMlnw4Peu9T3JtlKpjTrgV6sNSjRfi7PBgKCgvbEN. 8YDxvUXGEdQkPI_j01XxQFahmQlc3x_LvgO0dtRyUSDctrP.57KPdXVyH7ot aspyJHKRMapsusfa9KSclB2rNoT49BL_RccnmAo26ZYt.MKZvscHkdv8pkRp 5w2KjRHaexf2|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[184.108.40.206]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta4239.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO sonic317-27.consmr.mail.bf2.yahoo.com) (220.127.116.11) by mta4239.mail.bf1.yahoo.com with SMTPS; Sat, 01 Dec 2018 15:29:41 +0000|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1543678180; bh=sofCkAAVljWBeHwDZU+iKaUyjlZvSLDopLVyAj2Zxyk=; h=Date:From:Reply-To:Subject:References:From:Subject; b=sllyXyfb5FEKLi4oWBush0X16uVxzzgiKbFU7XcVDey/9NOVEIkS5t9pmusASZhC/N0m9yK9+lbnnukNSOm2F2eW9HacXEcu2o3ahZgswdumGP+CiNoajITecd+BQIOvlYlspHtJwRW2y1kyoJC09pfAoZURpcWnmS1Dsi7mXpgRo34GqAmXXAw61dPWL+DPKLUyoUF700o9IPf5zwp0HiqQFFS2NB01Ji8LNWzY4fDm3RABIj1dabiY62ikx6GjifkxslF9hLVeJj9GuyyP8my/Y7IowlYs5wA9mKY54yPz6ycoVI8LGvd0d4YqnAvFJNjh3JzCwr+y2E2o+p8wdw==|
|X-YMail-OSG:||A unique ID added by the Yahoo Outbound Spam Guard||QhF_jZkVM1mVAUwHxW_uyaM8vWj.GfFwShpnoFJjAdeBBC4Wu6nJOzGq_Ah10OI EJsPWvq0jxT.I4CPQllCTpncgiQ4gK1InoE52QYjlP340DhtN6DqkNdlOkQS5Y0fHYZY2pxLcwXE ChV.fwXdpgG55PM0EP8BQYz.PoqeMPv9dNKUjBHQjdujxFz.wjjwGJdclE2H7S8rXaVJB7GVjUNc v57t7.cBKXpg9kLdY7pkwUeDYRS0nDVPzdXyu6vQuSgRJ5i24LwHu.Q8xcoZXco4H6Is6aGlzRAK RnB3b_NqtpbloCj2PIUjeDL8qeZhHFsQeEBB2fP.V52bZmv18fVvEuPoiQ.uriUXT.El02XM_OjK LDrNztLGp_zveMPkyxc186g5MCtHuf.bElqN0zX5d763bBz3NjRtPs.hXETRkevAxxFC4XKEv_HR pzmX3spMJqBKYuz8HGL0JeCVCN2L40_B6gonApqV3eteJqN2FpC2tx8_tNPPZFeBv4dCFaMpi5qt REMM2LEuIDhafVwS2ExTw8ktPV8Z38LdOPXNl40HiV0wX2nWh1m6EKp0KHJvwAhdPlWpJdxyt92g H0ZwAPoA976kHRg5pZt9IxCf.A4z4kMeO6.fAPY0cCi9BO9SNGNqzIq7BR_rECpBVW4yAzSPEMAt 8aDP3qvxpexKiLOOEDcNBT5ltmKWAxsFN_a8ykQwmxRAU7ccNwtKJjrbVoLIkddf36VkJ.ulPFKB Wtoir.Zm2a7mECQ8n.82MCC3s5QKKU9hMN7T19kuW5XwGcbs9fK9M8FUE5aX_KDq66iFBNLzhQEQ QQ5IMHeITJ50TXVgznRjovT4Ga4IWj9wKJ9gL5yEqCe6IB8gnSIPowfeb2CNPFQ42Bgu8Qjnv.qX YHXQ86bI50QKnFTjqAIkVTkfkxih_jL.QKPcNSv20ymszUzz8mxyUBYXZ_c7Yjs3GAJGMqikuPI9 dXl4Q2lglVdJmIxADDTwh.bxr6jNPIw2jQt9Z1qLV2kBhLjSsJQ0b3rEuUL0YPJJpJP6KVOuWDfU -|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from sonic.gate.mail.ne1.yahoo.com by sonic317.consmr.mail.bf2.yahoo.com with HTTP; Sat, 1 Dec 2018 15:29:40 +0000|
|Date:||The date/time the email was sent||Sat, 1 Dec 2018 15:29:37 +0000 (UTC)|
|From:||This is the address the email was apparently sent from||Mrs kabedax [email address removed]|
|Reply-To:||This is the email address any reply would be sent to by default||Mrs kabedax [email address removed]|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|Subject:||The subject of the email||YOUR GIFT WESTERN UNION PAYMENT|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||text/plain; charset=UTF-8|
|Content-Transfer-Encoding:||How the email has been encoded to comply with regulations (e.g. maximum characters per line)||7bit|
|References:||Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation||[email address removed]|
|X-Mailer:||The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters||WebService/1.1.12827 YahooMailBasic Mozilla/5.0 (Windows NT 6.1; rv:63.0) Gecko/20100101 Firefox/63.0|
|Content-Length:||The size of the email, in bytes||1736|
pts rule description ---- ---------------------- -------------------------------------------------- 000.00 USD is complete. as I have been given your full compensation payment total sum of USD $900.000.00 USD.
VIA WESTERN UNION information to pick up your frist Transfer.
MTCN: 361_930--#### Tell him to give you the remaining 4 digits number
Sender's Name: WISDOM EJIKE
Text Question :When
Please,contact Pastor Joseph Okwuss Tell him to give you the remaining 4 digits MTCN number to you, below is their email address ( wubagency1@ou… tlook.fr) You have to send to him your address to enable him register your payment online with your information for you to start receiving your daily payment from WESTERN UNION agent over there in your city and country,send your information in your reply to them.
1. Full Name:
4. Phone Number:
6. Copy of passport:
Have A nice Day
[...] -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 1.0 MISSING_HEADERS Missing To: header 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.7 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit (wubagency1[at]outlook.fr) 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (mrskabedax[at]gmail.com) 1.5 SUBJ_ALL_CAPS Subject is all capitals 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [18.104.22.168 listed in list.dnswl.org] 0.0 HK_NAME_FM_MR_MRS No description available. 1.6 REPLYTO_WITHOUT_TO_CC No description available. 0.0 LOTS_OF_MONEY Huge... sums of money 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)