Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255401 - Final Notice Pick Up Your $6,000.00USD Immediately. Call# +2348184119096

Email info

The email was sent on 2018-12-03 08:08:15 and appeared to be from expreslogisticmasglobal@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to customerservicemai215@gmail.com which was the scammer's actual email address.
It was probably sent from 74.6.132.41 in Unknown, Nigeria

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Mon, 03 Dec 2018 05:08:15 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	74.6.132.41
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of yahoo.com designates 74.6.132.41 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	sp2K7KIWLDv8DZ.AmFfpcHRDckIfTlbxcVw3S8iP6GFvPsja ElnZNcQT18ArwU..V7jVdC_Dhs.lImWKiwvyyYCWo7CSzsVOonPa9HpDprv7 W12TJcloi1Z.yeq0W8U.2U13cL6Fbnc8tVwz7b678Mk4V.HgwL68gyAm5wze isB4SLh8hPpZRhBnmbtIr2OdGvH77tj2imHnvZU0qa1Ln55YSQimEdLMvHVl rafaR0mlZQg_X1iW3Z9k8FHZAmhoAi.yEB2DIVNhwYqIrghhY1SqeWYmfgV. PUqH1PASwCxe4uheuEW24nh4Ayx_I_13xz8YH3qVNEbrts_DgBlVVf.8R0N2 2kJKDVOnYty1SgNvd.uh0dCUEL9E00ogWIjlmyhF84UPHvZe4l2JMX3ZKANh 8Pcpc2Oqqx_L2sBN4OaXwUSTFmg_SwmOfDcoAvOjed28PkYX.UNiItvAwa8T d7BJOgB.RF6cjosFRxjGfopH4EnmcHjI2eQ0OJPM9YNDAyCxe3ikoAEnlc6s 5M_67xRlw11Bw_roUF3tBkanlyLHbLdn_YxuDj_Ijz.LFHsodrBJwfXH7tjR pAuinbAXNyhMQf2FE15nX.3H.FnGtYF8DKgZwbJlF1sPn0uQEKS7bKndAjkG o84r4gxCbhMPkxHKRYmf77x60SCb4uXsUd4pD4CKeYDAJ1chPgJQvYtcg5Ki ollcjIPokrpD5TQM6cJgTibJ9HHuu5d_53KhU5hflTr9he8YOXOVRy0d4qja GJIsXeVC1ri1cqWIJzLakQxkwowu3lZ6EXx04K7VFnrxvvNjaNngC0Cu1GRr aPVdHYplzKIx6lMJvhBCV7xOMWdqiP6wc8lRBqpSI9JX2zPRtPXhHn8fQ6hU SOz9zWp.Kni_E_3sUJl.vyzbRcPF5UivLORazMs6.NTdR5K8e7vC3xcfT2OW 9cZa3ah8MVC2gAdwv507PTYVq3xdQcuTSCkOD0ImcyI2rTV3WSkesg9u3xuu KWY6P2k4tEoK_Rwwm.WNCzegSZyYYCMOx.qwxClwFR7_Ra73mNVOoHV5xRbR exCZYIqiDTiGY4DuLmmJHxL5KWTj2AFWjJwozo5mEoj65mlUEIYEYOuhPXmy JLO3dBFlLgwNj64SYPse92G2_mRt4Uk2SutsAn0kusBeA.0zNm6DsJW3_NrC LFWS_QdjW2HLZAz4AJ81kw6NywcAj2lMPaXTDQ94s9i95P4kOL6dbAMPxJAd zqm9
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[74.6.132.41]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4179.mail.ne1.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic306-2.consmr.mail.bf2.yahoo.com) (74.6.132.41) by mta4179.mail.ne1.yahoo.com with SMTPS; Mon, 03 Dec 2018 05:08:15 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1543813694; bh=rDEgT5E55V4gi4SuKWxbdrYVU2ccOT2m1s5X8LI0UTU=; h=Date:From:Reply-To:Subject:References:From:Subject; b=YmvBk5EHRhQZZFQzxbiQZjtTrhtMKzMPU96P3NS3xeRSGo+BRDFCgjog3DT7Xv5x5f1mAFh3IPVl6LkSuFZQb6WbwgwclCdZtzPj/yiR+X/rKbyDctcvOU9aEDVoJNxuQP8JIKY6nVx9ttKEZp9PqeSwH6qCw2LtA+C16EMrI+nqfUqbkBlGbA3dlvOeVaWIogc3AnnMOS6DY3dEwTwxBLV/J8whfgzy4rxttPwLCIZgXuimJgiujlAex84frAL9YfHwHKiV3/Qs9h0icCkbhwbYKTDhg0PVhi4M6OFfHIXX+kqZIMjNAtVqwYQ7Yb0oylXwuHIfr82r0uGOBTceUg==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	kyGVf2kVM1m3G_RWZD1BziZyjRkXUYTvldqgqvlG_nA6j0lEboRTa5z4jssOmz_ igEnux6uW71.UKXS_oOqkWBQfUnNSbolW1foh6p5n2nIEBWHfd6Omh629COJHFZU75lJW_6kbXbp mDQ.CANl9TjNcDKwM9jPTj_0OVCMOBiciPiyA00K8z6OrD0vX8YWSouyxMya8x.3SYMz80oh7RiR .SRYxxu7hnO5T6RWE2jhodB5yZP_GLPMea4xXVHBY4vHDYrr038LdzCBKbHo5p2D1QD3xUPtYjBk pyp3F8lU4X0Gi1ihxQ3yjZLuvrIOdOIR7zjpsl3pQhzz0dIQmj8.OSoEpyHh1aMTB9liNoK6XqNT q2AY8thELYVeDpk8hnZ2ezjsKFvgU_T73XgBMIPYZa4g31ftRN1rgdPaRKavnZxq2O.HOlEuqAds tXiIYTCul7C86xN.s5daPsaYQDoGaYaxTwDxST8EiT2CkhfWCKClC7SStm8lQlm7Y_cQYW76MA2b OSNcTX2J2COW1snsKnCeRNvL0YGtXvsvn2byra2VlOlsegeRvSu6ju4Qcx2hhSWs_s5wXjYJDSnE .tbKoZmkBtFGP0EeoJdzE.sKMizCRwi3ydCSKErCBCCPMlociHpzC4ksBkgsbJdvBVqRLuSJ4QE1 ThZK1IpvWN_Qv7ZWbS71Ba41x4aeJ2uu.xZKEMh7cs.7JsZLmyX.4HPi2IR9HALGCty0CnlU60OH pEJoGzhMv1vyQKqtQT5oFqAj_ZojGX1lKslhrt.yw9k64lZWAnUxZek68mh3Zbp8bvOJsiEMum9A bp6kw4FGA03tdPCe_iC7kw7nHSs45mx07_.0Vaq1xfNUD8DTFBZtuRUfHvswmJ.Hz6YquKAtiigs StW15rhTlrmr.KPiifVRejCJmgTvUgludF619QUhT1plh26VSCrW_aDfZuh1o7Eh0grZ42aGwlpa jW19Iu7NfWq_LAPeutp9yq5kP_qwLb4N_pI9cUO1dsg0ovJzPxgbE9Plg3FtTQU.a3d0Sp9EdWix 7Y.uNP7WMCQg-
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.bf2.yahoo.com with HTTP; Mon, 3 Dec 2018 05:08:14 +0000
Date:	The date/time the email was sent	Mon, 3 Dec 2018 05:08:12 +0000 (UTC)
From:	This is the address the email was apparently sent from	MR EUGENE ATU [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	MR EUGENE ATU [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Final Notice Pick Up Your $6,000.00USD Immediately. Call# +2348184119096
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	quoted-printable
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.12827 YahooMailBasic Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length:	The size of the email, in bytes	2136

Your content is below the advert

The scam

Pick Up Your $6,000.00USD Immediately. Call# +2348184119096

This is to inform you that the America Embassy office Federal Republic of Nigeria was instructed to transfer your fund
totaled $985,000.00 U.S Dollars compensating all the SCAM VICTIMS and your email was found as one of the VICTIMS by the
America security leading team and America?s representative officers here in Federal Republic of Nigeria.
So between today the 28st of November till 22th Of December 2018 you will be receiving the sum of $6,000.00 dollars per day.
However be informed that we have already sent the $6,000.00 dollars this morning to avoid cancellation of your payment,

remaining the total sum of $979,000.00.

Note!!! You have only six hours to Call# us on +2348184119096 for the collection of your first western union reference
number of $6,000.Be informed that the already sent $6,000.00 is on-held because of the instruction from US Embassy?s Delegates, they asked
us to place it on hold by requesting the Transfer Charge of $155 in order to fulfill all necessary obligation to avoid any
hitches while sending you the payment through Western Union money transfer, the necessary obligation i mean here is to

obtain the (Clean Bill Record Certificate).

We need the below details from you, to enable us fully activate the payment to your name for it to reflect in your

country's western union branch office, and to update our file records:

1. Your Full Names:....................
2. Postal Address:.....................
3. Phone Number:.......................
5. Alternative Email Address:......................
6 proof of Identification
7. Country and State:........................

Furthermore you are advised to call us as the instruction was passed that within 6hours without hearing from you, Consider
your payment canceled. Number to call is the below listed managing director's office of the release order Call#:
+2348184119096, Email them via (customerservicemai215@gmail.com) immediately!!!

Thanks Mr. Ben Anderson
(Western Union Mgr Federal Republic of Nigeria.)

SpamAssassin Report (spam score: 6.2)

 pts rule                       description                                       
---- ----------------------     --------------------------------------------------
-1.9 BAYES_00                   BODY: Bayes spam probability is 0 to 1% [score:   
                                0.0000]                                           
 0.0 TVD_RCVD_IP4               Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP                Message was received from an IP address           
-0.0 SPF_PASS                   SPF: sender matches SPF record                    
 1.6 FORGED_YAHOO_RCVD          'From' yahoo.com does not match 'Received' headers
 0.0 DKIM_ADSP_CUSTOM_MED       No valid author signature, adsp_override is       
                                CUSTOM_MED                                        
 1.0 MISSING_HEADERS            Missing To: header                                
 0.0 FREEMAIL_FROM              Sender email is commonly abused enduser mail      
                                provider (expreslogisticmasglobal[at]yahoo.com)   
 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit          
                                (customerservicemai215[at]gmail.com)              
-0.0 RCVD_IN_DNSWL_NONE         RBL: Sender listed at http://www.dnswl.org/, no   
                                trust [74.6.132.41 listed in list.dnswl.org]      
 0.0 MIME_QP_LONG_LINE          RAW: Quoted-printable line longer than 76 chars   
 0.1 DKIM_SIGNED                Message has a DKIM or DK signature, not           
                                necessarily valid                                 
 0.1 DKIM_INVALID               DKIM or DK signature exists, but is not valid     
 1.5 HK_NAME_FM_MR_MRS          No description available.                         
 1.6 REPLYTO_WITHOUT_TO_CC      No description available.                         
 0.0 LOTS_OF_MONEY              Huge... sums of money                             
 1.0 FREEMAIL_REPLYTO           Reply-To/From or Reply-To/body contain different  
                                freemails                                         
 0.9 NML_ADSP_CUSTOM_MED        ADSP custom_med hit, and not from a mailing list  
 0.0 ADVANCE_FEE_5_NEW_MONEY    Advance Fee fraud and lots of money

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)