Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255441 - Attention:Beneficiary,

Email info

The email was sent on 2018-12-06 20:34:15 and appeared to be from boardofdirectors964@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to imfundpaymentoffice@gmail.com which was the scammer's actual email address.
It was probably sent from 74.6.130.42 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Thu, 06 Dec 2018 17:34:14 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	74.6.130.42
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of yahoo.com designates 74.6.130.42 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	LOljwTEWLDurAqqmFkXp.C7_77C67jiC79Iwf4QEomXsuG0w 8PV1UqesnCmHXxicAocS0pmX9JWC9g_4Yj8Hn98jCZ1aWBcnMADPOaXrpVZp bltOuxN0Cw_MccAKfP_zibE7vVv0sjZhJcJP2dhLot0zZhIaS5liT_y1cTPI XgcCIHkJiY3M1gQLY59r_kpt_VRThtQXlGQdqaTYsiTt1dyeobsgnCqi8XEb zGd6oL4aFIWP7sNTj97MmFpkpz_32hJVrEJQP.SeyJxLupZo9nW_8sWQrvcO krof.1VY30zcTcCoBeUTA77kY7WVqr.sqWMgQW4ep0gr_dT_d_E3ZTcO7TbD fypOucySvev7P742zoMnV975amhL0b13xvNYAwG1K5JmBIidR15LwIlnnyJ7 omWu2piyy1gJG2ANNZnWWWIya.XHR8QpjTBUnm6HntaZepXHF4Ajs3aONvaR ET6LO0I6g6_1L62W08sr.VIPxHKgDOU5KKF1s5ZPRnE_0_cZDyNxegLL1G1Y 5gZPpz0cmigBqr4.rPYO.6Io4blEzNgFd1CQ11gEIliGJpQWGF12BeCLWWbz p8ou7GaAhvx1RHWQG.TSTLdS1q4AheH6i9Tdnwb_Esh1eTTabgP9EAMB3.C0 HBAI8VoE7QlELfNT_3.RoaRGsZ3nmVwS36FLRCmt9ATnVZ6C1QUPEaDwKT4M gEPx9KuhfmniJMnNYfGStyLKicXOytDq3nSIrV3fX5IzwjRamLZFlAF5MEhK zlMRjHTn31d_5gkGk7httQ.605h04nBlxLAqAKNyrl.l_CETaNBN00b0rtm7 CX9E8oYc35kNY74_0U6cG74swn3m3Ebs1fYqmf3pmn2ikO6ypz_ITM7ojnA9 H3dBN4slf4ujseJYMs_oPJrx8ayI1vEVgXaXKcf6WSjoFG8G1WrfMZzEbxxE sY_02ToNLB8xulUIl0FnUGnXRlY0SG0ALFScrVy8_.HzrgokxHcKKmBM8lXD Yxj9m8XtU1VmNWdmiZIrAu9Kr25CmP4v39wbBVi_4nD2BmUplhnE_0Q7yEF_ UWk0os8cs_FIET3LfCUyMFoMZ6vDVhFOtNDkAgc6fRJu_acL1deUQ51cJq_m VveooDpV1KtkpInmIelX_mPrjJEGPzxByfA7qox8dI28kdOiW4HHwRzZ.7NR v3MpYLhePoaBexiVwOFELsQjepefYhjVk_ET.X4Ems5asewXbk8LeJVPFaru c0D40KWRlD0mWUQMS5g4l1HxwHbQUMp0MoZFzEZoG2sUuVdKMA--
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[74.6.130.42]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4493.mail.bf1.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic308-3.consmr.mail.bf2.yahoo.com) (74.6.130.42) by mta4493.mail.bf1.yahoo.com with SMTPS; Thu, 06 Dec 2018 17:34:14 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1544117654; bh=TQZY/K3X39IMOc0w0ql/x9KL8kYdHonalC5jsbk/ldo=; h=Date:From:Reply-To:Subject:References:From:Subject; b=bdRIgrKoyKgbPCOxmKp0D0kconmsV82YY/hay1m2Hi0ygJyhqh+biK3iUxkTZKy14Y7Ykd1rSZC6OqfzK4tCEivwXCG6CbAO2JWpwWClPN8JbI6cM/X25q1Xb/5vMzKHw8CbdoJozXlWK67RzTXmZHSdOBZ185LwNPnqrMBNkgbvcL/NwGNWSAzF3b1QDUwcyyU/FN2bMTsv27Smk8auBWhiuBWRwE8Gw6M/tmCqi5WHq/cgp75nHQuEiuaiVAlakv643RnpU+MTiiKxqvjW9YynsLMfkw39YaU1hvoTIAGVb8P2L9H6zSWvuCZcSKwOhCVtpmL8Tk9zYu3ro+siJA==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	wu26rx0VM1nCDWmWDdjImnIHMXTqof3aehpehkqpldoyVFxFFVtgyKFHgsuIJ0c 2ot2k6QpUBtGhVjrGlJnWej2kJ_QtSp2tgWJNkh1YJDFERwZub_4kLG2kgEQ213g.6pUOrvN1aiE Q6zqnCJu3bkeitBjR80K.9xUD0T3cHAsmXjKuAkKHRryPnIClgHJhzkT6FMAthBnq7cvKA5rdRP. O5vGTOv5.EkB5HIggdY40eimv8cHg9277_ASB.8OZXzQDEcTFmZNO6fLLNw5rHVnOm7a4rwC2oVp 2RgVv7_L4ttFiu9D_uPr0ZizaarDkgOlzblme4p6vFa5RpeglYpsXVnX6ivoOtpx206QG2bb1Zgu B7z8OdEH9uVwuwpKHNnR0C1yRzsiFjDkbO06HT4cbiYmcfzMHpjJYS8.fMsWFbOggqSbXb7EjW61 YsFFoe43oyy.VGRAAiSf4uBDBqanB0A7PQsY739h0LDGIgNvDWOMv8aU9TWnRXZW36pTZ8sJ.aWp 6zMOHyFi7yl8kRQ5YoSY8elj5xEM_cEUZmQJuh.bD0h4d.E3c0e73zAxRq8M2D4OlK4BtMhPE.YC gOc64Nt2EJD83Nm8OWMwwCCym7OScSvkpmL4gBbr.nlSw1lOgacOKVGWHBtIaOZwXUys9pKJQsDd diLLYgOgoBJuZcWFhiKhB2AYfSAlo8hB0CcUjsnX_ayo9YudsaY2SQS9XUlVNdIbsPyeiU.0JYq. KJwbEEy3NlNDW6AUxCpheJHacbMKQsOoVr31aI_jP3amb761Lq01wrcWA3BtEjbKO.UIGyTWOvXH jYz6RI_ZLREd_e6lhV4kx17oVBdAhnD1LOuCsHE7MLc0p3iw9.l4oFistFrCioo94E2g2RSdQA8g q1UQUYhRhdzM.RJBevUVG0zq6TLp0rV.dY.27Ou0gJ75K8V2xOt_C_IWKZJHQpEnMumYLYrtLPOz DWScEuizm4YBjEwE335xSPIBtpLVRZ2GGFTHoEG6CrUkFJCRDgOnYE4iCFMJ3OTJLaQv68jnQJ92 Y8532YvBml.NZcjnegJIhFN8h.883jL2WnQ0MLg--
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic308.consmr.mail.bf2.yahoo.com with HTTP; Thu, 6 Dec 2018 17:34:14 +0000
Date:	The date/time the email was sent	Thu, 6 Dec 2018 17:34:09 +0000 (UTC)
From:	This is the address the email was apparently sent from	Olson Ronald Earl [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	Olson Ronald Earl [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Attention:Beneficiary,
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	7bit
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.12827 YahooMailBasic Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36
Content-Length:	The size of the email, in bytes	2721

Your content is below the advert

The scam

Attention Beneficiary.

I am Olson Ronald Earl Head of Inspection Unit United Nations Inspection Agency in Hartsfield-Jackson International Airport Atlanta, Georgia during our investigation, I discovered An abandoned shipment through a diplomat from Africa which was transferred from JF Kennedy airport to our facility here in Atlanta, and when scanned it revealed an undisclosed sum of money in 2 Metal Trunk Boxes weighing approximately 110kg each.

The consignment was abandoned because the content was not properly declared by the consignee as money rather it was declared as personal effect/classified document to either avoid diversion by the shipping agent or confiscation by the relevant authorities. The diplomat's inability to pay for non inspection fees among other things are the reason why the consignment is delayed and abandoned.

By my assessment, each of the boxes contains about $27 Million or more.They are still left in the airport storage facility till today. The consignments like I said are two metal trunk boxes weighing about 110kg each (Internal dimension: W61 x H156 x D73 (cm) effective capacity: 680 L) Approximately. The details of the consignment including your name and email on the official document from United Nations' office in London where the shipment was tagged as personal effects/classified document is still available with us. As it stands now, you have to reconfirm your full name, Phone Number, full address so I can cross-check and see if it corresponds with the one on the official documents. It is now left to you to decide if you still need the consignment or allow us repatriate it back to Africa (place of origin) as we were instructed.

So you are to reconfirm your informations below:

1, Your full name......
2, Your address in full........
3, Your Telephone number or fax.......
4, Your Age and Marital status......
5, Your Occupation.......
6, Your Next of kin............

Like I did say again, the shipper abandoned it and ran away most importantly because he gave a false declaration, he could not pay for the yellow tag, he could not secure a valid non inspection document(s), etc. I am ready to assist you in any way I can for you to get back this packages provided you will also give me something out of it (financial gratification). You can either come in person, or you engage the services of a secure shipping/delivery Company/agent that will provide the necessary security that is required to deliver the package to your doorstep or the destination of your choice. I need all the guarantee that I can get from you before I can get involved in this project.

Best Regards,
Olson Ronald Earl
INSPECTION OFFICER
EMAIL_: imfundpaymentoffice@gmail.com

SpamAssassin Report (spam score: 4.7)

 pts rule                       description                                       
---- ----------------------     --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE         RBL: Sender listed at http://www.dnswl.org/, no   
                                trust [74.6.130.42 listed in list.dnswl.org]      
-1.9 BAYES_00                   BODY: Bayes spam probability is 0 to 1% [score:   
                                0.0000]                                           
 0.0 TVD_RCVD_IP                Message was received from an IP address           
 0.0 TVD_RCVD_IP4               Message was received from an IPv4 address         
 0.0 FREEMAIL_FROM              Sender email is commonly abused enduser mail      
                                provider (boardofdirectors964[at]yahoo.com)       
 1.6 FORGED_YAHOO_RCVD          'From' yahoo.com does not match 'Received' headers
 0.0 DKIM_ADSP_CUSTOM_MED       No valid author signature, adsp_override is       
                                CUSTOM_MED                                        
 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit     
                                (boardofdirectors964[at]yahoo.com)                
-0.0 SPF_PASS                   SPF: sender matches SPF record                    
 1.0 MISSING_HEADERS            Missing To: header                                
 0.0 DEAR_BENEFICIARY           BODY: Dear Beneficiary:                           
 0.1 DKIM_SIGNED                Message has a DKIM or DK signature, not           
                                necessarily valid                                 
 1.6 REPLYTO_WITHOUT_TO_CC      No description available.                         
 0.1 DKIM_INVALID               DKIM or DK signature exists, but is not valid     
 0.0 LOTS_OF_MONEY              Huge... sums of money                             
 1.0 FREEMAIL_REPLYTO           Reply-To/From or Reply-To/body contain different  
                                freemails                                         
 0.9 NML_ADSP_CUSTOM_MED        ADSP custom_med hit, and not from a mailing list  
 0.0 T_FILL_THIS_FORM_SHORT     Fill in a short form with personal information

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)