Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255786 - Mrs. Denise COLON

Email info

The email was sent on 2019-01-15 21:12:44 and appeared to be from mrslucetts@hexabyte.tn but this address could have been spoofed.
If you replied to this email, your reply would have been sent to mme.colon@citromail.hu which was the scammer's actual email address.
It was probably sent from 41.227.192.145 in Zaghouan, Tunisia

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Tue, 15 Jan 2019 18:12:44 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	196.203.199.7
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of hexabyte.tn designates 196.203.199.7 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	yaGYkEAWLDv2PA.iLdEDenoO0PgYfj34yLzSNQ86RpeKds_n mnBkS1eKyD7yR_VJNtZwV3u9oe5_ve0ESB9zZjpEUAhFkLcXHqeosHXWrkRc mboH1ecif7biSv3_YO9xUojNg9_zYcqr59IMpi_n7TagiAotiLEnRQVFf0Ct DnvEXpYiQmu3Y_SNBjfQORpnDaITRCcqfoJnBGGHV96ZuWFIqpBfpqlAHcTo DDl8cZFfjV8YXTbymURvZw5eqr27fsTz3d1v7MmDkCDohfbw0B5oiXQ5Sn2U 4QmeizUPsnQ5LjEpclHGG095EAUFyq2CsAXuf4eWaWgo6dywnmDOl1.ZQMPu ScF9rrrOtfRvbfWWlJeF8nHPbaQbRC2F5ll5IJJDvqmTEq_Gm01ihRwbjg4_ 8btcn5C8MeOw_A7L5akTgkWi11ypYZf_wUD.eaQ9sZdfNojfsvqC12j_e.6p NJB1kkTEEaA8ZSv0SOUMCYDTc3vxl68BS8h5kD01HDBd0908WTnjqXXM.eMM p5fPuIgpTTl1OP4YXjS0fJ19jGWSYQF_K0IMQaaHeA5noGw7bh1nGClVSwU. P0OV1XD5cfpKQUqhYbCCzVKwxGxkduNIUjqm6L7bwo_FMnJXRCAqY.zkd8Qa l.p_hxm8NMhiRVoSVxqqJLM_S8GiiLojqsVT8fjVzNs4d7rfnIJxlT4xxDLJ udPHC6DYUpPeFXQJnKSQGAPjGcXOPfO94jjCEVU_12jMvOzfsQghDuEW6ZBP Z7bndpKQ04.I6roF29JrzZtpVXBp5638GFF6JJTazMMwaWWiLEMQw0krO_bc MnhQNYJ5U0iYVLLZAabROut36yZlG2yBUocomQtZhdkPvZ9JIRmQab4PvBTh m.Byrhi.ig7Q8IxlwdUcFjkv4jdhAhNgOpwSPxKafkI5chzOiOj7rhozdbaE s6rutAnVOJLgEbUfVLqnWJZSMiAUMDP.yokzHHaK.toTARsRx4ZtN_AAxZSO AACaEO8V5ArxWG.k9gbwG6HsY66t2IzqhyRli.e53t0pSlAto8arX_jwnWIC DdgbO8R8iq_aGRtAEKasmuBVLAT9f41kcYLgb5Gc0nzujaCuiE_Aw8j21KZ7 xs46RskFNAIyD9WVDWbGkwWEIi.ZZjNG5K88naehb9xetNnnXNk_6ZMuptRl ZQPFhzEOkYPsv1Fmk4IMYyW_Cs2zagH8_WwvZ4An6BlpSQv1UHanC91T1Odx ZGJlngLiwt6GR_CG6IaZL1vXOLNxJhjs8WFeHhyxPADvafM.0IK9fT9iV1Bi m3MLm32if.9tWLUfwr3yICxuK6veN4xfHBJGz17HbF9gzQWCUgNdKhXMfCvl G4QhE5emcHajAnRRsyt2MrO__A1Nnq0KYdsnPdCuf3990XkRv3GbD.AeyEM6 Rt2K998KSCSh6YGAM7MyE0L8DnNG1cZQIa6jDUg3O.V.qnxwvj5Ywdhuv8we MfiYFxA6RWzHv9CFTiU8KKJoAWDs.gymefMgyZsXZBAkd7ulmaFiJ97CKWt. FdNu9XD6uYLiMKhvCMyG4tolJkT4ZpetHjM9OpvZLz7vGw4apPBpwH16k694 ZknL8Csz_IlwcI46ueoszR3ZEx8DHJFJmvSHOB6C1prLshAag7T82YytztkI OwR4OMb8H8gDNDJmf2USRZgyMBw.ENr3TGDmNzrwcc2eZdVboo00O0c2rNbN cE3PnmPrlGc_sdlx4Ng9BNq_Wqlg9qXqe0j21.a05Xbugpoop7Pf32Qmb4Gp vv3RbhxMCfeTrHUJbpyZXwkl6sig7LF_GOi9I.S79JBCQqygliXKZDQ.MdQo P2uabgNiT7WbLbsP5NXHyqvyBdUOHFPZUrPC8ttT.VcLsCBMPrr3TSUGRbYX oPXIfmhk4E5ZKkmWZl4eJ1.Hf50-
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[196.203.199.7]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4218.mail.ne1.yahoo.com from=hexabyte.tn; dkim=neutral (no sig)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO gatewayout2.hexabytegroup.com) (196.203.199.7) by mta4218.mail.ne1.yahoo.com with SMTP; Tue, 15 Jan 2019 18:12:36 +0000
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from localhost (localhost [127.0.0.1]) by gatewayout2.hexabytegroup.com (Postfix) with ESMTP id C1C8D1349C50; Sat, 12 Jan 2019 14:12:06 +0100 (CET)
X-Virus-Scanned:	The name of the virus scanner which scanned the email	by SpamTitan at hexabytegroupe.com
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from gatewayout2.hexabytegroup.com (localhost [127.0.0.1]) by gatewayout2.hexabytegroup.com (Postfix) with ESMTP id F38DC1349C71; Sat, 12 Jan 2019 14:12:04 +0100 (CET)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from smtp.hexabyte.tn (smtp.hexabyte.tn [196.203.35.80]) by gatewayout2.hexabytegroup.com (Postfix) with ESMTP id 7A2F01349C75; Sat, 12 Jan 2019 14:11:58 +0100 (CET)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from webmail.hexabyte.tn (unknown [41.227.192.145]) by smtp.hexabyte.tn (Postfix) with ESMTP id DE6C87FFBB; Sat, 12 Jan 2019 14:14:40 +0100 (CET)
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	multipart/alternative; boundary="=_de1b50339a6b8de903496007ec26358c"
Date:	The date/time the email was sent	Sat, 12 Jan 2019 14:15:02 +0100
From:	This is the address the email was apparently sent from	MRS DENISE LUCETTE COLON [email address removed]
To:	The email address(es) the email was sent to	undisclosed-recipients:;
Subject:	The subject of the email	Mrs. Denise COLON
Reply-To:	This is the email address any reply would be sent to by default	[email address removed]
Mail-Reply-To:	Same as reply-to, the email address any reply would be sent to by default	[email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
X-Sender:	Further information on the sender of an email	[email address removed]
User-Agent:	What was used to send the email, e.g. a webmail client or Microsoft Outlook	Roundcube Webmail/0.7.1
Content-Length:	The size of the email, in bytes	2894

Your content is below the advert

The scam

--

Hello beloved

I send you my sincere greetings, I am Mrs.
Denise COLON.
Of French origin, but I am currently living in Canada for
health reasons.
I contacted you, in order to make you responsible, for
the good management of a fortune of 20.400.000 EUR.
Half of these funds
will be used to go about your own projects or achievements, the rest of
the funds to do charitable works that are my main intentions to want to
do this action of generosity through you.

For me, you are the worthy
person of very good faith, which I need.

My number: (+1) 450 600 -
1663
but I am currently unavailable my doctor could talk to you
Here is
my email address: mrscolon@outlook.fr

Thank you for answering me for
more information.

Sincerely,

DENISE COLON

SpamAssassin Report (spam score: 3.5)

 pts rule                    description                                       
---- ----------------------  --------------------------------------------------
 0.0 TVD_RCVD_IP4            Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP             Message was received from an IP address           
-0.0 SPF_PASS                SPF: sender matches SPF record                    
 0.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII but isn't
 0.0 LOTS_OF_MONEY           Huge... sums of money                             
 0.0 T_HK_NAME_MR_MRS        No description available.                         
 1.0 FREEMAIL_REPLYTO        Reply-To/From or Reply-To/body contain different  
                             freemails                                         
 2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)