The email was sent on 2019-02-04 09:37:37 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 22.214.171.124 in Accra, Ghana
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Mon, 04 Feb 2019 06:37:37 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||126.96.36.199|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||pass (domain of mail.com designates 188.8.131.52 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||1Y8qJI4WLDvFed6YMmOze0nii6_DsfjjDvuofO2YOIhswk_c LKjJC0ZMzQR6x2aJSWX2sdmGc66FHnSwch_ddG__FsPtBSOOISL2UoDPgG1J N1bjm1WDVHiayEqPtR1RTDwjBsP7UunDA2PJjmT_yXu8savqj5xrDrbEIYYX 1AGu24SzzY5XhhIdMOU_GmpThwjM.HDWGjll06BriPskjpsSmwKQMmXMvAkj 3Nq4YZUYfzYkAuTyP3pokZhhbq.X39FhyQsZnDZ3lHVVjs_QAcdS8UFoZghE D5cxfMSU2_sScVEYygFape0ihd9iOyEggt1T6rjkG8_gtiXOmlW4zuS03A0h z2.hIYxOFtrxmiwZwyjDHXSB89gsPJeipDdRvVlV33aT8OPGMXToB4G.__Cz .VfJjKCfCDoalaJ3dVZ2DmGvt_lLgVgfSo2vF_0zCKoocHcgVTplDahHHqhQ ncTZAwMtSD5bNAtTXWBaDUyjrbVER2EoK.1aPwpoDjbqCpX1MOfOGHQ8lNql 9h81SUVmldoKx6rEfSMxAo.GwJK6jlca8woD4Oc0ULEz7YpXG4IOG9B9.3gM sdxk6Byi7WruzC6SdtzBZfoGaIeBIscYYK6PFxgNH6l5zTs1a3aRBad3_i3y SHNO5kisbv2AOrdkPcCivMmobYU1P_mnDj5_I4Xx_DTkO5gObstKo3hUQ0Ca KYZT4vMUixJCkb4VzKWZEn9Pan.hHMOC.u4FExrOoyIMRor1Nb_KWW.S.iil id3R.wobod7zMvZxF36u7fyoUaEuGs4JjcFiTm_7Pad8dtCH23lEWj0IydQP nPPCmg2_gbAtumJxqWaZ2vyeXiqnkFEBBz4ZwW9hfOGwSfjH2GdX4bCeoF09 JC_A8L.VLG2xdRoc80NHtBXqUBf_kujSXH.tQ3364cnG7G_xgw2eyYCntDOR i.CoYWVnKWfp6mfLKtsv1rrOelLez3lo0GuMWBgELd_ClK4yFCH_vPlch1fN k3swNYrEHZRwG7iP69nDVGIYXBS0qpq6IGOsZE1YJ3rQfWUR_vjMiuqduJ3g l7bUUADCO4gAM0TE_X59fKfEnwc_Fdj3Cx26rNY9eADyrbM0YAteIWv1AVuf qVaJwwe12Vl0o2gm1_OWKocurLqbbEJlyjI8TV4oTdCLM3TL3PabKxM1lQ7k 21I10tRdlxYj8fy.MgJ2A4tn3qzkTPLDkI.zz9aSMrJK5GL_AMYAgP99N.SY 7_E3aG6opwHyWAfDMhvDEQrFx2niOStkGb4KDM5KfP0EgP.D|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[184.108.40.206]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta4471.mail.gq1.yahoo.com [email address removed] header.s=dbd5af2cbaf7; dkim=permerror (bad sig)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 10.253.33.217 (EHLO mout.gmx.com) (220.127.116.11) by mta4471.mail.gq1.yahoo.com with SMTPS; Mon, 04 Feb 2019 06:37:36 +0000|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/simple; d=mail.com; s=dbd5af2cbaf7; t=1549262222; bh=P+ZHq9wu8oUwABYQDW7cVkWW9OBro3VEvoEKwe/Qvpk=; h=X-UI-Sender-Class:From:Subject:Date; b=ExkqE4RY3g8tb3ob+E3i1yvBoODllyX8uHC3zVCBAJ6/t8+HbYU3yhOWMB9F+jXbR n8IjfYaW3PQYJei7JlK9Dwrg+EfNTXDLik6ndQD53Q4lHnBend3YeevA7evc+WkBTl 5fe5fUzW8kMtgOk8pA46h7ykMdojGI7X1aWZSwFE= X-UI-Sender-Class: 214d933f-fd2f-45c7-a636-f5d79ae31a79|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from [18.104.22.168] ([22.214.171.124]) by web-mail.mail.com (3c-app-mailcom-lxa16.server.lan [10.76.45.17]) (via HTTP); Mon, 4 Feb 2019 07:37:02 +0100|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Message-ID:||A unique ID assigned to the ID for reference purposes|
|From:||This is the address the email was apparently sent from||[email address removed]|
|Subject:||The subject of the email||Dear Friend,|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||text/html; charset=UTF-8|
|Date:||The date/time the email was sent||Mon, 4 Feb 2019 07:37:02 +0100|
|Importance:||Email importance/priority||normal Sensitivity: Normal|
|X-Priority:||Email priority, as a number. 1 is highest, 3 is normal, 5 is lowest.||3|
|X-Provags-ID:||A unique ID added to the email, can be used to identify the sender||V03:K1:Otd/3lnrP9pDqYQ1kFOnr3blhnjlQT2hjXN5M/V+JZ9MshSDNL/TyALKu3R5Uz0EKDGtM LE6u5hzq9aUyh0SGWKnfe+Qt+6QjEEM2bY6aefvJazraUxqgtF4wbYz0XbDRsarcGQthiYOI48oM vc68407Do5eCSEkvHGGjo/yS+zVKymJerO1A1RszZVwiZevV530bT6SX1t81v1wXwn+sklRqNQIA 8Fi7yI5/FIyFZkE9501Fk/lx+Mbzm6zXQIhY6gq1P91qUlZqWhR+P6G6FWzuWkgB2mySqmLo20En o8=|
|X-Spam-Flag:||A simple yes if the email is spam, or no if it is not||NO X-UI-Out-Filterresults: notjunk:1;V03:K0:CIv1kSaGQ+8=:rQTtVdlvRqnmo5BwHW14SG TttKIp8yJFQeEWkFD12xf3hRsmASt3Ax5pNpFoXLX4FbCZdu7Dfn7gASwN5qplrotb23KI953 qiV/qXQUiqEryQ8o4ml51pE3HjeuTmBGoBztWW0YxtDLAhVE2KMf7gWI1y1BqBzzjhRKUXU/i 484+P07P6mtimQiBr7BL6TWY9rMlbsY3aVIdna4DkEWYL2sKEFRCRTcQCB/hsCRcO2oR6Puay qbTu/eE4at6VqhoJlCiSxp52bznOG776eSSG0oqsYUo6igLxT6zUQLPzoFF5wx4S+mNegsB0y MRsec+dEVe9HueEI65asV9wFXvsf226Mz2OdsuAJCzZ+uFWTqEQe0LFENvwkVuZxxp4TQDVbb VjnV+Oww4UA3v/L4qkiAG2bChNkqLbKgbGk275hUnpd3jmAxRXmsenCP1RiPRcHZFNw17b0zN AkwD026jLWgYIfLCmFIZTxVHQnGsOIBzVM0xbwAysdmAsFiWca6YebaODSBmJwsPg+SZlcxSz /TkeIxXqzhYsTw71wLyj2A/jUiluaCGvGEO9Zba4lZ5Uo4GzT4YbkILOPPJ2Ic+EIgQ/Tqm1z lg12jg2UFOpLQ=|
|Content-Length:||The size of the email, in bytes||5528|
I am very sorry for the informal manner in which this letter is reaching you, as this was necessitated by my urgent need to reach you.I therefore mail on a positive note anticipating your kind consideration, and plead for your time and understanding in this.First, my name is Mrs. Janet Kumah. I am the wife of late Mr. Kwesi Micheal Kumah, who was a very successful business tycoon based here in Ghana.He was the Chairman Executive Officer of LA-PALM ROYAL BEACH HOTEL,C.E.O. KUMAT HOLDINGS and a host of other companies died last month at the age of 48 years after a brief-illness at the Kolebu Teaching Hospital here in Ghana.
In our world today, such a manner of approach may not be acceptable or very suspicious, as we do not know each other well and have not had any sort of communication in the past, but I urge you to take my message very serious, considering the situation.Could you believe that the tradition and customs of the town and village where my late husband came from demands that any woman who does not have a male child for the husband, that whenever the husband dies, all the properties belonging to the late husband including cash will be shared among the late husband relatives and the woman will be sent out of the husband's house for good? My dear, this is exactly what I am going through right now since last month my husband died.His brothers had taken all the properties belonging to my late husband including Companies, Bank accounts and as well sent me and my little daughters out of his house just because I did not have a male child
This is a wicked tradition and culture that has no moral value. As am talking to you now, I and my two daughters are going through hell at the moment. But as God may have it, I'm having in my possession all the vital documents in relation to the deposited fund of the sum of $4.2 Million U.S Dollars - (FOUR MILLION, TWO HUNDRED THOUSAND U.S DOLLARS ONLY), he deposited in a bank in an ESCROW CALL ACCOUNT, here before his death.
Last week I contacted the manager of the bank and he told me that the fund is much intact, that I can as well come for it any time I feel like. Please remember that I cannot make use of this fund here due to forces surrounding me at the moment, since I am regarded as a threat to my husband's brothers and they'd threatened to kill me.Please, have mercy at the poor widow like me and help out of this mess. All I want you to do for me is to assist me move this fund from its location now to a foreign land immediately before my late husbands relatives have knowledge of it and claim it just like they did to others. I strongly believe that the only way I can secure this fund is to act fast now and move it overseas, and remember it is only you and I knows about this and should be treated as such. I need your assistance in the following ways:-
(1) To help me stand as the next beneficiary of the fund and my late husband's foreign business partner.
(2) To make arrangement for me and my two daughters to come over to your country to further their education.
Please note that you stand the chance to benefit from this transaction at the end, which percentage is negotiable. Remember also that my children are the source of my happiness and cannot stand and watch them go through such pains. You will be greatly rewarded and been titled to a percentage of the proceeds from any investments I may venture into. I look forward to hearing from you soonest, so that we can commence on this, for with God all things are possible.
You can equally reach me through my number:Tel:- 00233-275399811
MRS. JANET KUMAH
pts rule description ---- ---------------------- -------------------------------------------------- -0.0 BAYES_40 BODY: Bayes spam probability is 20 to 40% [score: 0.2570] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 1.0 MISSING_HEADERS Missing To: header 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (mrs.janetkumah[at]mail.com) -0.0 SPF_PASS SPF: sender matches SPF record -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [126.96.36.199 listed in list.dnswl.org] 2.0 HK_SCAM_N1 BODY: No description available. 2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear! 0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 1.6 MALFORMED_FREEMAIL Bad headers on message from free email service 0.0 LOTS_OF_MONEY Huge... sums of money 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid 1.0 XFER_LOTSA_MONEY Transfer a lot of money 0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)