The email was sent on 2019-03-19 01:34:53 and appeared to be from firstname.lastname@example.org but this address could have been spoofed.
If you replied to this email, your reply would have been sent to email@example.com which was the scammer's actual email address.
It was probably sent from 18.104.22.168 in Unknown, Nigeria - Click here to see the location on a map
Click here to leave a comment
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Mon, 18 Mar 2019 22:34:52 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||22.214.171.124|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||softfail (transitioning domain of gmail.com does not designate 126.96.36.199 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||PnyqRmEWLDtEa90jPRM7Wlv80FjRuH4HGOCF7Phx6Ug4Ue5J 4IJFLrYj5fqFXfUy.yvvjtOX6iAFTnET.kTQqD_5kNRk_5IbjyYcHsPYqMUw Yo79nEI6_V2CkG5cvPwkTLC0iLXqwfobe9c8fEsIru3E5iyGCR4QIvjRetFK xtkpZWYe1C9hsBNzwU5Emy3Tm8C6e8iomxKcCAm5LelzxoEl9Fsr_7C4Jh2p saT7P.i2DM5Y7IOKXOddKwJYZF5synkmlOaLqIRkZj9eF3WFVsg.53pYjH5f k_3FaJ_hNtu0IS4NKxT29CTUYjTHQSiWwv3h9uj7jWOEJ4RcaJcJRciY5SwY sGsikVDziV57VWhQHv5NpO99Bx9nAT22ezfgWPrODKQG3v46qItBWbWdhanE XlH6Z.zKwzwxq5zYsEHHz7QRdOvSKBV5qRcKOCHOhOFyYyr4yfoWfG6H5oBw D6wzpeDIzOxBkVcW8V4OFWxZ4qaXnW8jpoSQEyml6.EbBVz1OU0E2dkW0B.i rWMJdpQEap.q8A3PBu_bJ_4y6BaU57qgF03J2NgwZcK8RW7L_n7tk7DoZQv8 uMCssT5D9wTyOCkwXW0cVdzxwlr8rB_cWpvANbNPOKxaULR0MZDpj8KjryhN oi.oDNJBAQD02VcMD5nMiSUPCcFyP2sU2r5N86TDAvR5BHKU6n5RvmDrubdB ZlXNLYnt.o73AbHbnYvLv9NdbAptDuKyunVc9bq2.m3WS0_uXWT7lUtZIt_n uPOj5B9KTWTWBhs6dSAOCbkTdypVs8a2maKc1nJ0GcBVKlI_9xt2fC6Q4VIw 1faYOg7PPFgoZX8clm_gRhvIEHij8kka.3rAg0QL2x7eMn1Hnvof98PHgzW7 4HqQj.DJVsHP4eCKJF.ltI9NSGYdDkt5AGN2aqsJfN8re9O01HEkWPJVGLvk 84BQieXI8wkNBwXNkSanNBKRfD2ju9X3Sn_Zok8_psoucUasg.p5Jto9J9dL Asirv2VZhZeZNA2WacSTqROdAW0qBKlszAWhfi4bdQtAlfSohwRWOix4UQVL .rbdnXaAyFyPFFW29thy1uqRF.WBAStA9bp4ZMv8osK1jKQcbAEoqLc7iGGy 2oY__ssBCJBeaEzmpMzIJRE1WJmM1ZC7xbNmWWNsMSEu_dZi.fYIFvRgsTVI ue_3wfqqqd.ZBVdNrOnJ3UHUR9fCOvqE9M2kDDh9P2YVvsNgZzQDTeE0vpve IYN0KjwGF7qfA4s9Qm5ryfXRw_qr|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[188.8.131.52]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta4423.mail.ne1.yahoo.com [email address removed] header.s=s2048; dkim=pass (ok)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO sonic305-21.consmr.mail.sg3.yahoo.com) (184.108.40.206) by mta4423.mail.ne1.yahoo.com with SMTPS; Mon, 18 Mar 2019 22:34:51 +0000|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1552948489; bh=8Hi5OQSP/gkK/mAIGESC4UMom0NOTzbKMp7LJsJI67U=; h=Date:From:Reply-To:Subject:References:From:Subject; b=GypZELiEK36gJ3oH+nIFPbxxLD63mcFCWTtBPMJ4I0vtTZKh9K4kqX6zc8X6cgUbDXp2154JbSXfbWJxJ/SF/sTQLQC5Nzlgxzj3HbIC1SPM2Sc9FzDuIsu+kXVc9f7JPyWDqAe+f3RpqQ8b3uwti8yrj+G3LcyYi9xXap5RqvN6zivkIZT7WDZ+bV8knuzTGUxQAUbxP0uJ1kBoKQ036Ek+iCknXlvZLO+Nldy+kIGAHjWqioAvmQmtIpHNHqNgZ3FXpc39oM9sPdc4hl3lhH7Ls8miAomth1F5y4r8CtvqY2Wwpg1Uf40yzMOgajbxovUs191FHPLrqkXHcr9GVw==|
|X-YMail-OSG:||A unique ID added by the Yahoo Outbound Spam Guard||SI_JEhsVM1n_ayZKveVpbLaa6DbfRZ_KrDBzCU0kQChumqLxm6jvRQYzPzJmfBy IPiOuqlIGHQIC47_7_6MwN9h_9OoSd81EGcpFoOOPCtJR.RdDM1n4huzZBqxpSFOUpk7eysolXX8 9nCqFCzrNgZrEXC7h6PBoAjB6MfQ6xYyg_AUUmG1rehBvEgRe66Jum04W.KlK7.d6ccr9Ag9AsOs iub80JdBe05qx7.Y_2uvZcsLdIHQgCqq33CiI.byz2g0BSPMZHHZfZyQWEnyEqMGvTqOr90F9cvl heH41OIeC.x4E0I3w4khTYnd6nVrE51xW4jJ3EDiP_DSvVnyNeAUCxCFEqSAor.NQinpLWNwgcMT B5pWFC9DvV68KCySkkaBUiVgUQsCYkMffL675PtcAciBMyUQpehG6d7uxuIN.53Lj8Kc9bd0NMGB 7sY5lU8Te0wkAgrNOQk1Ta7dH2M4DazcdBWx74T.gUVMPP_WYeiEJxbygSzh8HX.3wjrSw70CLHe SNwT8gZ0Pl3ka6pKYEBiN2xah5AkqewGoz2LL9a61QsDlFSk0h6Wd_JiLi7eF2JYl53Z0SvHCR0u tdjtTl75N1AkAo_mYbgdfy2KSyl4.WrWr0S_lmzgajWcaupSRwvNiTX3leiRgCFouwLfslouTj41 rwdlFQO0BkAhoKcuFfw4rxgamilpUabWvNFoez9UxQa12pGLJybttYWQdGOrWWi6_hdMdGvrkaJU rNMK2ypY34mK9n8iq98PLszKfZ3JWrRxL9BE3A13eH4yJ.NSLjias3uLOavQnCXnf1gSmJ_QXA9r zhz90YNvY4q65.aVHrYHEh9ayZN._v7EGcqZ9rPK7OMBlvaagvGdv3RPC5Z0F3w9MnGo7csffx6y n_oYg0OERywk8C4y14i01wYvCMvq4CcJUUr4wEINR8iM.YVpmgoNYnIy2RXL1p9mZIdr0VjhgS80 OzNmYmankHbShkifUSMdw6qwp3iVq6b2ymYvpKs4h1uX0ShZcPNULW_pfHmcx9CcUFo0xg.8sXMZ UU8uwV8f09kutjXG9d52ux2CCSF0vcQEmKj4MvEMtglpabvHid6AI35ZL.t.JZy9RQi27EOQ45a0 YkHx9MjaX2LiKzkTdWyggI4E-|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from sonic.gate.mail.ne1.yahoo.com by sonic305.consmr.mail.sg3.yahoo.com with HTTP; Mon, 18 Mar 2019 22:34:49 +0000|
|Date:||The date/time the email was sent||Mon, 18 Mar 2019 22:34:46 +0000 (UTC)|
|From:||This is the address the email was apparently sent from||"MR. THOMAS GIBBONS" [email address removed]|
|Reply-To:||This is the email address any reply would be sent to by default||"MR. THOMAS GIBBONS" [email address removed]|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|Subject:||The subject of the email||Re: PLEASE NEVER YOU MISS THIS VERY GOOD OPPORTUNITY OF RECEIVING THIS COMPENSATION FUND TODAY.|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||text/plain; charset=UTF-8|
|Content-Transfer-Encoding:||How the email has been encoded to comply with regulations (e.g. maximum characters per line)||7bit|
|References:||Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation||[email address removed]|
|X-Mailer:||The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters||WebService/1.1.13212 YahooMailBasic Mozilla/5.0 (Windows NT 6.1; rv:65.0) Gecko/20100101 Firefox/65.0|
|Content-Length:||The size of the email, in bytes||3180|
pts rule description ---- ---------------------- -------------------------------------------------- 000.00 IS GONE FINALLY.
IF YOU FAIL TO SEND THE $50 TODAY YOUR $2.500, 000.00 IS GONE FINALLY.
I have to inform you again, that we are not playing over this, I know my reason for the continuous sending of this notification to you, the fact is that you can't seem to trust any one again over this payment and we have now curt the prize of $490 to $50 for what you have been in cantered in many months ago, but I want you to trust me now, I promise that i will not fail my word as i said OK and i will make sure that you get this fund receive as soon as possible. Just try all best to get this fee of $50 send as instruction we give you in this email now.
I cannot scam you for $50 it is for bank processing of your payment,the fees is $490 but we have curt to $50 so that you can be able to send it today, $50 is clearly written to you before, and the good part of this, is that you will never, ever be disturbed again over any kind of payment, this is final, and the forms from there becomes effective once we submit your payment application processing fee and pay the form fee of $50 I don't want you to loose this fund this time, because you may never get another such good opportunity, the federal government is keen and very determined to pay your overdue debts, this is not a fluke, I would not want you to loose this fund out of ignorance, I will send you all the documents as soon as bank payment processing fee is paid, you have to trust me, you will get your fund, find a way to get $50 you will not loose it,instead it will bring your financial breakthrough, find the money and send it to our bursary.
The reason why am sending you this because I want you to receive your USD2.5M immediately we are trying to round up for this [...] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit (thomasgibbons423[at]aol.com) 1.6 SUBJ_ALL_CAPS Subject is all capitals 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (chineduogugua50[at]gmail.com) 1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (chineduogugua50[at]gmail.com) 1.2 MISSING_HEADERS Missing To: header 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [220.127.116.11 listed in list.dnswl.org] 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid 0.0 T_HK_NAME_FM_MR_MRS No description available. 0.6 MALFORMED_FREEMAIL Bad headers on message from free email service 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC No description available. 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
Please do not click on links in the above email or make use of any contact details in the above email.