SCAMS | EMAIL | PHONE | MAP | TAGS | EMAIL ANALYSIS | IP LOCATOR
Click to go to Scammed.by homepage
Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD


Scam email #256949 - Your reply needed

Email info

The email was sent on 2019-06-10 23:26:47 and appeared to be from lizyudor.postmail@gmail.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to theodoreey@gmail.com which was the scammer's actual email address.
It was probably sent from 209.85.210.68 in Unknown, United States - Click here to see the location on a map
Click here to leave a comment

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Your content is below the advert

The scam

CITIBANK GROUP
250 Broadway
New York, NY 10007
Tel/Fax +1 646 481-0882
http://www.citigroup.com


OUR REF: WBLN/008/DPRT/DC

To: Beneficiary,

Re-NOTICE ON TELEGRAPHIC TRANSFER


This is the second time we are writing you concerning your overdue
payment, we assumed that you did not receive our first letter dated as
above and we deem it wise to resend it again.
I am Mrs. Heidi Bar singer, Secretary General, Head of the CITI Bank
Group, which is being set up to fight against scam and fraudulent
activities worldwide.

CITI Bank Group is responsible for investigating the legitimacy of
unpaid contract, inheritance and lotto winning claims by companies and
individuals and to make immediate payment of verified claims to the
beneficiaries without further delay.
You are being legally contacted regarding the release of your long
awaited fund. After a detailed review of your file, the CITI Bank
Group has mandated that your fund should be release immediately.

The sum of US$15, 5M (Fifteen Million Five Hundred Thousand UNITED
STATES DOLLARS ONLY)
has been approved in your favor via my desk. I therefore wish to
inform you that your payment is being processed and will be released
to you as soon as you respond to this letter with proof of ownership
of the fund.

Note that the above fund has been cleared from terrorist or fraud
related activities and everything about this transaction will cost you
the sum of $155 One Hundred and fifty Five Dollar only

Take Note: contact Mr. Theodore Dorsey for more details
through her direct e-mail address below:
theodoreey@gmail.com

Anticipating your prompt response,

Mr. Jeff Kelvin , Secretary General, Head of the CITI Bank Group James
A. Foresee

President and CEO
mrkelvinjeff@gmail.com

SpamAssassin Report (spam score: 6.6)


 pts rule                    description                                       
---- ----------------------  --------------------------------------------------
-0.0 BAYES_20                BODY: Bayes spam probability is 5 to 20% [score:  
                             0.0530]                                           
 0.0 TVD_RCVD_IP4            Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP             Message was received from an IP address           
 0.0 FREEMAIL_FROM           Sender email is commonly abused enduser mail      
                             provider (lizyudor.postmail[at]gmail.com)         
-0.0 SPF_PASS                SPF: sender matches SPF record                    
 0.0 DKIM_ADSP_CUSTOM_MED    No valid author signature, adsp_override is       
                             CUSTOM_MED                                        
 2.8 MILLION_HUNDRED         BODY: Million "One to Nine" Hundred               
 0.0 URIBL_BLOCKED           ADMINISTRATOR NOTICE: The query to URIBL was      
                             blocked. See                                      
                             http://wiki.apache.org/spamassassin/DnsBlocklists…
                             #dnsbl-block for more information. [URIs:         
                             citigroup.com]                                    
 0.0 RCVD_IN_MSPIKE_H3       RBL: Good reputation (+3) [209.85.210.68 listed in
                             wl.mailspike.net]                                 
 0.1 DKIM_SIGNED             Message has a DKIM or DK signature, not           
                             necessarily valid                                 
-0.0 RCVD_IN_DNSWL_NONE      RBL: Sender listed at https://www.dnswl.org/, no  
                             trust [209.85.210.68 listed in list.dnswl.org]    
 0.0 RCVD_IN_MSPIKE_WL       Mailspike good senders                            
 0.0 LOTS_OF_MONEY           Huge... sums of money                             
 0.1 DKIM_INVALID            DKIM or DK signature exists, but is not valid     
 1.0 FREEMAIL_REPLYTO        Reply-To/From or Reply-To/body contain different  
                             freemails                                         
 0.9 NML_ADSP_CUSTOM_MED     ADSP custom_med hit, and not from a mailing list  
 1.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money               



The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement

Please do not click on links in the above email or make use of any contact details in the above email.

Comments

Where the scam probably came from



theScamBaiter freight bait archive, theFailure Cole baits   theFAILURE freight bait from theScamBaiter - Cole v2.0   theFAILURE freight bait from theScamBaiter - Rebait at Cole's   theFAILURE freight bait from theScamBaiter - the Martins Cole saga   theFAILURE Butch Driveshaft telemarketer phone baiting   theFAILURE freight bait from theScamBaiter - Anus Laptops commercial made by scammer   theFAILURE freight bait from theScamBaiter - script of Anus Laptops commercial made by scammer