An
Email with the Subject "Attention Dear" was
received in one of Scamdex's honeypot email accounts on Sat, 8 Aug 2020 03:25:56 -0700 (PDT)
and has been classified as a Advance Fee Fraud/419 Scam Email.
The sender shows as US-embassy <usembassy@america.gov>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
beneficiary1 (209) 387-888500 million usd million hundred thousand embassycontactluckyaccountagent millionten millionfive hundred thousandtransactionfundurgentdeliverymaildiverteddiplomausddollar will security(209)dear mr woodus embassydelivery agent
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[delivered-to:] => scamdex@gmail.com
[received:] => Array
(
[0] => by 2002:a05:6638:3e9:0:0:0:0 with SMTP id s9csp3300447jaq; Sat, 8 Aug 2020 03:25:56 -0700 (PDT)
[1] => from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id z21sor5661012lji.52.2020.08.08.03.25.55 for (Google Transport Security); Sat, 08 Aug 2020 03:25:55 -0700 (PDT)
[2] => from slavesmtp.scs-net.org (shsmtp.scs-net.org. [213.178.226.250]) by gmr-mx.google.com with ESMTP id 69si590560lfa.3.2020.08.08.03.25.55 for ; Sat, 08 Aug 2020 03:25:55 -0700 (PDT)
[3] => from shsmtp.scs-net.org (localhost [127.0.0.1]) by shsmtp.scs-net.org (Postfix) with ESMTP id 22FCF425A85; Sat, 8 Aug 2020 13:16:35 +0300 (EEST)
[4] => from localhost (localhost [127.0.0.1]) by shsmtp.scs-net.org (Postfix) with ESMTP id AB70D425AC1; Sat, 8 Aug 2020 13:16:34 +0300 (EEST)
[5] => from shsmtp.scs-net.org (localhost [127.0.0.1]) by shsmtp.scs-net.org (Postfix) with ESMTP id D31FD425AB2; Sat, 8 Aug 2020 13:16:33 +0300 (EEST)
[6] => from out.scs-net.org (unknown [213.178.226.246]) by shsmtp.scs-net.org (Postfix) with ESMTPS id 68A24425A85; Sat, 8 Aug 2020 13:16:29 +0300 (EEST)
[7] => from [127.0.0.1] (helo=webmail.scs-net.org) by out.scs-net.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.89) (envelope-from ) id 1k4Lsz-0006k4-7e; Sat, 08 Aug 2020 13:15:33 +0300
)
[x-received:] => Array
(
[0] => by 2002:ac2:5502:: with SMTP id j2mr8411863lfk.50.1596882355998; Sat, 08 Aug 2020 03:25:55 -0700 (PDT)
[1] => by 2002:a05:651c:110b:: with SMTP id d11mr8752835ljo.353.1596882355706; Sat, 08 Aug 2020 03:25:55 -0700 (PDT)
)
[arc-seal:] => Array
(
[0] => i=2; a=rsa-sha256; t=1596882355; cv=pass; d=google.com; s=arc-20160816; b=amjbQ9LOF/y+e6Mt6qa0rkdxr0nI4WjN+fFQjOMYGcp/noJ2Vy4Swgt1eojBd6oI1o HybVAIGxtFYJoaGq5nos5ZAPOEqBtJWTbLNQC57XsqIuXvZX7lTB9qnintU7kdHFjCBb eAXRLj0y2iQ7aWAX4ln23gPhbPNc2ID9t5P6K6daXGuHHnObCLig7yqV6Ex0ujreR9Q4 j4yAI68ihysXWbeZcXLucLQGUzT45uNN7S6z8zUVFRiYY7T9Rw305Ww5ijmcsy2azFvt I704h717lWN56AXD1tUarEzvf2OlJyyu3eZ/rxXjaNayT+4OmFXna4H80kQ/WBy15/Cb V84g==
[1] => i=1; a=rsa-sha256; t=1596882355; cv=none; d=google.com; s=arc-20160816; b=W9Qyns2eblOrmDTlSlzq3BwEyUdFz+0nOL4WptNtPiWOYlzuVoO9AKU2vyRMcD0ON4 sG9WFLFOTModE9dAYkoUnZZoy7GXJiA+0zQKcfMnEi41nouZaVrtZtWrumBZ8bNbUHPZ /fw0Ua3Kk0gzIHcLL2QWgxdauZgXoroNoB8IXfN6D76fPTxnGO1QVrVHtsOYN+jmpRmN DCmYXspKWql612pIegA3zadYtHolmckyMjw+YlNGNsJM9I9+Wl5nPN2fwOWfK8Rr4ZwO tn24p1t8Dm6SJeF+j5s/sx0YAEiMS6dAlAu+po0BleFsX45EETf6rMUQ42BUqynS6oMR VUSA==
)
[arc-message-signature:] => Array
(
[0] => i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:user-agent:reply-to:subject:to:from:date:mime-version; bh=0OL/F9+RBnzLk4EZOKmIcUUGsEwmP5kkG8illdqhFpE=; b=x0biGGixCPcxPdWi0PMzx3sdsK6jBwfzGk6dRoxh3F097M4Ro6KbBXuJnOj2BYzMGv 2mwK93jkslzfcY93yZk44uLTqAN11bTgeBjFsHXOGWgzBYH8JAUBWr+OCMDqnGzlVOyc vGGWVm4QsJrlQ99MrV2FDsGlzqyNnefAhomyj0ELZ6VnP5MC42NIZ0jgxoX1qrO6F9pa ufDhW5wqPYCKiGSg5hcKB0ZfvYuax2X+6Ie1xv6i7Sa+KXKwX1KeRmN8dzhDhZwA8G73 ZfO3ug4CLBCW4kl4sLL/oEc3fRM96sUengvKf8frphFnEUfIRWsuGTc9Y5DhV3XlaN+L pawA==
[1] => i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:user-agent:reply-to:subject:to:from:date:mime-version; bh=0OL/F9+RBnzLk4EZOKmIcUUGsEwmP5kkG8illdqhFpE=; b=iAjEOmiEYUb4MnMIEs0R5Ep+M6yHrMfC1xp52j3YZr68ndwoSWoulDfRrAveoeABqv rnxsdFT5J+gX5PFfCOWojDhycedrzJBmL2DQr77eFknncSsmIALVtVVjVYaf17fgzXUv VzvUMjIeieP0dCImoJ8sXT60Y/00vJKyXF12DvT+tnIK32iwv+twCrtZ6ydj6iFjsMMR ZCb2L8t32B3K76rSeXVnoYJ2gHZbKx4KX3RGnF7x/1yzq2GGqohY1rcD8EfSSC7QAt75 jvlrdB8IzA3ftm4ny1HLDCI/pXS4RF59zHGphsGLCjYISe9RyfE48YF7wCuCDS5ppDv5 Tabw==
)
[arc-authentication-results:] => Array
(
[0] => i=2; mx.google.com; arc=pass (i=1); spf=pass (google.com: domain of usembassy@america.gov designates 209.85.220.41 as permitted sender) smtp.mailfrom=usembassy@america.gov; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=america.gov
[1] => i=1; gmr-mx.google.com; spf=softfail (google.com: domain of transitioning usembassy@america.gov does not designate 213.178.226.250 as permitted sender) smtp.mailfrom=usembassy@america.gov; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=america.gov
)
[return-path:] => Array
(
[0] =>
[1] =>
)
[received-spf:] => Array
(
[0] => pass (google.com: domain of usembassy@america.gov designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
[1] => softfail (google.com: domain of transitioning usembassy@america.gov does not designate 213.178.226.250 as permitted sender) client-ip=213.178.226.250;
)
[authentication-results:] => Array
(
[0] => mx.google.com; arc=pass (i=1); spf=pass (google.com: domain of usembassy@america.gov designates 209.85.220.41 as permitted sender) smtp.mailfrom=usembassy@america.gov; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=america.gov
[1] => shsmtp.scs-net.org; none
)
[x-google-dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:mime-version :date:from:to:subject:reply-to:user-agent:message-id; bh=0OL/F9+RBnzLk4EZOKmIcUUGsEwmP5kkG8illdqhFpE=; b=qh5f8F6Q23CLpRwNbz4htbAVVj6xUdy+YJXec6b7TE/KzLfjnWajoU2Gwz5XcSuIkx vYHwvdVS60nni5ikGWY3TP3ADGaTOPqTy67Fy+Sb7Ht/qyYCecxmml+8uv2IlLhIEzf/ k+5UeWBSq94K+QWTPnm3Crl+PdGpgbs4/xthSZBkKCMEMGz+l9WSE/Ba+4hR4GT6qNeZ uHzGjRYPLrxhQSXCaAQ4oLHy/DhNh2d9JjXh5sJQJEcab/wZEpORKYl7sQXtJrNSjk6X JPJ9D6K5ics7C2X6bCW7+o+Zs4zu/zYuWeCYvofWrrEYLwkDDcp5y/ohZs33DC6Y9Cpt SRLA==
[x-original-authentication-results:] => gmr-mx.google.com; spf=softfail (google.com: domain of transitioning usembassy@america.gov does not designate 213.178.226.250 as permitted sender) smtp.mailfrom=usembassy@america.gov; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=america.gov
[x-gm-message-state:] => AOAM5306w6ldSFJMQFuplUYc8twEsxbML336M3ByUWzTz+E5+8CDrxMK XwM6BdzVKZqjGCvPNkdegbs2LmvdW6Zmldh83w==
[x-google-smtp-source:] => ABdhPJxxhq0qUlWpGqVINYIrVd8Oaj+dJBD0PK+q1fDwKXTtZKilIgMw0IegHViYpn94n8WCm28vxycpJphNIk/9YR3hdJ+2e/I=
[x-virus-scanned:] => by SpamTitan at scs-net.org
[mime-version:] => 1.0
[date:] => Sat, 08 Aug 2020 11:14:53 +0100
[from:] => US-embassy
[to:] => undisclosed-recipients:;
[subject:] => Attention Dear
[reply-to:] => usembassy330@aol.com
[user-agent:] => Roundcube Webmail/1.4.3
[message-id:] => <00bb411b8403a383d9713ead5bd751c6@america.gov>
[x-sender:] => usembassy@america.gov
[content-type:] => multipart/alternative; boundary="=_e27086e59eb73b1f510e9415c60d0578"
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
My regards to you and your family. I am Diplomat John Wood from the US Embassy Ethiopia. Please you need to reply back to me right now and reconfirm to me if you are available to receive your fund in your house immediately today because I am on my way to your house right now so that I must be able to deliver your $10,500,000.00 million USD fund from the Embassy to you immediately today.
I want to let you know that some group of corrupted officials diverted your beneficiary fund to a security company in Benin Republic, but you are very lucky that the US Embassy was able to recover your fund from the security company, so I am on my way to your house right now to deliver your fund to you and I must like to deliver the fund to you immediately today. It also came to our notice that those criminals that attempted to divert your fund might be in contact with you in other to confuse you and steal some money from you, but you must avoid any contact with them to avoid you losing your fund, because the authorities must terminate your transaction and return the fund to the government reserve account if you keep dealing with those criminals.
Right now, I am in California and I need to start coming to your house right away so that I must be able to deliver your fund to you immediately today.
I want to let you know that it has been agreed by the authorities that you must need to receive your completed fund worth $10.500,000.00(Ten million five hundred Thousand united state dollars)immediately today, so please you need to reply back to me right away with your available telephone number and also reconfirm your correct home address where you want me to deliver your fund for you, so that I will start coming over to your house right away and deliver your fund to you immediately today as scheduled.
Reconfirm your available telephone number and your correct delivery address right now so that I will proceed to your house right now and deliver your fund to you.
Reply back to my email or you send me a message on Tel: +1 (209) 387-8885
I await your urgent feedback so that I must be able to deliver your fund to you immediately today.
My regard Delivery agent Mr Wood US Embassy
--
Attention Dear beneficiary,
My regards to you and your family. I am Diplomat John Wood from the US Embassy Ethiopia. Please you need to reply back to me right now and reconfirm to me if you are available to receive your fund in your house immediately today because I am on my way to your house right now so that I must be able to deliver your $10,500,000.00 million USD fund from the Embassy to you immediately today.
I want to let you know that some group of corrupted officials diverted your beneficiary fund to a security company in Benin Republic, but you are very lucky that the US Embassy was able to recover your fund from the security company, so I am on my way to your house right now to deliver your fund to you and I must like to deliver the fund to you immediately today. It also came to our notice that those criminals that attempted to divert your fund might be in contact with you in other to confuse you and steal some money from you, but you must avoid any contact with them to avoid you losing your fund, because the authorities must terminate your transaction and return the fund to the government reserve account if you keep dealing with those criminals.
Right now, I am in California and I need to start coming to your house right away so that I must be able to deliver your fund to you immediately today.
I want to let you know that it has been agreed by the authorities that you must need to receive your completed fund worth $10.500,000.00(Ten million five hundred Thousand united state dollars)immediately today, so please you need to reply back to me right away with your available telephone number and also reconfirm your correct home address where you want me to deliver your fund for you, so that I will start coming over to your house right away and deliver your fund to you immediately today as scheduled.
Reconfirm your available telephone number and your correct delivery address right now so that I will proceed to your house right now and deliver your fund to you.
Reply back to my email or you send me a message on Tel: +1 (209) 387-8885
I await your urgent feedback so that I must be able to deliver your fund to you immediately today.
