The email was sent on 2017-05-18 16:10:49 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 220.127.116.11 in Ashburn, United States
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Thu, 18 May 2017 15:10:49 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||pass (domain of em.thumbtack.com designates 18.104.22.168 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||pKYCJ4oWLDvmUAQg5JgZoSIN9avwgt0zAxXgGDjCKJPY9pNC W9i_GWDk1_Vp1ty84FPy.ecPRT6bNhyfWnmEtLBCDnLf8VeyVpwAHZsDlSZ8 rFwafWRAgGxfhNKhN8chW.an2O8j38rTDuMPJNv4DpNJAWWAZ_ULED7eWPMU S2JVf0m8NtGaywfbL8prw7z.CJnqK_Lfz.lWDfl4ZIrH8Ear58xdsVBQU6lu MVpVGAmiMLN_L0BqqPYZI9KjCPhuNum.S8srav3b4rseEbCFdCy_vnPCeqnN Cf6Zk6hRHTpFmbEP8wP44Isuh.RNArLrxCG219xH9t8ajG6BoXFF_WSDR7KY CdpOTrCaaF.RHwetDi1sc2B7LRUYD.MJPURk6pTSqVYkFLAC20Yzq1EUrsek MH3hgUL.Isy831KabFFzVPfNKaKFfqJe2tP995WP3Wueq4s5ADeMnei6NEfB 8amHNula3OH_2G1dTRrPurjgPcLOEyk7akSQ1JUKBCo3CYULpR2dEcto_Onv P7cdkgaT_6dKQmw8Ta7tb.zHzWkfuAd8AJd3cH0CDrf.MpnoFdpoihK7P_SV N0THkb6_GlowAsAKehmv1LaOeVRDFmUBhQaQzQdXTBDacw9VmSMNjcnjmPpm 58D3nVthNsAGHxa97E5AtJRy8_n1XeT0xSVEdC1tES9fDPDVFJtht.X_pC.X RmHaOmVNvEwWYdIz7_Q6PDoA8yE2bTRXVDC0QMtSsg3uc3NQrpVKFenF8OEG QpbNfwXOtoadRBjI84vaqk6ZIXr6g2IMAWhav.OGpIBGfp2Wu4Swob4vdTAF ng0uLqZGneEi_SurH3VBNrDTb5gkVqJO_B4rVcfDkefG8yVUEvQr3E0O3LlR m.T8yObmU04jy.G6zZtGtycDO4cO.f.AqZ6JhsS02eJyv_wiF_n61Mvyzfp6 SP0Axx.ezSFce4qi2Cd97M9su7PjVWQiVUE23QlvwNQQnhTOGQV76Nxeqv21 aBvEQhZiOr5naEAMUBkC4yddl2VtLeOMNWm4FkPUAkPonsQqhPGBR5u6.WaU LQJsGgM_JPXwUgpjcPNlmI2gcGiQDFmAp1AFhGKZpQrsb_hewsdNPlaTbVNv DN2i5Ryqi91A2yMhr6tia8lyqkYGo9xU065D4r9gWDiRin0l5aSVfYGh_8vK _H3cqGrO5slZLxZJO0A.VAWHhkQk4rhkOg1XN_4wnGx5krjlrRwk89pm5S._ frmRgi6EVG1P3DUjUF.jn8l8SjSgebg.xkY8luOSMJywIZ_5xeb8ulEWOh3q QyNpKRxRFX3Fg7e2SykLINWVOdteq38UPwGtLeoyp7ejASHssL56H94cjkAK aDhZzr3jVcKRwUd_yXfFR_L.0UjOxWYaz1AmWSrNCX5anr_kLk__mZZEZI_b FQ2fXxQMSyyt5sywiZSTXDOkTkCFg1T9wjLQqVVprhhg4BvSCeBajXGj.J3b J_9OkqCdX07LBpisSkFuKQz13EbALbFUm.dB.CIMVPYkUFowpazgNQCF9B8V Wyqm4JfT965PkM5VXG9o1h2SeRcdTXjp6Zj.IxUhf84n3D.rTbfwQ7._BN5B ElfpMephbHx5RToI5b4sI9b6m_96yMnMK_nmUZeQ8vEjeOhVMqsI0R4wxVK8 zuH7bTeKCZxP8Bx.eyoUKTjQrfLJslu3hDn7zW_UreWO3wvoOBLFkOzJSKQM ZhEJEVhRH7ft8P3F1eBPCWGhkdeBvamHKVPsOhPDpzlN24JVmN_V9Fo.6Rc2 iTa79DMwusgkdLGbqxtRs1JGNddU9Xn0T1hC9tdpfIADjVUYOF7irfMoqmaS UvpeVlIKXawXWQWWwBbDQf0qmXk-|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[22.214.171.124]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta1511.mail.ne1.yahoo.com from=thumbtack.com; domainkeys=neutral (no sig); from=sendgrid.info; dkim=pass (ok)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO o3.email.thumbtack.com) (126.96.36.199) by mta1511.mail.ne1.yahoo.com with SMTPS; Thu, 18 May 2017 15:10:49 +0000|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha1; c=relaxed/relaxed; d=thumbtack.com; h=content-type:from:mime-version:reply-to:subject:to; s=s1; bh=DhyCWTMQll5lLesRPkoMw9R792U=; b=Qdq5da+wu1szspR+leR6+fho88fR6 TJXB34/hgCqOTmzUVip8SAqAZRMTmaSi+rjiWDGLMKqhkaac9L1D8ZAZ3+9+sBFl OQ27FJhJXJu2hIO1EuQQpLWKK023Jz4JIk7I0/910vV8jEWAbIZoAXOe5d1vot7u Jj7mXdSviFD6I4=|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha1; c=relaxed/relaxed; d=sendgrid.info; h=content-type:from:mime-version:reply-to:subject:to; s=smtpapi; bh=DhyCWTMQll5lLesRPkoMw9R792U=; b=F11oPTbanj0xjbDvddgdEnxRjyu8j jl9ZY8LYQwQ47BkhNWAsZd8YVB8MlG3grXWFzcRxosaPjgLgUh3mfW58jytlvo21 efgMHCRi6lfWRa7m7hiGPGM9Ezg6g37DVIXx5wzOmZr6Nw54lRGPqHZ207stUYR7 DS2zZtOLPHZW9A=|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||by filter0937p1mdw1.sendgrid.net with SMTP id filter0937p1mdw1-17378-591DB978-2B 2017-05-18 15:10:48.686219372 +0000 UTC|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from MzM1MDg2 (ec2-52-72-244-177.compute-1.amazonaws.com [188.8.131.52]) by ismtpd0002p1iad1.sendgrid.net (SG) with HTTP id powpLugRQOqx-U5HXmdwxQ for [email address removed] Thu, 18 May 2017 15:10:48.756 +0000 (UTC)|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||multipart/alternative; boundary=049316bf73b8c45d1d3e0271fb6fca371a996f581f64ffb1f63ba98e4bf2|
|Date:||The date/time the email was sent||Thu, 18 May 2017 15:10:48 +0000|
|From:||This is the address the email was apparently sent from||"Thumbtack" [email address removed]|
|Mime-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Reply-To:||This is the email address any reply would be sent to by default||[email address removed]|
|Subject:||The subject of the email||Quick favor for frederick real estate int?|
|To:||The email address(es) the email was sent to||[email address removed]|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed] X-SG-EID: LH6lCcGf1siVtesZ2q3aqa8bk5wJE+iSsmSLmnQD7hkCeeKzf/y29yc5Kj7Wk/tEwK2wSWyFTFkUNd iHNrW0uIe71P7iVYBAQHI9g4WHq+aHnMOSiTHC4ysgxtbEu3Ko/OcCX7UlAzByBy+V4H+WbjZ4I5+y sC9kFId+92smF9HsYtletScCAWFigID6jVkVe00FTlLesbTq0sRmUi15J+TNC53hMyKPYjwQwhyd7t M= X-SG-ID: lLLoBNAGoi5eF+51D9VNhRm4CUgJR1X+OjaMjytlnPWFTyDzZzms98PzxZPn78RpoNRWLsQRG4Ko4O 5q/05KCpGG7YbtenWsD4tTYD/7nnak3+Q705TfBuztLce8dPsltpk3hAj7aP0YDWNnTO+oNw==|
|Content-Length:||The size of the email, in bytes||17250|
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
for more information.
0.0 TVD_RCVD_IP4 Message was received from an IPv4 address
0.0 TVD_RCVD_IP Message was received from an IP address
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 MISSING_MIME_HB_SEP BODY: Missing blank line between MIME header and
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 MIME_NO_TEXT No (properly identified) text body parts
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)