The email was sent on 2013-10-25 15:44:02 and appeared to be from firstname.lastname@example.org but this address could have been spoofed.
If you replied to this email, your reply would have been sent to email@example.com which was the scammer's actual email address.
It was probably sent from 188.8.131.52 in Unspecified, South Africa
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] via 184.108.40.206; Fri, 25 Oct 2013 14:44:02 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||220.127.116.11|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||none (domain of yahoo.com does not designate permitted sender hosts)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||IU9LonYWLDsmsubguBd5nNh61fp7ksgLd08SMLjuQr_7kJXY FTjeV_pZitvk7VCuLIoImNCUX.loZfDL6E_Wzcb9Qd.BKHDOxGFBtmRd7i0a EQsGRwLAqmuob9ickLfBydjtCaUWuPL.l0aQeNZIhRnHcO4YL5x8wuxabaGV 2ZYkODjGUhjAKUMpYDqQdx7sNf_6ipxD0qq4WV7zYo6HxU7h9mfjjGIYJOg. xh5iuJW2orG14T7NdB_quO0Bh4.CgAHNABjrYKT2DUDntVdGJ_hWby6qTgBJ erEEY6QAUvpsfmJqaiZq6.3ea3pgmp9RAHILCJTaztevSXOSevVgID1B6frL 6Das1bL3X0RS.YoLxD0SFOhDyg1HHU4AsjZ9lJCFgOH1Ear_9SFKJFav6vsz j9hFQNGb0xzQUwUwr3Z20YrqMlrerx.pUt.79.pYURtTMpyGVZxKzDr5QrOt brBYG9.4UM7tiQImz.vEsde3.Oid.QKInGVxH5awyWefmwLdKwzbyrIpYH8m 1B64C6vI4d.1pUfKYtW3favn5M9FzcTnkZdhwGjLvMr4CaNQfFndFLjBBf9l pPPCzxbLoIedP5uv0GIkFJok7v0UmLJhokAddM0iSVoFNWar8IsByou39jAS vT7w_UvpT4oNEPaJazwqpr523oa3BstCu4hiSTT7bAqpdwEabDblTSt0p2dZ LY_AgN2potqU.b0I.8BXcyFpmlD.EusjO1o0g0mpilQzSzSTOhQuyEMvVQvf f4TZdeG0oB0UEA5oQrPDzrmsgFejx9WJEttvNLoFhepdqlq5upyBwkwxJmws ZTpCc6qPCbyE2AMWuOq6vphsRGiSk2VPxE8li.KQltmvxcs1EZ_LFjjILX1m AaTHM_idGfEhZDgnaFmi38E8UOLNLKKPyRHfzEITCDHFrlDaiKgbBROu_Vml 94tiCiGopkTAKRG5PZauqf5EmRjpeZhJEW0wVtVROZCHkMY4KiCXmfpttTI8 oJiItHuyGKyD7IvlcdGjUwfQKB0uFBx7IuBD3j8b2TabT_jhEDpW_8xLRbAE UcCTIOIDlcUgaUOdHbRA9XeMUfvLnBVTwsWxMZ1IKl6KGmD8isirpiuwGJgw 4tOQZMJhTFQumcXs3Uy7Dtg6r16VtZRIXfybynMBA1DZTEYZcMNF7pnLRSDN fyHBXVHJuHbT7KdKcYpdyjvxcMs91wzsnGpt1hWj5u2JD2bOWHbClY3b5.KW gnzEIqST3jVWB2Yy8TCwtcZiznn7APFZEYLUL50l0eH.5yxRNSJ.wqmJeZWF a_pL8wl2hS5quHQ0NK.SSy8Kb0Th.QHcCh47DevTtPYYGcmxVzf7CEUvnBrr Donmef6aMkgr4UQ1QXLULG62z6s-|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[18.104.22.168]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta1474.mail.ne1.yahoo.com from=fondationbs.org; domainkeys=neutral (no sig); from=fondationbs.org; dkim=neutral (no sig)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (HELO p-HP) (22.214.171.124) by mta1474.mail.ne1.yahoo.com with SMTP; Fri, 25 Oct 2013 14:44:02 +0000|
|From:||This is the address the email was apparently sent from||"Liliane Bettencourt" [email address removed]|
|To:||The email address(es) the email was sent to||"Sscatcher" [email address removed]|
|Subject:||The subject of the email||FONDATION BETTENCOURT SCHUELLER.|
|Date:||The date/time the email was sent||Fri, 25 Oct 2013 16:43:44 -0700|
|Reply-To:||This is the email address any reply would be sent to by default||"Liliane Bettencourt" [email address removed]|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|X-Priority:||Email priority, as a number. 1 is highest, 3 is normal, 5 is lowest.||3 (Normal)|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Organization:||Organization sender belongs to||FONDATION BETTENCOURT SCHUELLER|
|Return-Receipt-To:||A return-receipt/return notification was requested by the sender, and will be sent to this email address||[email address removed] X-Confirm-Delivery-|
|To:||The email address(es) the email was sent to||[email address removed] X-Confirm-Reading-|
|To:||The email address(es) the email was sent to||[email address removed]|
|Disposition-Notification-To:||A read-receipt/delivery notification was requested by the sender, and will be sent to this email address (usually the one the email was sent from). The sender was likely notified that this email was read||[email address removed]|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||multipart/alternative; boundary="----_PartID_485306917011954"|
|Content-Length:||The size of the email, in bytes||1598|
I am moved to support you financially to build a future for the less
privileged children in your country.
I felt that you are the ideal person to receive this support due to your
dedication and love for humanity.
Make sure to furnish me with your FULL NAME, DIRECT TELEPHONE/FAX
As soon as I receive your response, I shall get back to you with all
BETTENCOURT SCHUELLER FOUNDATION.
27-29 RUE DES POSSONNIERS
92522 NEUILLY-SUR-SEINE CEDEX
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)