The email was sent on 2017-07-05 14:36:31 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 126.96.36.199 in Assiout, Location found from phone number in email
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Wed, 05 Jul 2017 11:36:31 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||188.8.131.52|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||pass (domain of speedy.com.ar designates 184.108.40.206 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||EbRMwn4WLDv3i1FcI3eJ6aHW8iVSFNLG9x51.49tRfJAokFN kRgA79uTLSPYfw43Kqe2T47bUOI6GvvsAIE55DX.WlYpFlCYIKoaPNeCBhzx LB4He4Gwbn35J0eJqMa.2FnNczuAT4BDx9wWbssqLUVEeHFS7szKL4Razy_I Tpw6gkeXpodoMgDfPRQrTMRbawsxLtnzi1fK72wpdMOV6nm6V1mL.wpi5bHr DHOdJEqcvGl5iTS0WMncumd_d7y4e9zGpuJL7z9ZEjpp18DGwVHBQh71myhc KheFJVBuFXFT5BCKBDZwteBMi37uNbYAc7MDoalb7TIOQ.DVgAL9XUoFTh_7 1ug51X.OzDq13TZzrF8omfjFcY75SOYWn52hSArhhB3oRwGHfWMgt6cR2VcS GrsjEPhrdt6bboXSiZB3YU_8timKCB.9S6Sm9qQ9024UGMLvK2bjtF0.U9fH AbyFQEWzZ4_MMGnWL4L_ZGPMggZuQE4ICyneJmCI52_SyB5m8jLXf28DfGPh 7mAS7JLERaoZHYKHp7tBNcxPIrWhcbhXkisoj2GnzjmfHRN4OhanMK9sQhud BtrJbSdfqD1GH3JGMQYKS32x309gSmGPyir5e1lGIgj9hCvK5vTv_Bn_5ZE3 6AjldQJQxQG_sK4SkBA7TnVdfvsjn0d2L.07pnU4VK1XaMJ8n8kQRzD_5Fu2 YIAUwJsQjBxgdOG4iphVw.CLLPCt7jpVvU_UIyt.1lhoSJvMdGfIAgvyfph3 eV6eXuNzGNTiPtSWbnWDjD53ODP7.okC4pvER7dRxjS7gpKbHUL6cildTsB3 7NRAjhgyH3nZGK0xKcgwxC5d5J1TYn_jhoNDdjh8AxnXdF6CdMc36lI09.Na 1Xq1.ap.1hbzQlHlfK6Y6bfqekVnlyw5WHiO7Ilt54zjMNAGbcbpcNpqV7gO Z2Q1DjYhB1DF0O7r9_LoL1TJXyZ.PQ7Xt4cMG0tqLtvOp35ZMTVIpaBSPe3U CeVTw6z3fisobKqd0SQ6aPw_ZD6NpRee2tspQEzAA7RDtApuQz5Kc11.T8II Wf89drFo4df4k3.IZ8q5SLR6fW2Vg9SvI2j5Jobj7ziTSwyeZ00hFB7jdliq xaPO814ZnMcuPse6YzzarydvFFdnMVNLXrJIpP5IleC62w69aWn_g.LuipSz iotx|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[220.127.116.11]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta1339.mail.ne1.yahoo.com from=speedy.com.ar; domainkeys=neutral (no sig); from=speedy.com.ar; dkim=neutral (no sig)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO terra.com) (18.104.22.168) by mta1339.mail.ne1.yahoo.com with SMTPS; Wed, 05 Jul 2017 11:36:30 +0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from mail-out-cmgw02-mia.tpn.terra.com (unknown [10.235.200.117]) by mail-sr-good-la02-mia.tpn.terra.com (Postfix) with ESMTP id 0C57DC08CC51 for [email address removed] Wed, 5 Jul 2017 11:36:29 +0000 (UTC)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from localhost ([22.214.171.124]) by cmsmtp with SMTP id SiaddxRwcnJNSSiaddJA1l; Wed, 05 Jul 2017 11:35:29 +0000 X-Auth: [email address removed] reply-to: [email address removed] date: Wed, 05 Jul 17 11:35:27 +0000 message-id: [email address removed] to: [email address removed]|
|X-Priority:||Email priority, as a number. 1 is highest, 3 is normal, 5 is lowest.||3 x-msmail-priority: normal importance: normal priority: normal subject: =?UTF-8?B?RXJyb3IgaW4geW91ciBwYXltZW50IGZpbGUu?= x-origin: 126.96.36.199 from: =?UTF-8?B?TXIuIFBldHRlciBTY290dA==?= [email address removed] content-type: text/html; charset=utf-8 content-transfer-encoding: QUOTED-PRINTABLE mime-version: 1.0 X-CMAE-Envelope: MS4wfMNHAVz3m8Awdab9DIBWKeL7Wru9F3hTrtnTM4tNIQeAl7OWJ5HkeOfVjYbc2juN27XCkYCPiR4p4jWKgRWhjrtLw9ntNLd/Gs3uLJyPLZd62sLslyRS OezMakVN/6sI2qc4JZZvdbDjEJKfVenfX0b/MD9vLqngVNc9IL8cF8sf4M/V5Nv6YMllFNFSGafWKkxqzo7KDdFq9aB6i+52fXTa44C+hRgqyMctDbn7CLEt Mb45Q1oKFZFB6cKfBxcmFF74yUXq2MJnJE5zI6SFJzKYbhcUSdzm1FJtFPiTbsJPITGrtDDebMbWg/GoxLfoCcYIAjKHaew5D5zqMuKM0ubOlSObO2O+1wIL rxh4dE481AxFf6lotLhPH6q0xHdnGrp2q5evWApjfwL5H3mGAeqjkbRADc54BY3bjAwcquy9bjScz+8M7lDsKOjhCyyBBf3YdNIdckjtfDXZb/i/dAkPeJd4 vzHmwxGxJvj42bK0zeXb+Wx1AFVuar9jw3UJ8GEkZzNFcGhYDZ2z4XrqvU+m+ranXd8LH9BUOZrlw6kOLB+SwJRQdEH3+BfuulA8fwq3RtVGxjg043OW1VtO RSMTAl+8wYhCNkQpsKVOMP18Y8PW0aet1DKRLC35FzgwBiAP0rYjbYdlakNYmQh979tu5JWZ5t6w3yj2zhCXcc7GzGB+fy2yqweJFA/zc8q9gtJWMFvz3+K3 WeoeXTIh/u8MvXGQU9yGPLsxY55eLg9A330vVXoTpQIvVjrdH8M2Wzn06keTjTuI/NAUR8G7lgpL5KsAzncbG3cLTszd62EMrOJb4Uu7v9EoSlNCECTw7TIw nYgOiPWeopwrnIY+r164xhqrlYxJRjP92vcyXDX6KYu2I7+7/firfGRBZjyvZa/B7spilobbgBe5u2ZjLuUJGlKgm5ilQDlKDamPa/RWqJ9/nVUjB8JF+0zk TstlXJC+RyrO9Ml9lva7/bmqQa1bYLAZd1tdPHFDXDGF1R4i+TpgLHKEMEj0oowvqU5KzoAtb0G7en8s6mFrw3bAsnuH1HtInnEpHF4Gvd8dqvqRqMJtUum+ L/PfztPsWIptoavokaZZklWCkcV3u934aYd2PIqQiqyEShIVU8yjwPgf6a+5tJRTAPCDEujCRwJqU2Ur3ZjD3TeV9JMDsG4okLmxXStVz+WLRapwmQoYYfgT a7hUBMlOdIjfxDm7fGo/1ASRU+jF+gz1Ux+uJCxSBfZaxpJR7fwyOT5GjqFRJT/DgXWBiFnpHk7JTF6PHSY313Y0aFaLu/MoyNz1Ro9gw7+tZdAdqT2Zuc7w tOV6stC9SHbkN5uny0d1Bar1VbDWb2uQVZiylZeEjzXGueaz85b0aPYSH3UCOu1OZbB7QWqqoPgbyMu7UgQinDpuxS4JeQsq0S4QGQX8UsD31ZmUUEdNuJ5G BOA2nwhB6VKSYwu6GOqKC6n3hrBZMs1ltqIY4Ikh4/6bw/y088VbCu26EV1Mhwy5p99MgJPlKrFlgfdlRkdHNnL/WCJ+sHHyiAauTRKDJtKBIMZgh5/c+W3D ehqh4c6CkKbjU3zl0mD87DZrV8zcjnI3izDeHeeHKRmw6P+gqpoEGpqGF5aNMjFoFWM1QD4IyMtHpc877+WH2h/yBIh+xgNmhFHyty1W+jXIhaSi6xngDzX1 2bsToPDKEJyGVTv5TuZnm9VSELrhAJ/sIc5BgOTASJLXC4uIFPBcPQ5mqS8v79ql+WlpU0suJE8OhmC8GZzUqjHrkZT5uQ/DNu1wfpbFK+ncPsmuW2wlmdCR 4Jv+T5YKNlsMkyAhbvOR0Q7jSg2cD1G7Ofrny/rbs8Wwdo5x1ujOkssq+7160TRRZ9+2kEDv6vqSpUVtGkC9s5D5k6W3I6QvF7umrHkYDbLZsi90DbVJZiNZ q9IOWzcEZbUeZXXXoZ7fqITipdtqfz5bM8jppKevDTiw9rFQJRtXmXjSvwCxeLj18LSy2UqqCI2v5UNikSVEkZFP9j8+v0QrYA058w3s0UixTrt1FXKeGBjs vwgGZ70ofP8m6mSFTNNUyTt1dLcPGagnOfm8EQ4421hqexwQkvjzb+0mfBFUHnD6tQufu9x3y3wjqs/4ygOHCNHTWYqTT6bIANGv4BWzYB4g5WMllOd6rUcx ZcrkppFzjcGRIXOaJfQonCoWMEuv3mQIe75dWoLRIihyac0dLS0GWCWVYuUTdl+rJRGO6i52Nolg7GFA2IWPEUe+GY6P4fBBbchrnMkfQ1rujnGpff6vusQ4 vUdR0p7276TkrvMRA/2EinaHc+QdCO7HyEohjdDGH+rg9NiOTZC/w24XkSB8up5rXx7reluuBVngxvnHRJwjUTGTIOjvQtNN/gYZSVwFNY+WFKOGusyAQbdt gLrkgEEkr0PiTH4jo/CY3TR+mcQY9sLmDxSsfqmwkG10TqP8JMAT8VbBGa1L2PTmVXroA7fgcTBMnr6/NiCtU3ns2TSajPrfDk0YC+aJvEFcFE3muUC+72mc 2C5/NlLqBgkwpSZO3AyCKtmw9e0X7C3UhyJHwAviXQrIG9inPC44qODiyedwRHcOFlCmRJWlNhpdShSPPq/5cz+DC8iJ0+8AEamz41zSdHKFgT54VCPQ832S +Hc0RW6YV7TJBMTT0HRoFo/+HMlLv/G8ESlIusVXd6YG5xO7SoxvA63B4RJxjHAqTwZG2A+A4rrFbJVHgIfctI/vJH1lQs2js7si1bCjjR+Qgas1EyMqC0Z4 mR7lIigQL7LAIP5WdCcaVlspT93oTTpsSBMCMB6UI2ROX+vuHyDPGKaOJF8+pT27owRrfXkJjvfN2N6HR5EvJqI2VYEMbz0TOhTzbK2tRyDhQjHCjS4M+J/y 7JEKRM3/sHJI4VHxdFD0yn/ESmQ=|
|Content-Length:||The size of the email, in bytes||2673|
pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 T_DEAR_BENEFICIARY BODY: Dear Beneficiary: 0.4 INVALID_DATE Invalid Date: header (not RFC 2822) 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [188.8.131.52 listed in list.dnswl.org] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit (petterscott316[at]yahoo.com ) 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag 1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily 2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From 0.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)