The email was sent on 2018-02-12 21:44:30 and appeared to be from firstname.lastname@example.org but this address could have been spoofed.
If you replied to this email, your reply would have been sent to email@example.com which was the scammer's actual email address.
Although the email apparently came from Mountain View, this is where Gmail, Yahoo and Outlook are. They probably hid the actual sender's IP address and put their own in instead.
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Mon, 12 Feb 2018 18:44:30 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||220.127.116.11|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||pass (domain of gmail.com designates 18.104.22.168 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||yX5V3PMWLDvSV0G9_u6HKfPhBwxyREEnK2PRpmIiGaEQyWg1 ngYRht_qpkFaXXo9grPnVIsFkZnGl0LMqLChJnquMA0.ryZJ5g6lARyo8uq7 S9ncyGDT2kzAE2VSfgjpTca8CzLl9xOYnm3IK_25gqoFOtHXs8o0bszQpcFU uEQWp5BM2ZnBcf_8svF8r8QYOY9Whw18E1bIYRlbMe5LrpqyKRc2bgRTEFwy M4.sM5Dy7OBm1SRxdbvUUeJgQXJNv7TSoaeVxD18Ea8FjNPo5PCM1cINetke NMRrSIuUpXgNFJ8g2AMskGmd7thQehAaDGxHz0GP4UmQO1PCLDjSErjDPQPH MUnvPE.5w6V_O8vUzcWVQ4o43scdS45YCyXMHXy_7qFv8U7I5t_h6zEPpqV6 Pymnmc2GPX8OtUMBFBFb.dWwNm6v63sCUlJ7fKkNnWXLg.jfH0ua1SHSllIH f7Suf9Vp3OXJa7Y8OPamlLl9RWC3wh2wgJ4cvsTKsyylQhr8JcyRoPJrRk5J vokgaiWebB9ez8d24zgeBgCVJmjQbuIEXWZDnhJG4jueFTx_DN3cc1eXt9dV 5A7O8EZ2pWNsbhVXewVRdZmhheoAk3guYKVTZErpVA.mYL5H5w3cTFGjImMk Wr.4agLI2NYgdo.IMDz9jkUxM3stJsFjV1XAuTmV5p4s9M4xbRoLyEGHdbU2 bq5iU8kI2MpgoPGhWW9IS1s.tOO3JAJEboRThXAQbrcz.WEVxwvq_IFiG0xA dkZQdBdlEN_3XJXV5I_8Vxx2jcVmDANfb2BmDdD8KBjoPvKDsXw16fjtacwE XTpPtmxCS.bgJ4eutv.m1fp5DsysrVASd9kKoxOOXK1WDDla4ChbuQDf_Iji 5cRz2GZEqxLoJYVmRxSrnfxbsK_TMbCNzp3nHL9qH_6iPauzSCsCGQ0S9kxX q0iD88qYjDHVDRzF28Q5YZfwqrtS6Kx0DkfeiugjnZu4fTYNvuoEF3KKKAwX DUOMLNvIxi3JKQh7xN6E7k0FE0wHTuuNUohz22KXd5b5xUBi92qz2ZQFWdgr JBfZY69bnllHtyODfVegFTjC5CmVb1cct78lzls6qDG77q67VGbmtgIEIDI9 uqlYr9R2RxiClJ_DQ3C.pZitHy8ZhoykD3rDaPVU8O1bgYlCoevcj.1mMoKI EIkSjAyXI5MTX6Fe0dBOXH2hsT1.2jtE2ehQow.B2Udl6UTW6nsr8UTTAimr 4d1q2nKgH..7ZafNXzB807Gmy9s1c2JofTvM6Q--|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[22.214.171.124]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta4093.mail.gq1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO mail-wm0-f65.google.com) (126.96.36.199) by mta4093.mail.gq1.yahoo.com with SMTPS; Mon, 12 Feb 2018 18:44:29 +0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||by mail-wm0-f65.google.com with SMTP id f71so11427249wmf.0 for [email address removed] Mon, 12 Feb 2018 10:44:29 -0800 (PST)|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:reply-to:from:date:message-id:subject:to; bh=bYtWDVSyYCyZ+0OqpVqeCSO5TmIt3crkeuoqPzW9rXk=; b=Gps6bU4mDcnGC70y9wCvDNSk2MK7AIGTXj9BWO7kJYx9FdRwgo38xURh1VASCtc43w cMllJTuM7XY6MY7m0FM95PiSEhoTlGjI5EJ+SoUwH9gculS9Sv8w8kXJ2b6/uDwDTasA ESf80zYgq6H5F4NoeJKmnirfKgr09VmqmeiAqMvHwg6dKNAu7WeA0jXJBG0jfssyRKUa QpD3tr+ivZeTrHlDf6qypHA88rPzyFqek4LwnokeNXGk2VQI0uEL2pZzDlvC22l6J6s4 aPwIlIHollEWlx7gCLHamBlo+Sy0BFqeFrOjmtRrX85et/p/fnPLwBrrOMWbhxMO62Zi Txvg==|
|X-Google-DKIM-Signature:||Google Mail adds this to all their headers, it is used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:from:date:message-id :subject:to; bh=bYtWDVSyYCyZ+0OqpVqeCSO5TmIt3crkeuoqPzW9rXk=; b=Rk22xmLiQWiZmCfayKDxtF36euUIjkAnrR4BSE/HRL5buPAoDO0ncxJ4UElE9Tc9Je Oaj85tuDAmqan/9+eFF0sXRkVtWcCs+9hzl6jRVJ5zytmay5a1x+FwYKi07IbJmFZlu/ 54octDH1n+/Hm06I525ztWn1cT1cQTLr3uHeTs0A4x7z8CpM+NWH0HpK7DG7iLK09QEv t/5ngMjT6lYbe8qeu/wicrEwh5X/bU7TeBGjvAb0iiiYSk/+hkYl7afvmP+yxCC57HPP HIXmns3KJTDxtctRdnJgUI+fgzZF/X6XP4DlNuq1edbTMQR5COKCyJR5WRlg5e1jXtW2 Myig== X-Gm-Message-State: APf1xPC5Fayofm2e0ubpMpbn0jpXtLmpIR+kxIMvM5MOmo4o5i4hoj1p iiT+fHxtXDE/jG7p+1veq/4V21OIZephlBdXMAE= X-Google-Smtp-Source: AH8x226l9d7zmFn+AzbGniwYf2P1t6lMfR0sEfA9gAec9Sxouc5oNBhi0mMqygF7P9MUE9e8hU1liGPaR7IkWhxqzLU=|
|X-Received:||Just like 'Received'. Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||by 10.80.179.146 with SMTP id s18mr17726456edd.190.1518461069163; Mon, 12 Feb 2018 10:44:29 -0800 (PST)|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||by 10.80.163.208 with HTTP; Mon, 12 Feb 2018 10:44:28 -0800 (PST)|
|Reply-To:||This is the email address any reply would be sent to by default||[email address removed]|
|From:||This is the address the email was apparently sent from||"MR.FRANK JIMMY" [email address removed]|
|Date:||The date/time the email was sent||Mon, 12 Feb 2018 12:44:28 -0600|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|Subject:||The subject of the email||GOOD DAY DEAR,I AM DIPLOMAT AGENT MR.FRANK JIMMY FROM DHL COMPANY,|
|To:||The email address(es) the email was sent to||undisclosed-recipients:;|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||text/plain; charset="UTF-8"|
|Bcc:||Email addresses the email was secretly copied into, this field is usually blanked so even by viewing the email header you can't see who was secretly copied into the email||[email address removed]|
|Content-Length:||The size of the email, in bytes||1833|
pts rule description ---- ---------------------- -------------------------------------------------- 60.00 FOR INSURANCE CERTIFICATE
THEY SAID THAT IF I DID NOT HAVE IT THAT I WILL NOT ENTER FLIGHT TO
YOUR HOME OR TAXI SO SEND THE FEE TO BENIN REPUBLIC WHERE I CAME FROM
THEY WILL GET THE INSURANCE CERTIFICATE AND FORWARD IT TO ME HERE SO
THAT I WILL DELIVER YOUR PACKAGE BOX TO YOUR HOME ADDRESS TODAY OR
HERE IS THE INFORMATION TO SEND IT TODAY.
RECEIVERS NAME ADAMS ADE
AMOUNT TO BE SEND .......$60 DOLLAR
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)