The email was sent on 2018-11-10 00:14:00 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 22.214.171.124 in Lianyungang, China
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Fri, 09 Nov 2018 21:13:56 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||126.96.36.199|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||pass (domain of woodbm.net designates 188.8.131.52 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||Teuh2HEWLDsdHZyNNgx8RKUyoZuJQMOomiQXnJPp2U68TNRi QQuMEQdW8FpjmxeHZMIR9vrSj.v58zvRmm2WNp9cTItXmfwb0jkI2xfYjnot f5WGFuAWnvFR0qJiT48rVGphKK0.G5z.qdc0sYQOxSS92gkkQgCpe6VP1pmv 3jNY5I1HORO_wZrsiq7QfQ4bVazpH_2x.2sF9HK.Cm1jywtlmMlzHsDMIDBE Ir073UYUHlttDZMimRf4pHlvpKYO5HHhBu6n6SbmqjoH9Vxx4QrVVKBEwnv1 3AEMesX_cp1BU4yhQet3CbKql_a7P9X3oimlS3pgzGjkTFVdpxotw34SJ3qJ .ITADNHi2_p0RfTk2HFqLPVrijeGTCWmmVZsxXNGF4k9vzeVUjEM_OUJinRc 9AqAtn2qGCj7EFfX1hZpLvMOtLgMB66dxwxX9k.2Ba2WiVF3JeG9VkUsM6WB y516mp23jQ8vGmEfAvNKjCX0dKcUG0QfmRO_XG8lPE0zGjK5XT82QQR2qjGo uhrBqsLyj03aWTwF3pKrrJ1hyL2OHgYPtJSVh_di9lCUdiutZF4gT0bwrhZ9 tsJnIb9vASCdnc03FecL2jUbs.vKk9_UDj_JrymhUaAZniDOIQl3icLYL7J8 2rtFQdvBml6cMCL26C0K5p4bDRccIqs55_.WKhhPsvX5DuD9QZ91fLZ7a7TX YFOOiV.9n.A_crPjTgR9HQBFULEFj.M.8zikwHUmVi7MNrCXzGvyv5Ln2i80 AjfPqoe0.wjNWaJeT9LMep3JUXL2pK99caBR3eYXq8Fm44VzDeuveptPQK4A baktxj7tvGu4jENKOYYwd9JZSgrj6ImtDhQXL9U4dUg.I1ut7hM34RLprXm6 lu4hBC64XyxL6Vtw80_HP57pwlIOA8JF.z9AHIn4PgQp7jWHMqb5DYaexaZA qQfcDdp22dCJdoNyDCjZF_up3oRmrvSUB3bbMWdQL7iSceiW2zpQn6ubIuOk 6sJhhpyuTJQ5KSE6M.BQJBLJrD7Aud5BcvkyeLuzBi5kXWp5FIxM3ywRPjR1 FpbvfSIggM4ISxx86jeU2dOyGSbmT70YlDRQtFb_2wLyrJGIWg--|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[184.108.40.206]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta4204.mail.bf1.yahoo.com from=woodbm.net; domainkeys=neutral (no sig); from=woodbm.net; dkim=neutral (no sig)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO m21397.mail.qiye.163.com) (220.127.116.11) by mta4204.mail.bf1.yahoo.com with SMTP; Fri, 09 Nov 2018 21:13:55 +0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from LocalHost (unknown [18.104.22.168]) by m21397.mail.qiye.163.com (Hmail) with ESMTPA id E50E5142A68 for [email address removed] Sat, 10 Nov 2018 05:13:35 +0800 (CST)|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|Date:||The date/time the email was sent||Sat, 10 Nov 2018 1:00:01 +0800|
|From:||This is the address the email was apparently sent from||Andy [email address removed]|
|To:||The email address(es) the email was sent to||[email address removed]|
|Subject:||The subject of the email||Good quality plywood for package and wooden box|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|X-Priority:||Email priority, as a number. 1 is highest, 3 is normal, 5 is lowest.||3|
|X-Mailer:||The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters||Joinf MailSystem 8.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||multipart/related; boundary="Mark=_145383741872691870964118" X-HM-Spam-Status: e1kIGBQJHllBS1VLV1koWUFITzdXWS1ZQUlXWQkOFx4IWUFZMjUtOjcyP0 FLVUtZBg++ X-HM-Sender-Digest: e1kMHhlZQR0aFwgeV1kSHx4VD1lBWUc6PlE6Pxw*LTkJPE0YHzohNU0# ATpPFAJVSlVKTk9KTEJDS0lOT0xIVTMWGhIXVRoVHwI7DBQUHxkWVRUeD0VZV1kSC1lBWUpKTFVC SVVCSFVKWVdZCAFZQUxJTUNMTkI3Bg++ X-HM-Tid: 0a66fa52b3d27f6bkuuke50e5142a68|
|Content-Length:||The size of the email, in bytes||7174844|
The followed products we all can supply.
If you are interested in our products, you can contact me,
and I will do my best to meet your requirements.
Also, the best price on the best quality will be given for you.
Awaiting for your reply and hoping our cooperation.
pts rule description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0005] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date -0.0 SPF_PASS SPF: sender matches SPF record -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [22.214.171.124 listed in list.dnswl.org] 0.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII but isn't
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)