The email was sent on 2018-12-03 15:12:38 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 18.104.22.168 in Unknown, United States
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Mon, 03 Dec 2018 12:12:37 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||22.214.171.124|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||pass (domain of gmail.com designates 126.96.36.199 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||lNTq9OwWLDtdZR5ZTDuV_N2431KnJv.EP2L3osrG2IPCWN3H .N8.Qd9DtbMar8or3JgnXwhNNZrX23x1T1h58eG5K_B6shTtNetjIrwS86fP lMKMYiiwkAA1Ak7wl8WCwJ6vEICPOhWJqYdMPMjHGTExOwqyrrycAmQOmaX6 jNDIOnAa_rcBId3SsYb7gUz.ztqT.BwGGE8yGkivj_kbdNnTECvAismE0PTP 9o2fQNl08ieUu7rqlkS9TF8hB1ard5caLksMHBW3nYrIIE2JWtrAEB3xy0sM AsoGn9EbyFIjaAceWAyg38UipKaBktZdsbo1Qui_zHavwAcfWdKrxrHrz7bW G88iIRHxJJWkfDwCqhJ.s3zFH.xfj62u9UmuCyRQqel8KGWtd6aaMpLVEuxx VguQXmSyqWUWrq82auvgZsbWuvHxkixlpDh23trNTtsDhGznIgSlfXE0CaBr 3LU6EAoeOCpthVpWSmNdpCFeZDECp_N7zSmKZ7_FvI.xoMlIJwuMWQCggGHf V9Axo_y77uuS74TBhYoRg_H_HwS.2CMjsM817GdybRbbBlgDejvBDZygUk9v Gz0m0ZjEkIHQ7rE4dWq9dB5ahabPZ.451JwLUoURb6lC8JE5fNXKoSwKFUth ngLiFtsqz.kTjF4tgIg6_53yDxxyrAgDVQhQIZkehcrPtFp88XkBCrw6RX_p IlQkYtgqTVzFwCl0aS.wBYx4BSyyXsYP9EAmnDb.MmNKHeVw_w1ae8w1eFti XOZRue64Y6bqvPBUsZ_o5s9aEN6PJeOne7RUB9j__L8yB7T5IZKUFduQsefv I5XgpTTad3Igzw1OnSmv7KmyomjdvwM.sJbt3iEk2j__hDZy6cRI13NSBLha L6M_70K8d1YfXD7sKN.IP5AJjXK1mWUjZBvwvWkwjpouClI0akXnIq4bCPqr 83x8COm9DyQ8Ei1CZBunNXwhl6e11Bve4aTeyib4zG9qEjsNEvknXY3sck2z 9bVJYz0wD4iJSUCVvkIyeHcrdIGsUzfkDNgaqASmiogKEf1vJS_Du1G6aqY7 Ezp3CKrRh6wPqyI_z4IfeyIxX7wd85tIl7AkOQ_wE5LZ4__3pFz1_3MLCxeR T051PzXvV.AZOfboyWYPVXsfSXXMdy_ToJ5Y3hk57aazDAQUQi_ZdcSHhsvN Lx00BlZ9_SjIBYSADJLLTADD5Yogbb8oZ8roawLF_Ua0xMTFwnY-|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[188.8.131.52]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta4318.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO mail-wm1-f66.google.com) (184.108.40.206) by mta4318.mail.bf1.yahoo.com with SMTPS; Mon, 03 Dec 2018 12:12:37 +0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||by mail-wm1-f66.google.com with SMTP id s14so5560480wmh.1 for [email address removed] Mon, 03 Dec 2018 04:12:37 -0800 (PST)|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=uvUbyT2lTjRhOEX0xzX7UiwO9raBd5slNKVqwWf4CBw=; b=I6TzOvi+rICZuAoH05vKW8y9O1NiqwcXWYFKNHF9Dk4bBgA02jtLkKbztULATRolqp YCTLPMlcoJBPpG0vdUQ4cs6qbJfyCd8Uoqi+rXJhYNeK3gsmzWPwOfyvZkn2DAqY/CCb AsfHPxfGMVHU6NAs+a+78BNnMGvT+gOVsYlGywwK0gs/2nYgGNAGoMuRFa4g7FkM5Q96 2h4OQoDToemtJNi3Dnurjttygnfal+5zuGp9SfczDpZpg588RbBI12YJpWkz1NG/+LDW OEcImIYSY9JfNGFbIpXVLsUElAlnLCmg+tHKAZQ3gKssK4v1e7LPFaZltO/6oNaZZgFZ 2Pyg==|
|X-Google-DKIM-Signature:||Google Mail adds this to all their headers, it is used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=uvUbyT2lTjRhOEX0xzX7UiwO9raBd5slNKVqwWf4CBw=; b=SfGvN7zgL5w+7L0SDVj9zKiJD7fkoTlfMuBjS0vlbPXVy1gb0adqodtoBQ3UAqU6iI CaTr3filKmiMUXGvT4DG1Rolu5j/XTwD01NV6tnAZKFyfQf08uv+J6UtVUm9ogC1AQA5 91OcgsEi8fOq3H9olT5z//lqUe5K56+y84H/I/HjxKdG/YemI33olocAF/aA29AbaaZp 64SKBZgXTc05SgcPYdcvaO1lwGbCF2k17iJKAT8/CK+IDp9xTLjMRTYSZawWhpgK6qe0 yerhEIw2OIUQvUpTjPHsZwzD44h1rnxexM0NJHHV0TkuXs0BCeC7nvZM29Fl1/G82mwi Y8DQ== X-Gm-Message-State: AA+aEWZOg50sS/Xo5R8PL2mvnCMzNlz1smN+BZScWE39spN9xu6h6b3B IRWZ3DZseJpw/rUniSsFkAAaMIfDxDMvUvuc/bLQIBeJrrk= X-Google-Smtp-Source: AFSGD/Vs+ZAqvaVsO+G0HJCB6bpyk7is62wTOdT1RD4b82Yl7wKE6AbjkLm8uG/0eoI3JA1EitY/8DK1+u8bsOcLaqk=|
|X-Received:||Just like 'Received'. Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||by 2002:a7b:cb86:: with SMTP id m6mr8153785wmi.61.1543839156489; Mon, 03 Dec 2018 04:12:36 -0800 (PST)|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|From:||This is the address the email was apparently sent from||bami yan [email address removed]|
|Date:||The date/time the email was sent||Mon, 3 Dec 2018 04:12:20 -0800|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|Subject:||The subject of the email||Attention Winner|
|To:||The email address(es) the email was sent to||undisclosed-recipients:;|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||multipart/alternative; boundary="000000000000835369057c1d10f7"|
|Bcc:||Email addresses the email was secretly copied into, this field is usually blanked so even by viewing the email header you can't see who was secretly copied into the email||[email address removed]|
|Content-Length:||The size of the email, in bytes||2921|
pts rule description ---- ---------------------- -------------------------------------------------- 000.00 USD to the new Director here Rev. Stacy Adams. I have remitted
the first payment of $5,000 with the help of my working partner Rev.Stacy
Adams to you and here is the information.
Here is the Western Union information to pick up the $5,000 that was sent.
To confirm your MTCN visit Western Union Website on
Money Transfer Control Number M.T.C.N: 233-055-6611
Sender's First Name: Paul
Sender's Last Name: Larry
I told her to keep sending you $ 5,000 USD daily until the payment of
$8,500.000.00 USD is completed and again forward them your Telephone
number,Full Name, Your Country and address so that they will be sure.
Please,contact: Rev. Stacy Adams with the below details:
Contact Person: Rev.Agent Stacy Adams
Email Address: stacyadams90… @yahoo.com
Noted: If there is any problem with the transfer, do contact Rev.Stacy
Adams and she will solve it for you. The care of the funds is under his
[...] -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (bamiyan45[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (bamiyan45[at]gmail.com) 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII but isn't 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [220.127.116.11 listed in wl.mailspike.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [18.104.22.168 listed in list.dnswl.org] 0.0 LOTS_OF_MONEY Huge... sums of money 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid 1.0 FREEMAIL_REPLY From and body contain different freemails 0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information 2.2 MONEY_FORM_SHORT Lots of money if you fill out a short form 0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)