The email was sent on 2019-01-03 12:08:20 and appeared to be from firstname.lastname@example.org but this address could have been spoofed.
If you replied to this email, your reply would have been sent to email@example.com which was the scammer's actual email address.
Although the email apparently came from Mountain View, this is where Gmail, Yahoo and Outlook are. They probably hid the actual sender's IP address and put their own in instead.
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Thu, 03 Jan 2019 09:08:20 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||188.8.131.52|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||none (domain of xwwahjkdfzvluem.com does not designate permitted sender hosts)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||D.2ALDIWLDv27THLj91pa0udpYwiVzQ_ogn12EteNTlMn3u_ 3rS95QdyVTm7PTdlcmRzRoo44gCuDo7tWd901i6XBcP9MdO7QAc0_RsXFNU5 jaFq390mleGME1QwL73AY9ORp7QKplgS0ecWJjn6ujaFeN3NmTSmpwP28XOZ n8n4nb.bGh8Hpw71wlrGUIPD5aPaHR_mK2wL4TmnquqS3xFXi3MwJ9snZSaL uifYN7A_foFBKw4boote2WmkpWQbmU4PTv011Q6p1MIKpSyCJT8U3tchlyKE GUmnXATTRFzGysr0ggioH1.cM1P4v6HQUtDm3yS0sWtauRvISGdMWWT5uAqM srrWq5b8EuiZZ.JZxgcndHN5KhDeR7fmdR17McA1xoadNBMuQ5328.25ytL7 Onv7tf7uf_C1BpOdbmmYUQ9SOMEZlDeGscPhWKsUDpTKRDX6Dt3CAlI7I8G7 e1DaXBr_TvAf_Syqbci36FdJM7metXSh2O_vw56psTj563YY46TQb20Yhcz2 4lASF1Zf48wTBzbZl5cff24s0aUkcwaZbdb95.hygOs1qaH1Y8T1_vmR5CL2 oKaWChEwb15hwehOoV5zqwJ6i21j_6832H5xFKBenycL4H8mlwAuWFtyfaHf ABypaddcJ0Bg9kHhZOA8fbfsi3H9Grw3i9TJzc6Q9J27Go8uvJcKmBab60zS SnVboYQlGsKbFc0T3grqiZeCNhj6CUdtYNvTlT4UCJV6c3t0nfTRWWZU4Nxc NHDD.qn0.UKwKG_3bUWs6kEIahJztlvEJ3uKIzmbfx.tw5d1NwU.FAeIMQax MNvOPmpXLoxrqSL2OG5ZMrpzqMXp31qT7JO7NX.egQsdAk0D1PqhimLQkfzL YPU0Xr4vCZMKNNiqVU.V5pcXQsjYdzp61pWLReAd7n5y9MKtHtMUosd6MK3h Ue6hg0TzFnmobrqJcYrZ0ZWwoNxes6E.wgoKx90XJBChVDJyNbHlj.mVLxvI fYmaT0QZAUTnDni2XO_6NWJbokvaI23T9XCYwr5aUPe5aJnsPmXg4W1u9HWg Gg_HiA5lXtUSp3Ug2RBFJdIl7.jTODKE4yDV7FLTvx7FtJME0eQiEcr365WT d1RYk8zTBKPeivLsVBPMYpbkA_5OnkUDlYOthIwQSpr9Uj_BXSn0D4h1H7jw 6UUfcjq3MLUWwqQ.HgfK1sRtkiLDF2esOe5nZrKlrM6MnROkcL2xjuBCvfYR n1FN2mmbtAd0Kp40YDEmClhEUbKyWlFJ0QkAm6c8vlY0h7WDcCyUeg_UCA2x DAxMuzZAcuaWUCgc3uxMtlJjzWn9COw-|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[184.108.40.206]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta4239.mail.gq1.yahoo.com from=xwwahjkdfzvluem.com; dkim=neutral (no sig)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO eiosmxfwup.com) (220.127.116.11) by mta4239.mail.gq1.yahoo.com with SMTPS; Thu, 03 Jan 2019 09:08:19 +0000|
|Date:||The date/time the email was sent||Thu, 3 Jan 2019 09:08:18 +0000|
|To:||The email address(es) the email was sent to||[email address removed] [email address removed]|
|From:||This is the address the email was apparently sent from||Jaclyn_xxx0x0x0xxx [email address removed]|
|Subject:||The subject of the email||Cum & Chat with me|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||text/html; charset=iso-8859-1|
|Content-Transfer-Encoding:||How the email has been encoded to comply with regulations (e.g. maximum characters per line)||base64|
|Content-Length:||The size of the email, in bytes||1238|
pts rule description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters 0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters 0.6 HK_RANDOM_ENVFROM Envelope sender username looks random 0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS 0.0 HTML_MESSAGE BODY: HTML included in message 2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length greater than 79 characters 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.4 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS records 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists… #dnsbl-block for more information. [URIs: bestwaybonus.pw] 0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)