The email was sent on 2019-01-09 02:54:16 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 18.104.22.168 in Unknown, United States
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Tue, 08 Jan 2019 23:54:15 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||pass (domain of flickr.com designates 22.214.171.124 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||CFFAMpEWLDvi0Ev9Cca2uXuGDdF18b88Br5qyGsq4Swp7tqm M8AwW4DIgT8fvzAOb1OhxgN.Deqgt6SLVl_oVUtuzUQHAKMsWm_46REWg3k6 cxD02QNZ6xlbB29E845GV.5K7dm5CBvHLwZUlIXaEq8qynGaqUWnWiXCqkdd iW4mZ446LBxfvPBZdM1IFFuRQqyyWbjcZmEQrpR9lDCb6oqq9PfF6sJcDsg4 nyqYtarBe.j3whpQUm9zQ0x5yh1h5laPYX5z4Fv5794dBegiEy4LwL9EojzF UGVQPb_2FeLL9MFDqlyGzCElb_Db35Q0BowLxBa0nd1e_JD.n7J5jtdSxnA1 XPCcMw1STy3WaILaU_y2SskmV9o4fg0vbneAhMqeyrDGf_baeEAN5I.psoYI W4R0W6CxJjRRI4G..FFVF_KK0O8azFgIe15.WTzPfYxEJPJXk6oodbbMeZ0M efl9RAWwiPpLnQaxllh1Pp1aOtuD045dkmTY5X0WVZFA0xUxrXylIxS0YLum 15hHUPOrgVyQt_U_zm9eiHWN3f72eBqjCZGMqHOc4R0GTcWwN71f5SVcFAcU yPCpa1qFr8RYlhlJfI9zzKpGWbtH.OpIh62LcaknGk3VWbVaU0PK04Ll5NMA GVOOdbMaAK15mSH0O7xfOfGxOGLPqUwopZ_8QSNdXZfD_fiLvo5LpKvv0EtA grXGcsMWRvkwe2C8aTSa0cK6sJHxg7V70tL3G8CrcxycgaT_cQL2zPZNZRFA Atl75aFqw0EYU4wpTRczu_cvuJ9Lv9vZX_PSmiZhefqrMjsp42wqx2djW7ok KmD6J.msiXxqy7sUx1ofUs1WRummOBdtT.0RPXSWoTmu12tMiBCzf6YRtNxd gBcxV9l7CG0VkQVvbZrFjlpsRa7qvNq0gIputk1zZygjxTDQrYepHGU4ZR6K X7h4FELYX3.ZQvprpQke2eoSzPBguY77VtyAXQOiPZctsrDRm4Kyfa1OgUha gGoBjCXwBiZO6JTEXQsUWOxMp5dl6ahM9DP7qOFUaJJ7RDIqDchBi8.efdHY sc4HU.LQlR69NDyw12XI5iSQaCX91HSAMPrqHStNgLXEt3B8J_NeayBWhIpV kJj4xYXcmtX6BIf3C89pvyXtbhX83Pf5.UFtN_6VbtC5acMGE7g9BfYqO1aO ZVjrpH1Jf78vFX3PZTJ7gKHrHN5NFerL.4eeVgji9nu3oGxNEWj3icxUUsVQ FY3ltIWwknwO_hz_McKHCOXC_7aUkadGSpYZeEQ76YiqHRWMyjBAUYb1.3YI iuUjnNzgoa3_HWlb1EC0JysLM5JHWjzaaKVMzgsfajMKcyVoXc4eSQZmy_EM JhRCcbkcPFRhdToeBh8FzaaPq.2C0wu.siaSdLxD8feE2b0_6aDa66cj6Px. 7UsVa8JP63G1lAU17CSip32fgUwepruvwLnD95.VWf96onzPUKl6KpkWXkxq M0YR5DfMGlAbFZMhkDFJPrHpWlQvCiLRFdJiqLfqyGaoBwYE_88-|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[126.96.36.199]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta4044.mail.bf1.yahoo.com [email address removed] header.s=fa14; dkim=pass (ok)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO sonic323-45.consmr.mail.bf2.yahoo.com) (188.8.131.52) by mta4044.mail.bf1.yahoo.com with SMTPS; Tue, 08 Jan 2019 23:54:15 +0000|
|DKIM-Signature:||Used to verify message integrity and ensure the header is not spoofed||v=1; a=rsa-sha256; c=relaxed/relaxed; d=flickr.com; s=fa14; t=1546991655; bh=26H63Wfda7f/lbg2bxDdizGt13DdhGZRAYpKfFKbGsg=; h=Date:From:To:Reply-To:Subject:From:Subject; b=n+E8NZh9630r7rZzNQBsTRA+2u7dvRXwG2Gz6CC2LzXSTUPLs/8X9Wi9SOswI6us7C9MP0V/+Uij9CLYiiFXc5cENrEoiyTh2p2XGz9V43SQ3VIz4cbCvb8Pyc9OjgNhoPdNsJdCJldrJ++gVmhBr12Ay9NZIiESMToHJz/WFzI=|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from sonic.gate.mail.ne1.yahoo.com by sonic323.consmr.mail.bf2.yahoo.com with HTTP; Tue, 8 Jan 2019 23:54:15 +0000|
|Date:||The date/time the email was sent||Mon, 07 Jan 2019 19:13:39 -0800|
|From:||This is the address the email was apparently sent from||"Flickr" [email address removed]|
|To:||The email address(es) the email was sent to||[email address removed]|
|Reply-To:||This is the email address any reply would be sent to by default||[email address removed]|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||multipart/alternative; boundary="__flickr_586767030__"|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Subject:||The subject of the email||=?utf-8?Q?Important_updates_to_your_Flickr_account=2E?= X-Yahoo-Forwarded: From [email address removed] To [email address removed]|
|Content-Length:||The size of the email, in bytes||19925|
pts rule description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.8 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date -0.0 SPF_PASS SPF: sender matches SPF record -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [184.108.40.206 listed in list.dnswl.org] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists… #dnsbl-block for more information. [URIs: flickr.net] 0.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII but isn't 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid 0.1 MISSING_MID Missing Message-Id: header 0.0 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts suspended", "account credited", "account verification"
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)