The email was sent on 2013-09-19 11:29:12 and appeared to be from firstname.lastname@example.org but this address could have been spoofed.
If you replied to this email, your reply would have been sent to email@example.com which was the scammer's actual email address.
It was probably sent from 126.96.36.199 in Unspecified, Italy
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] via 188.8.131.52; Thu, 19 Sep 2013 10:29:11 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||184.108.40.206|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||none (domain of asia.kh does not designate permitted sender hosts)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||aaAnalkWLDv8WCr0GeFYt3e6_VeXIQDR2eO6rA2dKaBpMxIy l9ZY62myv8NsAR233xjVxg.Kjcq_XZX0lRibG5TaPTqcBnilDGruoiTr1816 IsfieK3d2G6cDHd_LspcCkDcMcbPuGJQcPFqm2PGgFviEY5PyvrM89eKW4L7 2VmuS8toYieLlM1y99glBXa.SvLBEIRYzHqzPGweuag8hATm4tXsidbYMwlC F34dPeDTa8SfXo5xiwxQVnWnPuPZJ63sSIb5dTf6.9bNqiEAX1N1C0D1vKhn LgVqEFUkTYXkF1Dq1rdxEugRbq61nj.r1aixm_v4fek8B2ypy9rmsuK.27py iUh8CTxRvX_mJO6eLiZIfwBJTr7YD.ECp1eVvHxEtOTXGBh5AserSTtNqhSS 2NxtGWvs1zio9hZArs2z5DdAJjXap_6VQqG4XEGM.dan8QTxQYXKTauoHbuk 3KT65IcsWjQtxLKV9W5hexIqaUkz8jhPC3ca1Y_7CEB8QaTFsJL0BIJsdQfn Dp5TfTBPMibz.oevUuUFmSXDZwuFJ3T_eBYvVpQg3Q0pf.f2BC2MHhnVz5kF EAfhZvoNpiIxhWyYM7lq5X11INgdHGNIDJcI_2dXqLmjJMGskUg7l6_hRj7A YsKXbwLrkajKlCcmnnUb8V55y8qo4T.6dBE64BEINx.jeat81cfEJdkCBGZt QyGhIYrY_pSp6obXKncCeJailpiNgMfEiy5QpkPPuFGQuKG4qZP7pTQyfGaq KwhQavvo50o3OJZilkFZv5TYLR1ZsG6APjeU7h7BXGu747rDDXpS0iwRmjvK yJcL_TRGYzZ9hho2hgpRC9Ia99z5A01GFFg4xv63OFTqfp_0lfnhbNKb6.t5 RGJp2pI5Twffr1tgBzjVcB0Fsb03AuTwXBv6N4_zJVjqlJv1C7A2la0Ek3Xh pC_HgZHStnX7oocN.jlXUsAwk2LtT07Ks4B3l4y5cUCOumHLhl4muT6GOtM0 0AhR0stv7v_py5Lmnf1ultZRYdTmq9Fzs8M9vERwVrMelvKqgpNBiczBxBh3 4COZ9LokGkEe4t9R2mZWrHunqzsuxoAcPb8Gk2O7PG5.F9C35uT3nIvSaPE7 svEK_7RlN.7aHz015FmIzYMGCBwlROALM_p_hVarZZIsMR2Z.dIXmK0Hjo.D 1M9GZov8frr6YH14vzU5ZbJ3pqAomQD6GGHExY4S_g35iV.ZSvs_fFTRkEoj CLp7ozgG9uEKus9MnJ_TQdKcJK72Lqoh85tPhgmebZPlqSHX4CjriUGDMit1 d01gT9MakjuRqJAaYLV.nZ3Xeu3q.TgXq3KIzQhA0AvHarW6B2v2GYuWcU62 5AMLgi7670HuN6N2ZyORaOLWdXaHBk3y8Ui7Ujuf8XR8RYoa_kkkwP8vM30l wh2ZvIIqp13ptP.VqnIla2uTiHBd858OYEBUKoD_BDGd_N1Ex.BJfMmbZXy. jqGivEJQuPx3Gw--|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[220.127.116.11]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta1006.mail.ne1.yahoo.com from=asia.kh; domainkeys=neutral (no sig); from=asia.kh; dkim=neutral (no sig)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (EHLO smtp.comune.fidenza.pr.it) (18.104.22.168) by mta1006.mail.ne1.yahoo.com with SMTP; Thu, 19 Sep 2013 10:29:09 +0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from localhost (localhost.localdomain [127.0.0.1]) by smtp.comune.fidenza.pr.it (Postfix) with ESMTP id A3F11200B2DBC; Tue, 17 Sep 2013 14:48:58 +0200 (CEST)|
|X-Virus-Scanned:||The name of the virus scanner which scanned the email||amavisd-new at smtp.comune.fidenza.pr.it|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from smtp.comune.fidenza.pr.it ([127.0.0.1]) by localhost (smtp.comune.fidenza.pr.it [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fbLXiBZW4W0x; Tue, 17 Sep 2013 14:48:56 +0200 (CEST)|
|Received:||from mail.comune.fidenza.pr.it (unknown [192.168.22.22]) by smtp.comune.fidenza.pr.it (Postfix) with ESMTPA id AA0962030F387; Tue, 17 Sep 2013 14:48:54 +0200 (CEST)|
|MIME-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||multipart/alternative; boundary="=_284edab67197c96cf75d3ec8ad7270f6"|
|Date:||The date/time the email was sent||Tue, 17 Sep 2013 19:48:54 +0700|
|From:||This is the address the email was apparently sent from||"Mrs. Yang Huiyan Sea Food Ltd" [email address removed]|
|To:||The email address(es) the email was sent to||undisclosed-recipients:;|
|Subject:||The subject of the email||Good Day..|
|Organization:||Organization sender belongs to||Mrs. Yang Huiyan Sea Food Ltd|
|Reply-To:||This is the email address any reply would be sent to by default||[email address removed]|
|Mail-Reply-To:||Same as reply-to, the email address any reply would be sent to by default||[email address removed]|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|X-Sender:||Further information on the sender of an email||[email address removed]|
|User-Agent:||What was used to send the email, e.g. a webmail client or Microsoft Outlook||RoundCube Webmail/0.9.2|
|Content-Length:||The size of the email, in bytes||1956|
My name is Mrs. Yang Huiyan the owner and C.E.O of YANG SEA FOOD LTD, in Cambodia and Japan. I am a dying woman who has decided to donate what I have to you. For charitable goals.
If you feel for me and you want to help me to carry out my wishes. kindly Contact my lawyer through this email address ( firstname.lastname@example.org ) or you can call his private Line +855-9786-96133) if you are interested in carrying out this task, My lawyers name is Barrister Fang Wengen. I know I have never met you but my mind instincts me to do this through you, and i hope you act sincerely with passion.
Please make sure you contact my lawyer because i will not be available to respond to your mail.
Thank you and God bless you.
Mrs. Yang Huiyan.
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)