Here's the header:
Delivered-To: *****************
Received: by 10.58.230.41 with SMTP id sv9csp41801vec;
Mon, 16 Jul 2012 00:43:41 -0700 (PDT)
Received: by 10.50.104.168 with SMTP id gf8mr4441778igb.62.1342424621046;
Mon, 16 Jul 2012 00:43:41 -0700 (PDT)
Return-Path: <powerballagent12@yahoo.com>
Received: from nm38-vm1.bullet.mail.ne1.yahoo.com (nm38-vm1.bullet.mail.ne1.yahoo.com. [98.138.229.145])
by mx.google.com with SMTP id k4si11585777igb.69.2012.07.16.00.43.40;
Mon, 16 Jul 2012 00:43:41 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of powerballagent12@yahoo.com designates 98.138.229.145 as permitted sender) client-ip=98.138.229.145;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of powerballagent12@yahoo.com designates 98.138.229.145 as permitted sender) smtp.mail=powerballagent12@yahoo.com; dkim=pass (test mode) header.i=@yahoo.com
Received: from [98.138.90.52] by nm38.bullet.mail.ne1.yahoo.com with NNFMP; 16 Jul 2012 07:43:40 -0000
Received: from [98.138.89.166] by tm5.bullet.mail.ne1.yahoo.com with NNFMP; 16 Jul 2012 07:43:40 -0000
Received: from [127.0.0.1] by omp1022.mail.ne1.yahoo.com with NNFMP; 16 Jul 2012 07:43:40 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 432242.94848.bm@omp1022.mail.ne1.yahoo.com
Received: (qmail 70971 invoked by uid 60001); 16 Jul 2012 07:43:40 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1342424620; bh=98aIAxOcFNrQZcv6y00MfEbrDW0+zs0H3oB73p2FlUo=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=FEVoRYxZt87ehO9donKNAj44iB65fg/7Hc41vq737DGu9uzmpeyIiDwgAAwXfUt+e6yUAziZAkBZ3sbA/w3fDp/PyDqkuK4U0Ddpq10vjdmmpKtvE6ERE3oM/cUz3yKsz/qd0ia9JAKBXHyq0Jhfw2VhzHnJA8QZYPLipjb8qHw=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=suKf3tWl6AEOrGNzkcrR7M236egOT/ch6jkE7RtwB5ylcG+aJZeqPGugezniIt8adFTLeBGfsezfhnY+UnVNYDUJrbO/mQ3nrViN+APIEIiLMHA2sOz80YhzelNGxAzaFtmlI/VAVW0/wKDuPgttWm6c1E0NPRmqggjFQnqssK0=;
X-YMail-OSG: QE4qLioVM1kJ6qNRzkVr88u2pUWs6Vdqol02NRK8yy3VlcC
ibP0vLQoXKciL_rUmhnxUwoh4M48JycRlkVl4PZ24pU59pt.gkwxCdqK7RCj
lNesZR4GEBuUYaJsPJxivaeN5UroKf7uYxtdiNcbFFp8ukG.O7CXNbu.9707
b5zRaeVQIOYy_VK1H6S_.j7wegy1H_gzWtkgXMgFlKrZeLEXyvxIduhFW4Zg
AiuXkBfpc_csHKI.pWk4P2u0nwJ1kowyKhLWX56HvdFYcagrxaMbTipZD25J
k.kfNauYDZIiXX4Rt3RphhuXUgZiTTWBRSL16sKCpMmPWVqLwGtBuO.iGELy
FT8X8rresDi_aGNYpoQuqGSLTJekBuMH3BdRMMioJwFs_x7MCODp3W6Z.ZdN
2oru8rWFIYQJZoQa6ulmnM6sMe0ZCsM.Me5mm6IZOqbw3iHFBVy01FwYOnHq
QqbiWYUDM7AIhoSsO4DzN1p97fVjpMg1Hg.0R.Eh8EeFdn6wwO2O5bYxpp8z
hyGlxmFJkwQqx23uNv.BUdRV.BT5cLg--
Received: from [41.71.177.95] by web121501.mail.ne1.yahoo.com via HTTP; Mon, 16 Jul 2012 00:43:40 PDT
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.120.356233
Message-ID: <1342424620.65376.YahooMailClassic@web121501.mail.ne1.yahoo.com>
Date: Mon, 16 Jul 2012 00:43:40 -0700 (PDT)
From: John Dave <powerballagent12@yahoo.com>
Subject: URGENTLY REPLY !!!!
To: *************** <**********>
In-Reply-To: <CAKJzpRYdjrBK-eck3OF1cuyCNv--zXcZ2Lj-xpQYFcYEQAcXLg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="1389141485-231755765-1342424620=:65376"
--1389141485-231755765-1342424620=:65376
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
And it only took me about a day to kill his website, it was a blatant phishing site, and I don't think the scammer realizes yet that it's down