Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => scams@scamdex.com [delivery-date:] => Fri, 21 Aug 2015 17:36:01 -0700 [received:] => Array ( [0] => from md8244.agava.net ([89.108.125.74]:47300)by bigcat.newsblaze.com with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256)(Exim 4.85)(envelope-from )id 1ZSwmu-00010X-LPfor scams@scamdex.com; Fri, 21 Aug 2015 17:36:01 -0700 [1] => by md8244.agava.net (Postfix, from userid 8)id 376EE2663B86; Sat, 22 Aug 2015 02:13:56 +0300 (MSK) [2] => from User (unknown [201.63.14.98])by md8244.agava.net (Postfix) with ESMTPA id 720A7266396C;Sat, 22 Aug 2015 02:13:41 +0300 (MSK) ) [x-spam-checker-version:] => SpamAssassin 3.3.1 (2010-03-16) on d8244.agava.net [x-spam-flag:] => YES [x-spam-level:] => ********************* [x-spam-status:] => Yes, score=21.5 required=5.0 tests=ADVANCE_FEE_5_NEW_MONEY,ALL_TRUSTED,AXB_XMAILER_MIMEOLE_OL_024C2,FAKE_REPLY_C,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FORM_FRAUD_5,FREEMAIL_REPLYTO,FROM_MISSPACED,FROM_MISSP_EH_MATCH,FROM_MISSP_FREEMAIL,FROM_MISSP_MSFT,FROM_MISSP_USER,FROM_MISSP_XPRIO,FSL_CTYPE_WIN1251,FSL_NEW_HELO_USER,HK_SCAM_N2,HTML_MESSAGE,LOTS_OF_MONEY,MIME_HTML_ONLY,MISSING_HEADERS,MISSING_MID,MONEY_FORM_SHORT,MONEY_FROM_MISSP,NSL_RCVD_FROM_USER,REPLYTO_WITHOUT_TO_CC,TO_NO_BRKTS_FROM_MSSP,T_FILL_THIS_FORM_SHORT,T_FROM_MISSP_DKIM,T_MONEY_PERCENT autolearn=disabled version=3.3.1 [x-spam-report:] => * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP* 0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam* 0.7 NSL_RCVD_FROM_USER Received from User* 1.2 MISSING_HEADERS Missing To: header* 1.5 HK_SCAM_N2 BODY: HK_SCAM_N2* 0.0 HTML_MESSAGE BODY: HTML included in message* 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts* 0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format* 0.1 MISSING_MID Missing Message-Id: header* 0.0 LOTS_OF_MONEY Huge... sums of money* 0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority* 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC* 0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool* 0.6 FSL_NEW_HELO_USER Spam's using Helo and User* 0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait* 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only* 0.0 FROM_MISSP_USER From misspaced, from "User"* 0.0 FAKE_REPLY_C FAKE_REPLY_C* 0.0 MONEY_FROM_MISSP Lots of money and misspaced From* 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different* freemails* 0.0 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors* 0.0 FROM_MISSPACED From: missing whitespace* 0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable* 0.0 T_MONEY_PERCENT X% of a lot of money for you* 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook* 2.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope* 0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider* 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal* information* 1.7 MONEY_FORM_SHORT Lots of money if you fill out a short form* 3.8 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money* 3.4 FORM_FRAUD_5 Fill a form and many fraud phrases [reply-to:] => [from:] => "david brown" [subject:] => [SPAM] Re:Remember to call me [date:] => Fri, 21 Aug 2015 20:15:09 -0300 [mime-version:] => 1.0 [content-type:] => text/html;charset="Windows-1251" [content-transfer-encoding:] => 7bit [x-priority:] => 3 [x-msmail-priority:] => Normal [x-mailer:] => Microsoft Outlook Express 6.00.2600.0000 [x-mimeole:] => Produced By Microsoft MimeOLE V6.00.2600.0000 [x-spam-prev-subject:] => Re:Remember to call me [message-id:] => <20150821231356.376EE2663B86@md8244.agava.net> [to:] => undisclosed-recipients:; )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.