Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => mc_mxw@o7e.net [delivery-date:] => Wed, 16 Dec 2015 01:38:17 -0800 [received:] => Array ( [0] => from optimato.vshosting.cz ([217.16.180.96]:37181)by bigcat.newsblaze.com with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256)(Exim 4.86)(envelope-from )id 1a98X4-0006ol-Pzfor mc_mxw@o7e.net; Wed, 16 Dec 2015 01:38:17 -0800 [1] => from IP-222-72.dataclub.biz (unknown [46.183.222.72])by optimato.vshosting.cz (Postfix) with ESMTPA id E40AA2E41DD2;Wed, 16 Dec 2015 09:23:57 +0100 (CET) ) [x-no-relay:] => Array ( [0] => not in my network [1] => not in my network [2] => not in my network [3] => not in my network [4] => not in my network [5] => not in my network [6] => not in my network [7] => not in my network [8] => not in my network [9] => not in my network [10] => not in my network [11] => not in my network [12] => not in my network [13] => not in my network [14] => not in my network [15] => not in my network [16] => not in my network [17] => not in my network [18] => not in my network [19] => not in my network ) [dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/simple; d=optimato.cz; s=vsh;t=1450254238; bh=83wm08rwfeukcoSikGkDh0bgGHxUASdz62m2+jCpVVA=;h=Subject:To:From:Date;b=ena3/wN7aE5TG1j/XedYDt1f0AU3o6IdOjSu4P/N979Hw7EPmM0YdErefZnNEBqE0 3OQySiPxowBrywoG6HonHn81q0aWKvPOQW5YcTnr97Ls/TE0+8769Z7G/eall4hSFo hXeBobQ//LBK27S1rty5UUk3sogIg+FhNSa3h/PY= [content-type:] => multipart/alternative; boundary="===============2075044868==" [mime-version:] => 1.0 [subject:] => Signed Invoice for payment [to:] => Recipients [from:] => "LONTECH" [x-virus-scanned:] => clamav-milter 0.97.8 at optimato.vshosting.cz [x-virus-status:] => Clean [date:] => Wed, 16 Dec 2015 10:23:59 +0200 [x-spam-status:] => No, score=2.6 [x-spam-score:] => 26 [x-spam-bar:] => ++ [x-ham-report:] => Spam detection software, running on the system "bigcat.newsblaze.com",has NOT identified this incoming email as spam. The originalmessage has been attached to this so you can view it or labelsimilar future email. If you have any questions, seeroot\@localhost for details.Content preview: Dear Sir, Attached is the signed invoice. Confirm to us if the bank details provided is correct as we are ready to initiate payment today. Your urgent response is needed Scan_005.pdf View | Download [...] Content analysis details: (2.6 points, 4.5 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: optimato.cz]-3.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'-3.0 URG_BIZ BODY: Contains urgent matter 0.0 HTML_MESSAGE BODY: HTML included in message 2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level above 50% [cf: 100] 0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% [cf: 100] 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) 1.6 MISSING_MID Missing Message-Id: header 2.5 DUP_SUSP_HDR Duplicate suspicious message headers 0.0 TEQF_USR_POLITE To and from user nearly same + polite greeting [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.