Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => submitted@scamdex.com [delivery-date:] => Mon, 14 Mar 2011 17:11:51 -0700 [received:] => Array ( [0] => from nm12-vm0.access.bullet.mail.sp2.yahoo.com ([98.139.44.126])by chester.loopbiz.com with smtp (Exim 4.69)(envelope-from )id 1PzHrZ-0003M0-Onfor submitted@scamdex.com; Mon, 14 Mar 2011 17:11:51 -0700 [1] => from [98.139.44.97] by nm12.access.bullet.mail.sp2.yahoo.com with NNFMP; 15 Mar 2011 00:11:54 -0000 [2] => from [98.139.44.70] by tm2.access.bullet.mail.sp2.yahoo.com with NNFMP; 15 Mar 2011 00:11:54 -0000 [3] => from [127.0.0.1] by omp1007.access.mail.sp2.yahoo.com with NNFMP; 15 Mar 2011 00:11:54 -0000 [4] => (qmail 86464 invoked by uid 60001); 15 Mar 2011 00:11:54 -0000 [5] => from [41.216.50.26] by web83804.mail.sp1.yahoo.com via HTTP; Mon, 14 Mar 2011 17:11:53 PDT ) [x-yahoo-newman-property:] => ymail-3 [x-yahoo-newman-id:] => 197595.39466.bm@omp1007.access.mail.sp2.yahoo.com [dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1300147914; bh=yMcbu5Q7PNfMOEQPQbkApXkikz7q0Q9XV0xj4StuUBs=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=YCZF9U6WpnkzVwBoozb7XmtP7EP5umsIA0UjeMOgTEAUq58Lwp1XcfowbXZqfFew1A6GdBKWnQypIvcGoOJi6t57G9P8J/cZuljogm3QCSWVx6Zb/Baky4/caE0ou8o038vbkwbsCnYUIX0knRGxBmH0f86ch5hu8LjEgr6PopA= [domainkey-signature:] => a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=XjkvRV0A53/k/sFcsyt4orlylFHi9aVESIPvY9hXNf+zfmrDJr+pPOtvoiOSEDc6WiZ9qeI+1wRXTQxrQAk0c6BY18KgaQt359MZDWojPctQ3zbvi2W6vD+jYiRro/KfqQg9R0oPIK9x57md61zdMhf80TiM1riVLZb4KDeUCHA=; [message-id:] => <58339.85721.qm@web83804.mail.sp1.yahoo.com> [x-ymail-osg:] => ATeFQO4VM1l4q.cQYSJkyocAfYC3AmpzH7ejGSpzYi9TO_BhpKfaJ_QzKEPQASZGUf8elgy991PEqoRFuS12MAhoXmN2QdyZ7Apd.dVTkF6vR4.Lecr5F37HLo6c_Q8CD3vHrXY.rRYNIeLB8a7Ma2YYKyR3BRoQCptgqIICfyt2ksjKEOIBoTu2Tm45bq2RKB.FPhI_w3E3MgaMLpi1VQze5gJNwEhEJKsn6LXm4KpdRS0EXpZrAcYvacEQp1N4W7G2UmCMLQfokfe1kcNhdkDFd_J1SuCZxW88OKSHrSMQ6ed8aO3w46554Y7B5YWYySNSJ4sMw9sWeVxHvZi46hcXZZ_Gnou1EuDcQaEH5kcEwxi7DWcLoiq91pbA.QCW76pt4ErXz98JAxqr2lcLkXAa6FgIRslxBxrYRLc6Ody7MgevNAIrj2n7rIZY.rJ.jpKLwuL.u2P2L0DWcW3zTjTu55kdpmTk_vngKhHZ_tke.rmumNYFyyKQGfcD9F65sfAOkrVLatiOSWNZ1wLrh7yS5HhNqdtOiTsl7VslsQWdrGvI5lNtjOgasUBUOA0UmumBcGEz6B2jsaK0DscBwPVWVeQCNZiP1YbNKiV83qgElZKt6ltIHxTfKcccASDbtFK79lsEsawzrEEZMtzz76U6atqZlJP2ZpoSBQAJ4TBtajNeKqNoyI4iK9FKWuqJpK7_zA_4pazBQ1E7z1uahXqJge03d99yBc2fx6Myjdk2XxqJNxe41Y2ZaYRhVsXJdw9qmwkpxzxsWjkA7_gdsBZw3C6o7TpQJQ9Q_QqJE1Xh9C.CNNUpxeQs6COwsoS_eXOq8nZ.fRrjR0vbzz5KazkIahHVmZwyjKQEgUNyGi8MA7uUiv7MlhEFjhbQWgk5.0w5K9uO1OCjD451zrkeQvaTambw1yyL0FlTnMU_JhItygdp2TvWos3zEabAfwR_tRT6VompTa_t8I_V659_WVJKtn9G3M_FsjflqXv2qj_icjrBuAR6QadEDCtYmoVcT5hfA3oK3FKG6aFhRfxcGBQeREavnLuJrSC.xKhStcabkGEJPn9IZCiqbXcZpVj6E1DvbKMW3UDZJpkMLInrokuBYk5tGR_J.MeuRIRP74.3QyZulw6h3THkClOix_X5JeDVFkkDpefYBemIHL7arouJVm7dzEagKv3F.o5E8vdTyHFN.qofy_kwWxm.e8Zg.dW8WfESc9jIMlpnjgy.AYXZ0hYJtOiA63BLPleVlR7h92RnDP0Oz0L_9wfJ.o7d1fJ2Bm6lE1JnX0i8s1cqAUUYIIndesgD_gg4eOEM36J1oWbaMnNJPdhCunh1izEYGMBToaszdacwa7ysvOMtHjaU53F7VdpUXAE1TFhQ8st1fH.oWuNxspMVDZa3xjX86eybj.BdYiVI48S_mZFP7A6IUY7PNMl_1eQ20RaB9gjRY4EOh3WZjjmHcsFrq3jJqy27NfypzCqtckPKaiCgohT70W0QhPetNEAPonWK3G8of19PCxdTCNvYyR7yhkKTw2gBeBVoYeCA9uCiDv2wQnj2VZj_na81bYHqF3iIysZ93BjXgo5.wNZcyQ4EGuxvpzwL5ZHY_HZp9VbIsOzEZlvwrHAbs8k5N6LCVMg_8JrmMOOqCSdKzDA3F3QgVSH2ir9oCAcu1TqgTPpi9y9rAoXWH8cvDw-- [x-mailer:] => YahooMailClassic/11.4.20 YahooMailWebService/0.8.109.292656 [date:] => Mon, 14 Mar 2011 17:11:53 -0700 (PDT) [from:] => "Acct. lawrance Eze" [subject:] => CONTACT ADEX COURIER COMPANY BENIN BRANCH OFFICE. [to:] => undisclosed recipients: ; [mime-version:] => 1.0 [content-type:] => multipart/alternative; boundary="0-2146945015-1300147913=:85721" [x-spam-subject:] => ***SPAM*** CONTACT ADEX COURIER COMPANY BENIN BRANCH OFFICE. [x-spam-status:] => Yes, score=4.1 [x-spam-score:] => 41 [x-spam-bar:] => ++++ [x-spam-report:] => Spam detection software, running on the system "chester.loopbiz.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Attn: Dear Sir/Madam, I have been waiting for you to comedown here and pick your $3.500,000.00USD but I did not hear from you thenI went and deposited the $3.500,000.00Million US Dollars as a Consignmentbox with ADEX COURIER COMPANY BENIN BRANCH. Because I am traveling to Dubaiand I will not come back till next month end. I want you to contact the ADEXCOURIER COMPANY BENIN BRANCH, to know when they will deliver your consignmentbox to you. Please I want to let you know that the director is the only personthat knows the content of your consignment box and no body else knows aboutthis only Dr. Mark Dibor the director So please do waste no time in contactingthem with the below information. I have paid for the delivery fee so theonly money you have to send to them now is their security keeping fee of yourconsignment about $105.00. Please i will advice you to be friendly with Dr.Mark Dibor the director because he alone have the idea of the content ofyour consignment. Also be informed that I did not give him the key of thebox so please take note that as soon as they deliver the consignment use thisCODE NUMBERS TO OPEN THE BOX TO KNOW IF THE 3.5MILLION USD IS INTACT ANDCOMPLETE.THE BOX CODE IS 4475855 AND I WANT YOU TO KEEP THIS CODE NUMBERSCONFIDENTIAL IN YOUR HOME, SO THAT ANOTHER PERSON WILL NOT GET USE TO THECODE, MAY GOD BLESS YOU AND YOUR FAMILY. CONTACT PERSON;DR. MARK DIBOR, DIRECTORADEX COURIER COMPANY BENIN BRANCH. CONTACT PHONE/FAX 229-994 966 16 E-mail:(adexcourierc@yahoo.com) Try to contact them as soon as possible to avoidincreasing the security keeping fee I gave them your delivering address butyou have to reconfirm it to them again to avoid any mistake in delivery,reconfirm below information to the company immediately and tell them to sendyou the airway bill receipt as soon as you send them the security fee. Iwould have paid the security fee for you but they said no because they dontknow when you will contact them so please they are waiting for you to contactthem with your [...] Content analysis details: (4.1 points, 4.0 required)pts rule name description---- ---------------------- --------------------------------------------------1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net[Blocked - see ]-3.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'-3.0 MILLION_USD BODY: Talks about millions of dollars-2.0 NA_DOLLARS BODY: Talks about a million North American dollars0.0 FREEMAIL_FROM Sender email is freemail (arnorld------joh4[at]att.net)-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, lowtrust[98.139.44.126 listed in list.dnswl.org]-2.0 SUBJ_ALL_CAPS Subject is all capitals2.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends indigit (arnorld------joh4[at]att.net)-2.0 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)0.0 HTML_MESSAGE BODY: HTML included in message0.0 LOTS_OF_MONEY Huge... sums of money3.5 FILL_THIS_FORM_LONG Fill in a form with personal information2.5 FREEMAIL_REPLY From and body contain different freemails0.0 FILL_THIS_FORM Fill in a form with personal information0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)0.0 T_TO_NO_BRKTS_FREEMAIL T_TO_NO_BRKTS_FREEMAIL0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money0.9 ADVANCE_FEE_3_NEW_FORM Advance Fee fraud and a form1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money0.8 ADVANCE_FEE_2_NEW_FORM Advance Fee fraud and a form0.0 MONEY_FORM Lots of money if you fill out a form0.5 MONEY_FRAUD_5 Lots of money and many fraud phrases1.0 MONEY_FRAUD_3 Lots of money and several fraud phrases0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)0.5 FORM_FRAUD_5 Fill a form and many fraud phrases0.5 FORM_FRAUD_3 Fill a form and several fraud phrases [x-spam-flag:] => YES )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.