Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => scams@scamdex.com [delivery-date:] => Mon, 25 Jun 2012 14:32:18 -0700 [received:] => Array ( [0] => from smtp-out02.msg.oleane.net ([62.161.3.11]:55036)by lester.newsblaze.com with esmtp (Exim 4.77)(envelope-from )id 1SjGtN-0002Sc-3tfor scams@scamdex.com; Mon, 25 Jun 2012 14:32:18 -0700 [1] => from smtp07.msg.oleane.net (smtp07.mail.priv [172.17.20.116]) by smtp-out02.msg.oleane.net with ESMTP id q5PLVtIW001849;Mon, 25 Jun 2012 23:31:55 +0200 [2] => from smtp07.msg.oleane.net (localhost [127.0.0.1]) by smtp07.msg.oleane.net (MTA-AV) with ESMTP id q5PLVqad010484;Mon, 25 Jun 2012 23:31:52 +0200 [3] => from gaserveur ([217.108.141.49]) (authenticated)by smtp07.msg.oleane.net (MSA) with ESMTP id q5PLVnXC010452;Mon, 25 Jun 2012 23:31:50 +0200 [4] => from User (unknown [41.203.64.132])by gaserveur (Postfix) with ESMTP id C19EE6558068;Mon, 25 Jun 2012 23:36:30 +0200 (CEST) ) [x-oleane-rep:] => REPA [reply-to:] => [from:] => "WORLD BANK" [subject:] => PLEASE CONFIRM/FROM 2012 WORLD BANK GRANT [date:] => Mon, 25 Jun 2012 22:32:16 +0800 [mime-version:] => 1.0 [content-type:] => text/html;charset="Windows-1251" [content-transfer-encoding:] => 7bit [x-priority:] => 3 [x-msmail-priority:] => Normal [x-mailer:] => Microsoft Outlook Express 6.00.2600.0000 [x-mimeole:] => Produced By Microsoft MimeOLE V6.00.2600.0000 [message-id:] => <20120625213630.C19EE6558068@gaserveur> [to:] => undisclosed-recipients:; [x-spam-flag:] => Array ( [0] => YES [1] => YES ) [x-pmx-spam:] => Probability=100% [x-spam-level:] => XXXXXXXXXX [x-pfsi-info:] => PMX 5.5.9.395186, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.6.25.211817 (no virus found) [x-orange-auth:] => c210cC5nYXhpZXVzZXZlcmFjQGNhYmRldHIxLmZyLmZ0bw== [x-spam-subject:] => ***SPAM*** PLEASE CONFIRM/FROM 2012 WORLD BANK GRANT [x-spam-status:] => Yes, score=4.8 [x-spam-score:] => 48 [x-spam-bar:] => ++++ [x-spam-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: ATTENTION SIR/MADAM World Bank has continued for the year 2012 WITH BUDGET OF USD200,000,000,000, [...] Content analysis details: (4.8 points, 4.0 required) pts rule name description---- ---------------------- ---------------------------------------------------3.0 BILLION_DOLLARS BODY: Talks about lots of money-3.0 MILLION_USD BODY: Talks about millions of dollars 0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam 0.0 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam 0.4 NSL_RCVD_FROM_USER Received from User 0.0 FSL_RCVD_USER FSL_RCVD_USER 0.6 HK_RANDOM_ENVFROM Envelope sender username looks random 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (worldbk_funds[at]w.cn) 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [62.161.3.11 listed in dnsbl.sorbs.net] 1.1 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date-2.0 SUBJ_ALL_CAPS Subject is all capitals-2.0 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 FSL_UA FSL_UA 0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool 0.0 FSL_NEW_HELO_USER FSL_NEW_HELO_USER 0.9 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2 3.4 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only 0.1 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed 0.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to 0.0 FROM_MISSP_USER From misspaced, from "User" 0.0 FROM_MISSPACED From: missing whitespace 0.0 MONEY_FROM_MISSP Lots of money and misspaced From 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To 0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope 0.0 FROM_MISSP_URI From misspaced, has URI 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook 0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information 1.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money 0.8 MONEY_FORM_SHORT Lots of money if you fill out a short form )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.