Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => scamdex@scamdex.com [delivery-date:] => Mon, 25 Jun 2012 14:36:09 -0700 [received:] => Array ( [0] => from ch1ehsobe002.messaging.microsoft.com ([216.32.181.182]:32392 helo=ch1outboundpool.messaging.microsoft.com)by lester.newsblaze.com with esmtps (TLSv1:AES128-SHA:128)(Exim 4.77)(envelope-from )id 1SjGx5-0003ru-WCfor scamdex@scamdex.com; Mon, 25 Jun 2012 14:36:09 -0700 [1] => from mail5-ch1-R.bigfish.com (10.43.68.233) byCH1EHSOBE016.bigfish.com (10.43.70.66) with Microsoft SMTP Server id14.1.225.23; Mon, 25 Jun 2012 21:34:29 +0000 [2] => from mail5-ch1 (localhost [127.0.0.1]) by mail5-ch1-R.bigfish.com(Postfix) with ESMTP id C60561403FA for ; Mon, 25 Jun2012 21:34:28 +0000 (UTC) [3] => from mail5-ch1 (localhost.localdomain [127.0.0.1]) by mail5-ch1(MessageSwitch) id 1340660066276610_27977; Mon, 25 Jun 2012 21:34:26 +0000(UTC) [4] => from CH1EHSMHS030.bigfish.com (snatpool1.int.messaging.microsoft.com[10.43.68.253]) by mail5-ch1.bigfish.com (Postfix) with ESMTP id 3FF7E120241for ; Mon, 25 Jun 2012 21:34:26 +0000 (UTC) [5] => from smtp.bsu.edu (147.226.7.164) by CH1EHSMHS030.bigfish.com(10.43.70.30) with Microsoft SMTP Server id 14.1.225.23; Mon, 25 Jun 201221:34:25 +0000 [6] => from 212.138.84.28 ([212.138.84.58]) by smtp.bsu.edu over TLSsecured channel with Microsoft SMTPSVC(7.5.7601.17514); Mon, 25 Jun 201217:35:58 -0400 ) [x-forefront-antispam-report:] => CIP:147.226.7.164;KIP:(null);UIP:(null);IPV:NLI;H:smtp.bsu.edu;RD:smtp.bsu.edu;EFVD:NLI [x-spamscore:] => 28 [x-bigfish:] => VS28(z3cf7ozc89bhc857h77f5Izz1202hzz8275bhz30ih87h668h839hd25hd2bhe96hec2i9dfm) [received-spf:] => fail (mail5-ch1: domain of tsbbank.co.nz does not designate 147.226.7.164 as permitted sender) client-ip=147.226.7.164; envelope-from=noreply@tsbbank.co.nz; helo=smtp.bsu.edu ;smtp.bsu.edu ; [x-fb-domain-ip-match:] => fail [message-id:] => [from:] => TSB Bank [subject:] => New Enhanced Security Update [date:] => Tue, 26 Jun 2012 00:29:38 +0300 [mime-version:] => 1.0 [content-type:] => multipart/alternative;boundary="----=_NextPart_000_08DE_01CD5332.C55848E0" [x-priority:] => 3 [x-msmail-priority:] => Normal [x-mailer:] => Microsoft Windows Mail 6.0.6001.18000 [x-mimeole:] => Produced By Microsoft MimeOLE V6.0.6001.18000 [x-originalarrivaltime:] => 25 Jun 2012 21:35:59.0598 (UTC) FILETIME=[830488E0:01CD531A] [to:] => Undisclosed recipients:; [x-spam-status:] => No, score=3.4 [x-spam-score:] => 34 [x-spam-bar:] => +++ [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: TSB Bank Online Banking is carrying out a software upgrade for maximum user convenience. New Enhanced Security Update Kindly upgrade your account by clicking the link below . CLICK HERE TO UPGRADE [...] Content analysis details: (3.4 points, 4.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO 0.9 SPF_FAIL SPF: sender does not match SPF record (fail)[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=noreply%40tsbbank.co.nz;ip=216.32.181.182;r=lester.newsblaze.com] 0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist [URIs: sanelyurdu.com] 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.