Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => scams@scamdex.com [delivery-date:] => Thu, 27 Sep 2012 06:53:35 -0700 [received:] => Array ( [0] => from mail.creditrights.net ([206.71.87.21]:36819)by lester.newsblaze.com with esmtps (TLSv1:AES256-SHA:256)(Exim 4.77)(envelope-from )id 1THEX0-0004H8-Nhfor scams@scamdex.com; Thu, 27 Sep 2012 06:53:35 -0700 [1] => from cleanspam.dohwa.co.kr (cleanspam.dohwa.co.kr [210.122.146.203])by mail.creditrights.net (Postfix) with ESMTPA id EFD5081327BFfor ; Thu, 27 Sep 2012 07:53:31 -0600 (MDT) ) [from:] => "PayPal" [subject:] => You have changed your PayPal email address [mime-version:] => 1.0 [content-type:] => text/html [message-id:] => <20120927135332.EFD5081327BF@mail.creditrights.net> [date:] => Thu, 27 Sep 2012 07:53:31 -0600 (MDT) [to:] => undisclosed-recipients:; [x-spam-subject:] => ***SPAM*** You have changed your PayPal email address [x-spam-status:] => Yes, score=4.2 [x-spam-score:] => 42 [x-spam-bar:] => ++++ [x-spam-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Dear PayPal Customer, You have added les.everitt@btinternet.com as a new email address for your Paypal account. If you did not authorize this change, check with family members and others who may have access to your account first. If you still feel that an unauthorized person has changed your email, click on restore account PayPal and follow the next steps. [...] Content analysis details: (4.2 points, 4.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist [URIs: 61.253.249.157] 0.0 NORMAL_HTTP_TO_IP URI: Uses a dotted-decimal IP address in URL 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 2.4 TVD_PH_BODY_META TVD_PH_BODY_META 0.0 T_REMOTE_IMAGE Message contains an external image [x-spam-flag:] => YES )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.