Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => rbrito@scamdex.com [delivery-date:] => Mon, 22 Apr 2013 09:18:26 -0700 [received:] => Array ( [0] => from [38.103.105.91] (port=10690 helo=Aeonfinancial.net)by lester.newsblaze.com with esmtp (Exim 4.80)(envelope-from )id 1UUJR3-0000wk-H7for rbrito@scamdex.com; Mon, 22 Apr 2013 09:18:26 -0700 [1] => from 38.103.105.91(helo=rcfntxdznnhj.maighoqq.com)by Aeonfinancial.net with esmtpa (Exim 4.69)(envelope-from )id 1MMHSE-7398nl-OVfor rbrito@scamdex.com; Mon, 22 Apr 2013 11:17:44 -0500 ) [date:] => Mon, 22 Apr 2013 11:17:44 -0500 [from:] => "Bill Me Later" [x-mailer:] => The Bat! (v2.01) Educational [x-priority:] => 3 (Normal) [message-id:] => <9089138682.1QY1K44K119947@otujb.qxvyb.biz> [to:] => [mime-version:] => 1.0 [content-type:] => multipart/mixed; boundary="----------C8E9B14BA5CF1E" [x-spam-status:] => Yes, score=4.0 [x-spam-score:] => 40 [x-spam-bar:] => ++++ [x-spam-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seeroot\@localhost for details.Content preview: Log in here Dear Customer, Thank you for making a payment online! We've received your Bill Me Later® payment of $1570.65 and have applied it to your account. For more details please check attached file Summary: Your Bill Me Later Account Number Ending in: 0910 You Paid: $1570.65 Your Payment Date*: 04/03/2013 Your Payment Confirmation Number: 802123383251134606 Don't forget, Bill Me Later is the perfect way to shop when you want more time to pay for the stuff you need. Plus, you can always find great deals and discounts at over 1000 stores. Watch this short, fun video to learn more. *NOTE: If your payment date is Saturday, or a holiday, it will take an additional day for the payment to appear on your account. However, you will be credited for the payment as of the payment date. [...] Content analysis details: (4.0 points, 4.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: billmelater.com] 1.8 DKIM_ADSP_DISCARD No valid author signature, domain signs all mail and suggests discarding the rest 0.9 SPF_FAIL SPF: sender does not match SPF record (fail)[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=service%40fiserv.com;ip=38.103.105.91;r=lester.newsblaze.com] 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 LOTS_OF_MONEY Huge... sums of money 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 T_REMOTE_IMAGE Message contains an external image [x-spam-flag:] => YES [subject:] => ***SPAM*** Thank you for scheduling a payment to Bill Me Later )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.