Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [delivered-to:] => scamdex@gmail.com [received:] => Array ( [0] => by 10.224.58.132 with SMTP id g4csp4040qah; Sat, 27 Apr 2013 08:16:49 -0700 (PDT) [1] => from alfa.infoexpress.pl (alfa.infoexpress.pl. [213.25.185.5]) by mx.google.com with ESMTPS id h44si14373351eev.93.2013.04.27.08.16.48 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Sat, 27 Apr 2013 08:16:49 -0700 (PDT) [2] => from [198.50.161.210] (helo=User)by alfa.infoexpress.pl with esmtpa (Exim 4.71)(envelope-from )id 1UW6nT-0005fT-2w; Sat, 27 Apr 2013 17:12:27 +0200 ) [x-received:] => by 10.14.3.137 with SMTP id 9mr13162200eeh.0.1367075809255; Sat, 27 Apr 2013 08:16:49 -0700 (PDT) [return-path:] => [received-spf:] => neutral (google.com: 213.25.185.5 is neither permitted nor denied by best guess record for domain of judith02@aaanet.ru) client-ip=213.25.185.5; [authentication-results:] => mx.google.com; spf=neutral (google.com: 213.25.185.5 is neither permitted nor denied by best guess record for domain of judith02@aaanet.ru) smtp.mail=judith02@aaanet.ru [message-id:] => [reply-to:] => [from:] => "FRB DIPLOMATIC DELIVERY" [subject:] => DELIVERY [date:] => Sat, 27 Apr 2013 16:08:21 -0700 [mime-version:] => 1.0 [content-type:] => text/plain;charset="Windows-1251" [content-transfer-encoding:] => 7bit [x-priority:] => 3 [x-msmail-priority:] => Normal [x-mailer:] => Microsoft Outlook Express 6.00.2600.0000 [x-mimeole:] => Produced By Microsoft MimeOLE V6.00.2600.0000 [x-spam_score:] => 39.5 [x-spam_score_int:] => 395 [x-spam_bar:] => +++++++++++++++++++++++++++++++++++++++ [x-spam_report:] => Spam detection software, running on the system "alfa.infoexpress.pl", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: ATTN: BENEFICIARY, THE DIPLOMAT JUST ARRIVED BRISBANE,QUEENSLAND WITH YOUR CONSIGNMENT WORTH $1.500,000 MILLION USD, GO NOW AND SEND $140 VIA WESTERN UNION MONEY TRANSFER AND GET BACK TO ME WITH THE INFORMATION'S OF THE PAYMENT, THE DIPLOMAT IS NOW IN [...] Content analysis details: (39.5 points, 5.0 required) pts rule name description---- ---------------------- ---------------------------------------------------1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% [score: 1.0000] 0.7 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam 1.1 NSL_RCVD_HELO_USER Received from HELO User 1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date 1.0 MISSING_HEADERS Missing To: header 3.2 MILLION_USD BODY: Talks about millions of dollars 3.2 DEAR_BENEFICIARY BODY: Dear Beneficiary: 1.8 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 UPPERCASE_75_100 message body is 75-100% uppercase 1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 4.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool 3.8 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2 2.6 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE 2.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to 3.7 MONEY_FROM_MISSP Lots of money and misspaced From 2.1 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors 2.0 FROM_MISSPACED From: missing whitespace 0.4 FROM_MISSP_EH_MATCH From misspaced, matches envelope 1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.