Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => phpbbs@o7e.net [delivery-date:] => Sat, 24 Jul 2010 17:40:55 -0700 [received:] => Array ( [0] => from ofilter.cord.edu ([138.129.254.32])by chester.loopbiz.com with esmtp (Exim 4.69)(envelope-from )id 1OcpGw-0005Sf-TNfor phpbbs@o7e.net; Sat, 24 Jul 2010 17:40:55 -0700 [1] => from exchange.cord.edu (cordedge02.cord.edu [138.129.18.205])by ofilter.cord.edu (Spam & Virus Firewall) with ESMTPid C53B52B3450; Sat, 24 Jul 2010 19:21:03 -0500 (CDT) [2] => from exchange.cord.edu (cordedge02.cord.edu [138.129.18.205]) by ofilter.cord.edu with ESMTP id T5Te7mPhu6scQzNd; Sat, 24 Jul 2010 19:21:03 -0500 (CDT) [3] => from cordexch01.cord.local (138.129.18.200) by cordedge02.cord.edu(138.129.18.205) with Microsoft SMTP Server (TLS) id 8.2.254.0; Sat, 24 Jul2010 19:21:04 -0500 [4] => from CORDMAIL.cord.local ([138.129.18.203]) by cordexch01.cord.local([138.129.18.200]) with mapi; Sat, 24 Jul 2010 19:21:03 -0500 ) [x-asg-debug-id:] => 1280017263-6c1a000d0000-u9kNKi [x-barracuda-url:] => http://138.129.254.32:8000/cgi-bin/mark.cgi [from:] => Christopher Hendricks [date:] => Sat, 24 Jul 2010 19:21:02 -0500 [x-asg-orig-subj:] => Executor of the estate of Late Mr. Christopher Friedrich [ReplyTo:brownejacobson111@yahoo.com.hk] [subject:] => Executor of the estate of Late Mr. Christopher Friedrich [ReplyTo:brownejacobson111@yahoo.com.hk] [thread-topic:] => Executor of the estate of Late Mr. Christopher Friedrich[Reply To:brownejacobson111@yahoo.com.hk] [thread-index:] => AQHLK49DWaLFCJtG0kam5p3BUcbvqw== [message-id:] => <31ADFC4D34B5474F8547580665C04F7C01D9AFA53DE2@CORDMAIL.cord.local> [accept-language:] => en-US [content-language:] => en-US [x-ms-has-attach:] => [x-ms-tnef-correlator:] => [acceptlanguage:] => en-US [content-type:] => multipart/alternative;boundary="_000_31ADFC4D34B5474F8547580665C04F7C01D9AFA53DE2CORDMAILcor_" [mime-version:] => 1.0 [to:] => Undisclosed recipients:; [x-barracuda-connect:] => cordedge02.cord.edu[138.129.18.205] [x-barracuda-start-time:] => 1280017263 [x-barracuda-virus-scanned:] => by Barracuda Spam & Virus Firewall at cord.edu [x-barracuda-spam-score:] => 1.50 [x-barracuda-spam-status:] => No, SCORE=1.50 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=8.0 tests=ADVANCE_FEE_1, BSF_SC0_SA083, HTML_MESSAGE, MAILTO_TO_SPAM_ADDR [x-barracuda-spam-report:] => Code version 3.2, rules version 3.2.2.36002Rule breakdown below pts rule name description---- ---------------------- --------------------------------------------------0.00 MAILTO_TO_SPAM_ADDR URI: Includes a link to a likely spammer email0.00 HTML_MESSAGE BODY: HTML included in message0.00 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419)1.50 BSF_SC0_SA083 Custom Rule SA083 [x-spam-status:] => No, score=0.0 [x-spam-score:] => 0 [x-spam-bar:] => / [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.