Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => Submissions@scamdex.com [delivery-date:] => Tue, 08 Mar 2011 19:34:40 -0800 [received:] => Array ( [0] => from web84102.mail.mud.yahoo.com ([68.142.206.189])by chester.loopbiz.com with smtp (Exim 4.69)(envelope-from )id 1PxAAa-00032T-3Jfor Submissions@scamdex.com; Tue, 08 Mar 2011 19:34:40 -0800 [1] => (qmail 6599 invoked by uid 60001); 9 Mar 2011 03:34:39 -0000 [2] => from [180.215.208.88] by web84102.mail.mud.yahoo.com via HTTP; Tue, 08 Mar 2011 19:34:39 PST ) [dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1299641679; bh=33cZ+oPJG6fAwnmrwvRlxn1Z+bprLTLz+/4UmwTbPSQ=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:To:MIME-Version:Content-Type; b=pXjHL7Fx3lxMsyEWY7DnAl/3YPn2tQuX6XRxzMo8bYaJ2HvKNeh/MPM//Jpm0kkJvQmjZH4m1ViYxnUZpPLDebC67evDUL/OP+XLGcMC3w+xuYN5zh6j1vGL/E1DijR/vBa2kKVOyUpffUfUkw/8OzL0V+mbn7wKtnFMo6wkxic= [message-id:] => <931234.94051.qm@web84102.mail.mud.yahoo.com> [x-ymail-osg:] => lUoMgxUVM1mzgQEeeii062XOO8P3ywCpYyFfyMcPbRT9wGAhCqxBvuJnBK.KVix2QjKd9ppoZvJltQIBwv2yPUmK0EtOHo8BJTn_PIFxmC8L7tBhmyiBKGOu.OpVdYXWonR0zRhe68jxNCJSAo4_xp.RC_BN821uQtf9Yp9mJCo8XnUait2DDDPJ4.iaVawzlTrinJUVhY4rVl9N.t3yaq9euHGfio9y_iE6giW8D7FfkcojCrSW5ilyO_JcluO9ITjcyO9w7GFRpckvuzhYk_nu7aFwNjZ.VBLPBsxcLIqmCUL_BUvo.UrXCJ23uAr2KpRbh6jjVPP7GEwmz2OLnmqmhJfF6mstZ1MO6d2_CjpIwDler8_xXcuoAVjb7GUmwkFezezCcK_cPfLPY5E6EdKplp3FCdBi.amNLe.7LGoAB2Ktg4VgfOkQ1jAfUcYTbuQwFhvoVMQA8fwAm22ecQZZmOTbGOr.NcGhvAbOapmmhoIx2Gw5uzRrQda4bEjyCygCZck7pUY_JHjyiy.yttbUaZDC_yWOxagEoIps0REY4ejgwgRFUAwUOiXg8g6gwa.y6r5mINNcCyNsSvz1.aKYTT3TDB6eS.eRoFvUu6B.DbBQLKHwrg-- [x-mailer:] => YahooMailClassic/11.4.20 YahooMailWebService/0.8.109.292656 [date:] => Tue, 8 Mar 2011 19:34:39 -0800 (PST) [from:] => JAMES MATTINS [reply-to:] => james_mattins@myself.com [to:] => undisclosed recipients: ; [mime-version:] => 1.0 [content-type:] => multipart/alternative; boundary="0-961875308-1299641679=:94051" [x-spam-status:] => No, score=-0.7 [x-spam-score:] => -6 [x-spam-bar:] => / [x-ham-report:] => Spam detection software, running on the system "chester.loopbiz.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Dearsir/madam, james_mattins@myself.com To whomit may concern,I kindly want to put in notice before you, my name is Mr. JAMESMATTINS acitizen of South Africa, I am in Mumbai-India presently seeking for areliableand trust worthy fellow to assist me of my late father money, which Itransferredfrom BANK OF ENGLAND to the RESERVE BANK OF INDIAN, ForeignRemittent BankingDepartment here in India, for aninvestment purpose. The saidamount is threepoint two million usd ($3.2 million) I have done a reasonableresearch andfind out that is not easy for foreigner to have an account forsuch a hugeamount, so i want you as a citizen of India to assist me bytransferring thisfunds into your nominated bank account, and ten percent willbe offer to youfor the work well done. Please,if you are interested do contact me by sendingyour Full name Fulladdress Cellnumber Accountdetails Scan copyof pan cardor any other identity proof. So that Ican forward them to the Foreign remittentbanking department of the RESERVEBANK OF INDIAN, so that they can contactyou as soon as possible, Forproper verification here are the contact numbers.Thanks for co. operation. Mypersonal number: +919619495231 james_mattins@myself.comRegards JAMESMATTINS [...] Content analysis details: (-0.7 points, 4.0 required)pts rule name description---- ---------------------- ---------------------------------------------------3.0 MILLION_USD BODY: Talks about millions of dollars-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, lowtrust[68.142.206.189 listed in list.dnswl.org]-0.0 SPF_PASS SPF: sender matches SPF record0.0 HTML_EXTRA_CLOSE BODY: HTML contains far too many close tags0.0 HTML_MESSAGE BODY: HTML included in message1.8 MISSING_SUBJECT Missing Subject: header0.0 LOTS_OF_MONEY Huge... sums of money0.0 RFC_ABUSE_POST Both abuse and postmaster missing on sender domain0.0 DECEASED_NO_ML Dead not via mailing list0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.