Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => submitted@scamdex.com [delivery-date:] => Mon, 30 May 2011 16:26:19 -0700 [received:] => Array ( [0] => from imta-35.everyone.net ([216.200.145.35] helo=imta-38.everyone.net)by chester.loopbiz.com with esmtps (TLSv1:AES256-SHA:256)(Exim 4.69)(envelope-from )id 1QRBqj-000830-KDfor submitted@scamdex.com; Mon, 30 May 2011 16:26:19 -0700 [1] => from pps.filterd (omta001 [127.0.0.1])by imta-38.everyone.net (8.14.4/8.14.4) with SMTP id p4UNO3vw022106;Mon, 30 May 2011 16:25:24 -0700 [2] => from mo5.mail.sc.edu (129.252.158.29 [129.252.158.29])by dm0211.mta.everyone.net (EON-INBOUND) with ESMTP id dm0211.4de07c26.6891c9for ; Mon, 30 May 2011 16:25:23 -0700 [3] => from mo5.mail.sc.edu (127.0.0.1) id hsgjm60171s5 for ; Mon, 30 May 2011 19:25:22 -0400 (envelope-from ) [4] => from CAE145HUBP01.ds.sc.edu ([172.27.7.168])by mo5.mail.sc.edu (SonicWALL 7.3.1.4735)with ESMTP (AIO); Mon, 30 May 2011 19:25:22 -0400 [5] => from cae145erlp02.ds.sc.edu (172.27.7.167) by CAE145HUBP01.ds.sc.edu(172.27.7.168) with Microsoft SMTP Server id 14.1.289.1; Mon, 30 May 201119:25:04 -0400 [6] => from CAE145EVSP04.ds.sc.edu ([172.27.7.18]) bycae145erlp02.ds.sc.edu with Microsoft SMTPSVC(6.0.3790.4675); Mon, 30 May2011 19:25:20 -0400 ) [x-eon-delivered-to:] => [x-eon-dm:] => dm0211 [x-mimeole:] => Produced By Microsoft Exchange V6.5 [content-class:] => urn:content-classes:message [mime-version:] => 1.0 [content-type:] => multipart/alternative;boundary="----_=_NextPart_001_01CC1F20.D6676DA6" [subject:] => Your verification number is: (EM-389-6373,FGN/P-073-92). [date:] => Mon, 30 May 2011 19:25:18 -0400 [message-id:] => <73B6F98A61BF1A4EB12C394F2FB7349645E4E9@CAE145EVSP04.ds.sc.edu> [x-ms-has-attach:] => [x-ms-tnef-correlator:] => [thread-topic:] => Your verification number is: (EM-389-6373,FGN/P-073-92). [thread-index:] => AcwfINXaarwWYEs7Q1SARYaR1rMrWw== [from:] => "WHITE-HURST, ELIZABETH" [x-originalarrivaltime:] => 30 May 2011 23:25:20.0453 (UTC) FILETIME=[D7A98F50:01CC1F20] [x-mlf-version:] => 7.3.1.4735 [x-mlf-uniqueid:] => o201105302325220210532 [to:] => undisclosed-recipients: ; [x-proofpoint-spam-details:] => rule=probablespam policy=default score=78 spamscore=78 ipscore=0suspectscore=6 phishscore=10 bulkscore=0 adultscore=0 classifier=spamadjust=0 reason=mlx scancount=1 engine=6.0.2-1012030000definitions=main-1105300164 [x-spam-subject:] => ***SPAM*** Your verification number is: (EM-389-6373,FGN/P-073-92). [x-spam-status:] => Yes, score=4.5 [x-spam-score:] => 45 [x-spam-bar:] => ++++ [x-spam-report:] => Spam detection software, running on the system "chester.loopbiz.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: You have been awarded the sum of 850,000.00 USD. in the ExxonMobil Oil And Gas Award 2011. Cont Mr. Fred Ifah with your Name ,Tel no,Country, Sex, Age to Email: exxonoilgas@hotmail.sg or call: (+234) 807 7083 354 for more information on this award. [...] Content analysis details: (4.5 points, 4.0 required)pts rule name description---- ---------------------- --------------------------------------------------1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)0.0 HTML_MESSAGE BODY: HTML included in message0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars0.0 LOTS_OF_MONEY Huge... sums of money3.5 FILL_THIS_FORM_LONG Fill in a form with personal information0.0 FILL_THIS_FORM Fill in a form with personal information0.0 MONEY_FORM Lots of money if you fill out a form [x-spam-flag:] => YES )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.