Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => submitted@scamdex.com,submissions@scamdex.com [delivery-date:] => Tue, 26 Nov 2013 16:56:16 -0800 [received:] => Array ( [0] => from ns.fsid.cvut.cz ([147.32.160.4]:60394)by lester.newsblaze.com with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)(Exim 4.80.1)(envelope-from )id 1VlTQM-0002D5-Tc; Tue, 26 Nov 2013 16:56:16 -0800 [1] => from localhost (localhost [127.0.0.1])by ns.fsid.cvut.cz (Postfix) with ESMTP id F3B271C6E4B;Wed, 27 Nov 2013 01:56:13 +0100 (CET) [2] => from ns.fsid.cvut.cz ([127.0.0.1])by localhost (ns.fsid.cvut.cz [127.0.0.1]) (amavisd-new, port 10024)with ESMTP id HKq4VmbbIMue; Wed, 27 Nov 2013 01:56:11 +0100 (CET) [3] => from [10.254.112.59] (unknown [204.93.59.60])(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))(No client certificate requested)by ns.fsid.cvut.cz (Postfix) with ESMTPSA id 8F95C1C6E53;Wed, 27 Nov 2013 01:55:51 +0100 (CET) ) [x-virus-scanned:] => Debian amavisd-new at ns.fsid.cvut.cz [x-spam-flag:] => Array ( [0] => YES [1] => NO ) [x-spam-score:] => Array ( [0] => 7.064 [1] => -6 ) [x-spam-level:] => ******* [x-spam-status:] => Array ( [0] => Yes, score=7.064 tagged_above=-999 required=6.31tests=[ALL_TRUSTED=-1, BAYES_50=0.8, FREEMAIL_FROM=0.001,FREEMAIL_REPLYTO=2.398, FS_ORG_GRANT=-0.5, HTML_MESSAGE=0.001,LOTS_OF_MONEY=0.001, NA_DOLLARS=3.599, T_FILL_THIS_FORM_SHORT=0.01,US_DOLLARS_3=1.754] autolearn=no [1] => No, score=-0.7 ) [content-type:] => multipart/alternative; boundary="===============1585901945==" [mime-version:] => 1.0 [subject:] => {Spam?}Best Wishes [to:] => Recipients [from:] => Mark & Cindy Hill [date:] => Wed, 27 Nov 2013 02:55:29 +0200 [reply-to:] => markcindy.hill@gmx.us [message-id:] => <20131127005551.8F95C1C6E53@ns.fsid.cvut.cz> [x-spam-bar:] => / [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seeroot\@localhost for details.Content preview: My name is Mark Hill and my wife 19s name is Cindy. On November 28, 2012 my wife and I won the largest Missouri Powerball Jackpot of $293.7 Million US Dollars. We were in shock after discovering we held one of the two tickets that matched all six numbers drawn to win the jackpot considering the fact that my wife was laid off her job in June 2010 due to the loss of a grant. After winning this Jackpot, we 19ve discussed as a family and decided to set up the HILL FOUNDATION to voluntarily support the less privileged wherever they may be. You are among the 3 Genuine Beneficiaries that was selected by our online Charity Outreach by email to receive the sum of $1,350,000.00 USD as part of our annual donation. On receipt of this email kindly get back to us immediately with the correct details required below so that we can forward it to the pay-out bank for your funds transfer. 1. Full Name: ------ 2. Age/Sex: ------ 3. Telephone: ------ 4. Home address/Country: ------ 5. Occupation: ------ Please visit the official Powerball website to confirm our winning: http://www.powerball.com/powerball/winners/2012/112812MO_Hill.shtml [...] Content analysis details: (-0.7 points, 4.0 required) pts rule name description---- ---------------------- ---------------------------------------------------2.0 NA_DOLLARS BODY: Talks about a million North American dollars 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (markcindy_hill[at]mail.com) 0.9 SPF_FAIL SPF: sender does not match SPF record (fail)[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=markcindy_hill%40mail.com;ip=147.32.160.4;r=lester.newsblaze.com] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: powerball.com]-2.0 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 LOTS_OF_MONEY Huge... sums of money 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF failed 0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information 1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.