Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => cj@scamdex.com [delivery-date:] => Thu, 24 Mar 2011 17:14:09 -0700 [received:] => Array ( [0] => from f4mail-235-143.rediffmail.com ([202.137.235.143] helo=rediffmail.com)by chester.loopbiz.com with smtp (Exim 4.69)(envelope-from )id 1Q2ufH-0007Gj-P1for cj@scamdex.com; Thu, 24 Mar 2011 17:14:09 -0700 [1] => (qmail 15896 invoked by uid 510); 25 Mar 2011 00:13:28 -0000 [2] => from unknown 41.210.5.192 by rediffmail.com via HTTP; 25 Mar 2011 00:13:26 -0000 ) [comment:] => DomainKeys? See http://antispam.yahoo.com/domainkeys [domainkey-signature:] => a=rsa-sha1; q=dns; c=nofws; s=redf; d=rediffmail.com; b=LQlSfi/pqWyzfyH7Oafk5t+AG+8n+fbKjagI11I7pLZsiYGWHJaxaKSic3R23e9x9vB6DGW7FFgbdwioloQe+CVLjfNz47bV/CcFqKlI5MKxZwhmdl25YHsXmr12VSvDQTEUqqSpn1GNzyXn2UKWXCwMNMHRtRxmnUDx2IpaC38= ; [x-ctch-spam:] => Unknown [x-ctch-vod:] => Unknown [x-ctch-flags:] => : 0 [x-ctch-refid:] => str=0001.0A150203.4D8BDE39.0145,ss=1,pt=DBB_66867,fgs=0 [date:] => 25 Mar 2011 00:13:28 -0000 [message-id:] => <20110325001328.15887.qmail@f4mail-235-143.rediffmail.com> [mime-version:] => 1.0 [to:] => [subject:] => =?utf-8?B?RGVhciBNYWRhbS9TaXIu?= [from:] => "karlinated " [content-type:] => multipart/alternative;boundary="=_43b3563372b5aa38fe44fb0631e4cb59" [x-spam-status:] => No, score=2.0 [x-spam-score:] => 20 [x-spam-bar:] => ++ [x-ham-report:] => Spam detection software, running on the system "chester.loopbiz.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: I am Miss.KARLINA TEDJA PRAWIRA. from Indonesian,my late parentsMr & Mrs JA PRAWIRA. lost their lives in West Java disaster, Indonesia.Accordingto survival and other eye witnesses,The sad incident occurred in West Javaon September 2, 2009 at 14:55 Indonesia local time,killing at least 79 people,injuring over 1,250, and displacing over 210,000 (including more than 140,000in Tasikmalaya regency).I contact you for assistance to help me claim thisdeposit and invest it in your country.A total sum of $13,700,000.00(ThirteenMillion Seven Hundred Thousand) was secured in a Fiduciary vault companyby my late father.But the problem now is that the fiduciary gave a letterto evacuate the deposit through a beneficiary i will present as the deceasedonly child.My late father attorney is ready to assist us in this dealingswith all legal documents to back up this claim to you.Urgently reply me nowif you accept my offer to enable me give you further explanations to makeyou stand as my late father's next of kin or beneficiary to this deposit.Inreturning back your mail to me,do send me your your full information's toenable me know whom I am dealing with.Attach your Identity and send me acontact home address,Hand Mobile phone and any other useful information'sof you.I will also do the same so you have my complete biography.If you areinterested to handle this claim,Kindly detail me all about you to enablequick processing of this deposit to you.Reply e-mail:karlinatedjaprawira@linuxmail.org[...] Content analysis details: (2.0 points, 4.0 required)pts rule name description---- ---------------------- --------------------------------------------------0.3 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)[URIs: rediffmail.com]-3.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'-3.0 URG_BIZ BODY: Contains urgent matter0.0 HK_SCAM_N2 BODY: HK_SCAM_N20.0 FREEMAIL_FROM Sender email is freemail(karlinated2[at]rediffmail.com)-0.0 SPF_HELO_PASS SPF: HELO matches SPF record-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relaydomain-0.0 SPF_PASS SPF: sender matches SPF record2.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends indigit (karlinated2[at]rediffmail.com)0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, lowtrust[202.137.235.143 listed in list.dnswl.org]-2.0 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)0.0 HTML_MESSAGE BODY: HTML included in message0.0 LOTS_OF_MONEY Huge... sums of money0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay0.0 DECEASED_NO_ML Dead not via mailing list2.5 FREEMAIL_REPLY From and body contain different freemails1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money1.0 MONEY_FRAUD_3 Lots of money and several fraud phrases0.5 FORM_FRAUD_3 Fill a form and several fraud phrases [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.