Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => scams@scamdex.com [delivery-date:] => Sat, 30 Apr 2011 10:13:37 -0700 [received:] => Array ( [0] => from mail.une.net.co ([200.13.249.119] helo=une-pmta02.une.net.co)by chester.loopbiz.com with esmtp (Exim 4.69)(envelope-from )id 1QGDjc-0003An-Chfor scams@scamdex.com; Sat, 30 Apr 2011 10:13:36 -0700 [1] => from localhost (localhost.localdomain [127.0.0.1])by une-pmta02.une.net.co (Postfix) with ESMTP id 5540E2FFC90;Sat, 30 Apr 2011 12:13:38 -0500 (COT) [2] => from une-pmta02.une.net.co ([127.0.0.1])by localhost (une-pmta02.une.net.co [127.0.0.1]) (amavisd-new, port 10024)with ESMTP id TOB2ZO-xSTAZ; Sat, 30 Apr 2011 12:13:38 -0500 (COT) [3] => from [172.36.49.149] (unknown [41.203.64.254])by une-pmta02.une.net.co (Postfix) with ESMTPSA id 89F0A2FFC1C;Sat, 30 Apr 2011 12:12:14 -0500 (COT) ) [x-virus-scanned:] => amavisd-new at une-pmta02.une.net.co [content-type:] => text/plain; charset="iso-8859-1" [mime-version:] => 1.0 [content-transfer-encoding:] => quoted-printable [content-description:] => Mail message body [subject:] => Warm Regards [to:] => Recipients [from:] => "Mrs. Larisa Sosnitskaya" [date:] => Sat, 30 Apr 2011 10:11:35 -0700 [reply-to:] => mrslarisa@w.cn [x-antivirus:] => avast! (VPS 110430-0, 04/30/2011), Outbound message [x-antivirus-status:] => Clean [message-id:] => <20110430171215.89F0A2FFC1C@une-pmta02.une.net.co> [x-spam-status:] => No, score=0.3 [x-spam-score:] => 3 [x-spam-bar:] => / [x-ham-report:] => Spam detection software, running on the system "chester.loopbiz.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Dear friend, My name is Mrs. Larisa Sosnitskaya, personalsecretary of Mr. Boris Mikhail Khodorkovsky, the arrested Chairman/CEO ofYukos oil and Bank Menatep SPB in Russia. I have the sum forty-six millionto be transferred to you for business investment in your country. I shallprovide you with you with more details,when i recieve your reply. [...] Content analysis details: (0.3 points, 4.0 required)pts rule name description---- ---------------------- --------------------------------------------------0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server[41.203.64.254 listed in dnsbl.sorbs.net]-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, lowtrust[200.13.249.119 listed in list.dnswl.org]1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net[Blocked - see ]0.9 SPF_FAIL SPF: sender does not match SPF record (fail)[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=lan%40mail.co;ip=200.13.249.119;r=chester.loopbiz.com]-3.0 DEAR_FRIEND BODY: Dear Friend? That's not very dear!0.0 T_HK_NAME_MR_MRS T_HK_NAME_MR_MRS0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope0.0 FROM_MISSP_SPF_FAIL FROM_MISSP_SPF_FAIL0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPFfailed0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.