Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => cj@scamdex.com [delivery-date:] => Tue, 04 Oct 2011 08:06:48 -0700 [received:] => Array ( [0] => from mail.tochka.net ([91.207.122.195] helo=dvmail.tochka.net)by lester.newsblaze.com with esmtp (Exim 4.69)(envelope-from )id 1RB6Zy-0004mW-6sfor cj@scamdex.com; Tue, 04 Oct 2011 08:06:48 -0700 [1] => from mail.tochka.net (dvmailimap [91.207.122.195])by dvmail.tochka.net (Postfix) with ESMTP id 23CD88F05C7;Tue, 4 Oct 2011 18:05:53 +0300 (EEST) ) [mime-version:] => 1.0 [content-type:] => multipart/alternative;boundary="=_2a7cff10b505beb126181823f7f7c757" [date:] => Tue, 04 Oct 2011 18:05:53 +0300 [from:] => senatorjamesdavid@tochka.net [to:] => , , ,, , ,, , ,, , ,, ,, ,, , ,, , ,, ,, ,, , ,, , ,, ,, ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, ,, , ,, , ,, , ,, , ,, ,, , ,, ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, , ,, ,, , ,, , ,, , ,, ,, , ,, , ,, , ,, , ,, , ,, ,, , ,, ,, ,, ,, ,, ,, , ,, ,, , ,, ,, ,, , ,, , ,, , ,, ,, ,, , ,, , [subject:] => PROPERTY ACQUISITION AND INVESTMENT [message-id:] => [x-sender:] => senatorjamesdavid@tochka.net [user-agent:] => RoundCube Webmail/0.5.1 [x-spam-status:] => No, score=3.5 [x-spam-score:] => 35 [x-spam-bar:] => +++ [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: DEAR FRIEND, MY NAME SENATOR DAVID JAMES, I WAS A ONE TIMESENATOR IN NIGERIA. I HAVE A REQUEST TO MAKE, I NEED TO PURCHASE A PROPERTYIN YOUR COUNTRY AND ALSO I WANT TO RELOCATE MY FAMILY TO OUTSIDE THE SHORESOF NIGERIA FOR PERMANENT RESIDENCE. I HAVE OVER $265 MILLION DOLLARS TO INVESTIN YOUR COUNTRY. I HAVE THIS MONEY IN A FINANCE COMPANY IN AMSTERDAM HOLLAND.I NEED YOUR ASSISTANCE TO MOVE THIS MONEY OUT OF HOLLAND IN YOUR NAME, BUYA PROPERTY OUTSIDE NIGERIA AND RELOCATE MY FAMILY. [...] Content analysis details: (3.5 points, 4.0 required)pts rule name description---- ---------------------- ---------------------------------------------------3.0 BILLION_DOLLARS BODY: Talks about lots of money3.3 SINGLE_HEADER_4K A single header contains 4K-5K characters2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL[91.207.122.195 listed in psbl.surriel.com]1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT[91.207.122.195 listed in bb.barracudacentral.org]-2.0 SUBJ_ALL_CAPS Subject is all capitals-0.0 SPF_PASS SPF: sender matches SPF record-0.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain2.5 SORTED_RECIPS Recipient list is sorted by address-3.0 DEAR_FRIEND BODY: Dear Friend? That's not very dear!0.0 HTML_MESSAGE BODY: HTML included in message0.0 LOTS_OF_MONEY Huge... sums of money-1.0 UPPERCASE_75_100 message body is 75-100% uppercase0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)0.1 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)0.8 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money1.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money0.4 MONEY_FRAUD_5 Lots of money and many fraud phrases0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information0.5 FORM_FRAUD_5 Fill a form and many fraud phrases [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.