Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => Scams@scamdex.com [delivery-date:] => Thu, 08 Dec 2011 10:01:15 -0800 [received:] => Array ( [0] => from quasar.dnsprotect.com ([63.247.69.242])by lester.newsblaze.com with esmtps (TLSv1:AES256-SHA:256)(Exim 4.69)(envelope-from )id 1RYiHS-0007cq-Qifor Scams@scamdex.com; Thu, 08 Dec 2011 10:01:15 -0800 [1] => from localhost ([127.0.0.1] helo=[63.247.69.242])by quasar.dnsprotect.com with esmtpa (Exim 4.69)(envelope-from )id 1RYhte-0004Lf-IX; Thu, 08 Dec 2011 12:36:38 -0500 [2] => from 82.128.44.217 ([82.128.44.217]) (SquirrelMail authenticated user gdb77@millsmind.com) by 63.247.69.242 with HTTP; Thu, 8 Dec 2011 20:36:38 +0300 ) [message-id:] => <1f1f34f0c580ec42991a46fe7693d37c.squirrel@63.247.69.242> [date:] => Thu, 8 Dec 2011 20:36:38 +0300 [subject:] => RE:Hajia Turai Yar'Adua CFR.URGENT [from:] => "Hajia Turai Yar'Adua CFR" [reply-to:] => hajaituraiyaradua1954@yahoo.com.hk [user-agent:] => SquirrelMail/1.4.22 [mime-version:] => 1.0 [content-type:] => text/plain;charset=iso-8859-1 [content-transfer-encoding:] => 8bit [x-priority:] => 3 (Normal) [importance:] => Normal [return-receipt-to:] => turaiyaradua2003@gmail.com [x-antiabuse:] => Array ( [0] => This header was added to track abuse, please include it with any abuse report [1] => Primary Hostname - quasar.dnsprotect.com [2] => Original Domain - scamdex.com [3] => Originator/Caller UID/GID - [47 12] / [47 12] [4] => Sender Address Domain - gmail.com ) [x-spam-status:] => No, score=1.9 [x-spam-score:] => 19 [x-spam-bar:] => + [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Dear Friend, Compliment of the season to you and your family.My names are Mrs Turai Umaru Yar'Adua wife of former Nigeria president andfor former first lady federal republic of Nigeria. I am contacting you becauseI Want you to help me to receive some funds in Europe which I was able tomove to a security company before the death of my husband Former presidentUmaru Yar Adua whom died on the 6th May 2010 after suffering from a longtime acute heart condition in a hospital in Jeddah, Saudi Arabia, and he alsosuffered from a chronic kidney problem before he died and since the deathof my husband last year is deputy was sworn-in and since then there as beenvarious probe of my husband former aids and minister then in government andmy family also,and before the death of my husband as I was advised then thatI should move some funds to a reliable place were it cant be traced becausethen my late husband condition was getting very critical so it was then thatI was able to lodged the sum of $18.8million with a security company confidentially.You see,why I decided to contact you is for you to help me to receive thisfunds in your country after every RELEVANT clearance of the funds as beenmade possible so that you can help me to receive the funds in your countrythrough bank to bank wire transfer or through diplomatic courier service.You should let me know your position in this transaction if you can helpme out so that I can let you know the next position of how you are to helpme to receive these funds in your country and for me to also let you knowmore because am willing to offer you 25% of the total funds for your helpand support because I would also want to invest the funds into the real Sectorin your country and any other good investment in your country according toyour advice. I wait to hear from you urgently or you can call me throughthis my private phone numbers for this transaction only +234 8087 439 421.Sincerely, Hajia Turai Yar'Adua CFR. FORMER FIRST LADY FEDERAL REPUBLIC OFNIGERIA [...] Content analysis details: (1.9 points, 4.0 required)pts rule name description---- ---------------------- ---------------------------------------------------5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at http://www.dnswl.org/, hightrust[63.247.69.242 listed in list.dnswl.org]0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider(turaiyaradua2003[at]gmail.com)0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)1.0 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit(hajaituraiyaradua1954[at]yahoo.com.hk)0.1 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends indigit (turaiyaradua2003[at]gmail.com)1.2 MISSING_HEADERS Missing To: header-3.0 DEAR_FRIEND BODY: Dear Friend? That's not very dear!0.0 LOTS_OF_MONEY Huge... sums of money1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC2.8 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain differentfreemails0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)0.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)0.0 T_MONEY_PERCENT X% of a lot of money for you0.4 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money1.2 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money0.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.