Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => scams@scamdex.com [delivery-date:] => Mon, 13 Feb 2012 06:10:33 -0800 [received:] => Array ( [0] => from mx01.geomix.at ([77.75.18.2] helo=mx02.geomix.at)by lester.newsblaze.com with esmtps (TLSv1:AES256-SHA:256)(Exim 4.69)(envelope-from )id 1Rwwbv-0007Nv-GAfor scams@scamdex.com; Mon, 13 Feb 2012 06:10:33 -0800 [1] => from localhost ([127.0.0.1] helo=77.75.18.2)by mx02.geomix.at with esmtp (Exim 4.69)(envelope-from )id 1RwwaE-0001VC-If; Mon, 13 Feb 2012 15:08:57 +0100 ) [mime-version:] => 1.0 [content-type:] => text/plain; charset=UTF-8;format=flowed [content-transfer-encoding:] => 7bit [date:] => Mon, 13 Feb 2012 06:08:46 -0800 [from:] => miss rosemary [to:] => undisclosed-recipients:; [subject:] => From: Dr. Ubril Yanko [message-id:] => <383f54a23465e56f301bd9aff6a305b9@geomix.at> [x-sender:] => dr.rosemaryjohnson@geomix.at [user-agent:] => RoundCube Webmail/0.5.3 [x-spam-score:] => Array ( [0] => 6.5 (++++++) [1] => 39 ) [x-spam-report:] => Spam detection software, running on the system "mx02.geomix.at", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: From: Dr. Ubril Yanko N.N.P.C. Contract Award Committee Chairman.Lagos Nigeria. Direct Email ubrily@yahoo.com RE: OVER INVOICED CONTRACT PAYMENT.I would like to use the name of your company to receive the sum of sixtytwo Million United States Dollars ($62M) which was deliberately over invoicedby my committee in the Nigeria National Petroleum cooperation{ NNPC} in contract/CrudOil sell etc. You are receiving this fund as a sub contractor who has notbeen paid and I will produce all the relevant documents that will make youthe beneficiary of this fund without any risk attached to it. If you areinterested and confident to yourself that you are capable of handling suchdeal kindly reply me by providing me your company full detail ,your privatetelephone so that we will talk things over . Await your response Thanks,Dr. Ubril Yanko [...] Content analysis details: (6.5 points, 5.0 required)pts rule name description---- ---------------------- ---------------------------------------------------1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%[score: 1.0000]1.5 MILLION_USD BODY: Talks about millions of dollars1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419)1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419)0.6 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419) [x-spam-status:] => No, score=3.9 [x-spam-bar:] => +++ [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: From: Dr. Ubril Yanko N.N.P.C. Contract Award Committee Chairman.Lagos Nigeria. Direct Email ubrily@yahoo.com RE: OVER INVOICED CONTRACT PAYMENT.I would like to use the name of your company to receive the sum of sixtytwo Million United States Dollars ($62M) which was deliberately over invoicedby my committee in the Nigeria National Petroleum cooperation{ NNPC} in contract/CrudOil sell etc. You are receiving this fund as a sub contractor who has notbeen paid and I will produce all the relevant documents that will make youthe beneficiary of this fund without any risk attached to it. If you areinterested and confident to yourself that you are capable of handling suchdeal kindly reply me by providing me your company full detail ,your privatetelephone so that we will talk things over . Await your response Thanks,Dr. Ubril Yanko [...] Content analysis details: (3.9 points, 4.0 required)pts rule name description---- ---------------------- --------------------------------------------------0.0 T_LOTTO_DEPT BODY: Claims Department-3.0 MILLION_USD BODY: Talks about millions of dollars-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relaydomain1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO0.0 LOTS_OF_MONEY Huge... sums of money0.0 T_HK_NAME_MR_MRS T_HK_NAME_MR_MRS0.6 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)0.8 SINGLE_HEADER_1K A single header contains 1K-2K characters0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money1.7 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money1.5 MONEY_FRAUD_5 Lots of money and many fraud phrases0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.