An
Email with the Subject "Your Intuit.com software order." was
received in one of Scamdex's honeypot email accounts on Mon, 05 Mar 2012 04:00:07 -0800
and has been classified as a Generic Scam Email.
The sender shows as "INTUIT INC." <update@intuit.com>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => earnestpbvfrederick@scamdex.com
[delivery-date:] => Mon, 05 Mar 2012 04:00:07 -0800
[received:] => Array
(
[0] => from 125-236-197-234.adsl.xtra.co.nz ([125.236.197.234] helo=xtra.co.nz)by lester.newsblaze.com with esmtp (Exim 4.69)(envelope-from )id 1S4Wa5-00018H-74for earnestpbvfrederick@scamdex.com; Mon, 05 Mar 2012 04:00:07 -0800
[1] => from (192.168.1.170) by intuit.com (125.236.197.234) with Microsoft SMTP Server id 8.0.685.24; Mon, 5 Mar 2012 23:59:57 +1200
)
[message-id:] => <4F549843.809090@intuit.com>
[date:] => Mon, 5 Mar 2012 23:59:57 +1200
[from:] => "INTUIT INC."
[user-agent:] => Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.24) Gecko/20100328 Thunderbird/2.0.0.24
[mime-version:] => 1.0
[to:] =>
[subject:] => Your Intuit.com software order.
[content-type:] => multipart/alternative;boundary="------------08050300206080902010303"
[x-spam-status:] => No, score=3.5
[x-spam-score:] => 35
[x-spam-bar:] => +++
[x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Your intuit.com order. DearSir/Madam: Thank you forpurchasingyour softwareIntuit Market. We areprocessing and willletyou know when yourorderis processed. Ifyou ordered multiple items, wemay sendthem in more than oneshipment(at noextra cost to you) to ensurequicker delivery. If you havequestionsabout your order, pleasecall 1-800-955-8890. [...] Content analysis details: (3.5 points, 4.0 required)pts rule name description---- ---------------------- --------------------------------------------------1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT[125.236.197.234 listed in bb.barracudacentral.org]1.7 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist[URIs: franovaworldservices.com]1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist[URIs: franovaworldservices.com]-3.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'0.0 TVD_RCVD_IP TVD_RCVD_IP0.9 SPF_FAIL SPF: sender does not match SPF record (fail)[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=update%40intuit.com;ip=125.236.197.234;r=lester.newsblaze.com]0.0 HTML_MESSAGE BODY: HTML included in message0.4 RDNS_DYNAMIC Delivered to internal network by host withdynamic-looking rDNS
[x-spam-flag:] => NO
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
Thank you for
purchasing your software
Intuit Market. We are
processing and will
let
you know when your
order is processed. If
you ordered
multiple items, we
may send
them in more than one
shipment (at no
extra cost to you) to ensure
quicker delivery.
If you have
questions about your order, please
call 1-800-955-8890.
ORDER
INFORMATION
Please download
your complete
order
id #563596592293
information at Intuit
small business website.
NEED HELP?
Email us at mktplace_customerservice@intuit.com.
Call us at
1-800-955-8890.
Reorder Intuit Checks
Quickly and
Easily starting
with
the information
from your previous
order.
To
help us better serve
your needs, please
take
a
few minutes to let us
know how we are doing.
Submit
your feedback here.
Thanks
again for your order,
Intuit
Market Customer
Service
Privacy , Legal , Contact Us , About
Us
You have received this
business communication as part of our efforts
to fulfill your request or service
your account. You may
receive this and other business communications
from us even if you have opted
out of marketing messages.
Please note: This
e-mail was sent from an auto-notification
system that cannot accept incoming email
Please do not reply to this
message.
If you receive an email
message that appears to come from Intuit but
that you suspect is a phishing
e-mail, please forward it
immediately to spoof@intuit.com.
Please visit http://security.intuit.com/
for
additional security
information.
