Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => submitted@scamdex.com [delivery-date:] => Sat, 23 Jun 2012 11:41:54 -0700 [received:] => Array ( [0] => from sitemail2.everyone.net ([216.200.145.36]:41223 helo=imta-38.everyone.net)by lester.newsblaze.com with esmtps (TLSv1:AES256-SHA:256)(Exim 4.77)(envelope-from )id 1SiVHN-0008Mn-LKfor submitted@scamdex.com; Sat, 23 Jun 2012 11:41:54 -0700 [1] => from pps.filterd (omta002 [127.0.0.1])by imta-38.everyone.net (8.14.4/8.14.4) with SMTP id q5NIe9YT028545;Sat, 23 Jun 2012 11:41:06 -0700 [2] => from mail-ob0-f182.google.com (mail-ob0-f182.google.com [209.85.214.182])by dm0222.mta.everyone.net (EON-INBOUND) with ESMTP id dm0222.4fdad80e.183cb03for ; Sat, 23 Jun 2012 11:41:05 -0700 [3] => by obbun3 with SMTP id un3so6879649obb.27 for ; Sat, 23 Jun 2012 11:41:05 -0700 (PDT) [4] => by 10.182.202.71 with SMTP id kg7mr6570940obc.56.1340476864784; Sat,23 Jun 2012 11:41:04 -0700 (PDT) [5] => by 10.60.118.106 with HTTP; Sat, 23 Jun 2012 11:41:04 -0700 (PDT) ) [x-eon-delivered-to:] => [x-eon-dm:] => dm0222 [dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=5sXUdvvZVv02VTVsz6KQmAJ72Nn637wMb5CuId9Kb7k=; b=AwIp+MxkwBzed3zfXE4OvEz6niRw9o5CaV//Py0uUzKTPX3gp4+Wx/WH8MA+xTyeFF b+4ogICaiaNvfVaSXLyPjPg3DoJjDbtgIHiLKc58c4+/GuXW9KdN4yIBTqkSH8cgtZoO 4JvQ5WUSjyRbswp2Uri1/CjNaEp9MmdcdnmDpPkBx9fymJ4jOiqHWoFsVKj6UEKSPb1n qmhYgKkh5hpZH+fR/77ucLGB/qTj21jeJ95xkPHpTgmQ1u2EkCaF9caTbFZYSJ1lh59K F41V7kKYxcr8euCqI6eRe1tBaAV4TDM8NaU7o+8bFwzkqRGKptEkhDuHyskFu7vJw3LB e6CA== [mime-version:] => 1.0 [date:] => Sat, 23 Jun 2012 13:41:04 -0500 [message-id:] => [subject:] => Urgent [from:] => Jerald Lucas [to:] => undisclosed-recipients:; [content-type:] => multipart/alternative; boundary=e89a8f6438c65af04104c32817ec [x-proofpoint-virus-version:] => vendor=fsecure engine=2.50.10432:5.7.7855,1.0.260,0.0.0000definitions=2012-06-23_07:2012-06-22,2012-06-23,1970-01-01 signatures=0 [x-proofpoint-spam-details:] => rule=notspam policy=default score=45 spamscore=45 ipscore=0 suspectscore=1phishscore=4 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlxscancount=1 engine=6.0.2-1203120001 definitions=main-1206230211 [x-spam-status:] => No, score=1.9 [x-spam-score:] => 19 [x-spam-bar:] => + [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Dear Partner, I need you to assist me in receiving a trunk box that contains some valuable items of pure precious stones i.e. (cut diamonds and gold). These items are worth millions of dollars which I will disclose to you later on. I will make every necessary arrangement to transport the shipment to you if you accept to receive and secure it at your end until we meet. Further information will be disclosed to you as we proceed. Please indicate your interest by replying me on my personal email: *jeraldlucas59@yahoo.com* ** [...] Content analysis details: (1.9 points, 4.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (jeraldlucas5[at]gmail.com) 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (jeraldlucas5[at]gmail.com) 0.0 HTML_MESSAGE BODY: HTML included in message 1.0 FREEMAIL_REPLY From and body contain different freemails [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.