Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => <> [envelope-to:] => uniplex@o7e.net [delivery-date:] => Sat, 26 Jan 2013 12:35:00 -0800 [received:] => Array ( [0] => from na01-co1-blk-194-73-56-157.outbound.messaging.microsoft.com ([157.56.73.194]:12995 helo=CO9EHSNDR001.bigfish.com)by lester.newsblaze.com with esmtps (TLSv1:AES128-SHA:128)(Exim 4.80)id 1TzCSp-0003cq-TRfor uniplex@o7e.net; Sat, 26 Jan 2013 12:35:00 -0800 [1] => from co9outboundpool.messaging.microsoft.com (10.236.132.252) byCO9EHSNDR001.bigfish.com (10.236.130.55) with Microsoft SMTP Server (TLS) id14.1.225.23; Sat, 26 Jan 2013 20:34:59 +0000 [2] => from mail139-co9-R.bigfish.com (10.236.132.227) byCO9EHSOBE024.bigfish.com (10.236.130.87) with Microsoft SMTP Server id14.1.225.23; Sat, 26 Jan 2013 20:34:59 +0000 [3] => from mail139-co9 (localhost [127.0.0.1]) bymail139-co9-R.bigfish.com (Postfix) with ESMTP id 78AB8C019C; Sat, 26 Jan2013 20:34:59 +0000 (UTC) [4] => from mail139-co9 (localhost.localdomain [127.0.0.1]) by mail139-co9(MessageSwitch) id 1359232497129886_24486; Sat, 26 Jan 2013 20:34:57 +0000(UTC) [5] => from CO9EHSMHS023.bigfish.com (unknown [10.236.132.233]) bymail139-co9.bigfish.com (Postfix) with ESMTP id C7D53300100; Sat, 26 Jan 201320:34:56 +0000 (UTC) [6] => from coyote.csusm.edu (144.37.1.41) by CO9EHSMHS023.bigfish.com(10.236.130.33) with Microsoft SMTP Server id 14.1.225.23; Sat, 26 Jan 201320:34:56 +0000 [7] => from copilot.csusm.edu (copilot.csusm.edu [144.37.1.25]) bycoyote.csusm.edu (Postfix) with ESMTP id EDC3A7641A; Sat, 26 Jan 201312:34:55 -0800 (PST) [8] => from navigator.csusm.edu (144.37.11.191) by copilot.csusm.edu(144.37.1.25) with Microsoft SMTP Server (TLS) id 8.3.279.1; Sat, 26 Jan 201312:34:56 -0800 [9] => from pilot.csusm.edu ([144.37.11.248]) by navigator.csusm.edu([144.37.11.191]) with mapi; Sat, 26 Jan 2013 12:34:55 -0800 ) [x-forefront-antispam-report:] => CIP:144.37.1.41;KIP:(null);UIP:(null);IPV:NLI;H:coyote.csusm.edu;RD:coyote.csusm.edu;EFVD:NLI [x-bigfish:] => VPS31(zzd772hc85dhce0cimzz1d77h1ee6h1de0h1202h1e76h1d1ah1d2ahzz18c673h8275bh11fb3ao1852bekz2dh668h839hd25hf0ah1288h12a5h12bdh137ah1441h14ddh1504h1537h153bh15d0h162dh1631h1758h18e1h) [x-fb-outbound-spam:] => yes [x-spamscore:] => 31 [from:] => Sandra Orozco [to:] => "info@m.com" [date:] => Sat, 26 Jan 2013 12:34:54 -0800 [subject:] => System Administrator [thread-topic:] => System Administrator [thread-index:] => AQHN/ASZlebnPexvhkSA9QPlNPJrxA== [message-id:] => <0CAEE398B5226143BCE19045E3F284852F8FB069B8@pilot.csusm.edu> [accept-language:] => en-US [content-language:] => en-US [x-ms-has-attach:] => [x-ms-tnef-correlator:] => [acceptlanguage:] => en-US [content-type:] => multipart/alternative;boundary="_000_0CAEE398B5226143BCE19045E3F284852F8FB069B8pilotcsusmedu_" [mime-version:] => 1.0 [x-fope-cra-verdict:] => 144.37.1.41$nmsu.edu%0%1%csusm.edu%False%False%0$ [reply-to:] => [x-originatororg:] => csusm.edu [x-spam-status:] => No, score=1.4 [x-spam-score:] => 14 [x-spam-bar:] => + [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Your password will expire in 48Hours Click Here to validate your e-mail. Thanks System Administrator Your password will expire in 48Hours Click Here to validate your e-mail. [...] Content analysis details: (1.4 points, 4.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 HTML_MESSAGE BODY: HTML included in message 0.4 RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS 1.0 URI_GOOGLE_DOCS URI for Google Docs, common in phishing [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.