An
Email with the Subject "Account Verification Update" was
received in one of Scamdex's honeypot email accounts on Thu, 21 Feb 2013 12:35:51 -0800
and has been classified as a Generic Scam Email.
The sender shows as Admin <drben112@gmail.com>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
boxverificationpasswordchecksaccountinternetchecksentmailuserwebmaildrben112@gmail.com will mailbox(___________) password (_...cooperation
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => scam@scamdex.com
[delivery-date:] => Thu, 21 Feb 2013 12:35:51 -0800
[received:] => Array
(
[0] => from mail.tugab.bg ([194.141.15.3]:15857)by lester.newsblaze.com with esmtp (Exim 4.80)(envelope-from )id 1U8crr-0004X1-6Nfor scam@scamdex.com; Thu, 21 Feb 2013 12:35:51 -0800
[1] => from mail.tugab.bg (unknown [127.0.0.1])by mail.tugab.bg (Postfix) with ESMTP id EB584B362FF;Thu, 21 Feb 2013 22:08:21 +0200 (EET)
[2] => from webmail.tugab.bg (localhost [127.0.0.1])by mail.tugab.bg (Postfix) with ESMTPSA id A54B0B362F9;Thu, 21 Feb 2013 22:08:21 +0200 (EET)
[3] => from 116.203.101.127 ([116.203.101.127]) by mail.tugab.bg (HordeFramework) with HTTP; Thu, 21 Feb 2013 22:08:20 +0200
)
[x-virus-scanned:] => amavisd-new at tugab.bg
[message-id:] => <20130221220820.14927j8x683pvu0k@mail.tugab.bg>
[date:] => Thu, 21 Feb 2013 22:08:20 +0200
[from:] => Admin
[reply-to:] => accountupdate30@hotmail.com
[to:] => undisclosed-recipients:;
[subject:] => Account Verification Update
[mime-version:] => 1.0
[content-type:] => text/plain;charset=ISO-8859-1;DelSp="Yes";format="flowed"
[content-disposition:] => inline
[content-transfer-encoding:] => 7bit
[user-agent:] => Internet Messaging Program (IMP) H3 (4.3.7)
[x-spam-status:] => No, score=3.8
[x-spam-score:] => 38
[x-spam-bar:] => +++
[x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: The Helpdesk Program that periodically checks the size of your space email is sending you this information. The program runs weekly to ensure your inbox does not grow too large, preventing you from receiving or sending new email. As this message is being sent, you have 18 megabytes (MB) or more stored in your inbox. [...] Content analysis details: (3.8 points, 4.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (drben112[at]gmail.com) 1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT [194.141.15.3 listed in bb.barracudacentral.org] 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit (accountupdate30[at]hotmail.com) 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (drben112[at]gmail.com) 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails
[x-spam-flag:] => NO
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
email is sending you this information. The program runs weekly to
receiving or sending new email. As this message is being sent, you
username (___________) Password (_________) You will receive a
mailbox size is 20 MB, a program on your Webmail will move your oldest
continue to receive incoming emails. You will be notified that happened.
emails and it will be returned to sender. These are all programmed to
cooperation.Help.
Important: Update email account verification!
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
The Helpdesk Program that periodically checks the size of your space
email is sending you this information. The program runs weekly to
ensure your inbox does not grow too large, preventing you from
receiving or sending new email. As this message is being sent, you
have 18 megabytes (MB) or more stored in your inbox.
To help us reset your space in our database, enter your current
username (___________) Password (_________) You will receive a
periodic alert if your inbox size is between 18 and 20 MB. If the
mailbox size is 20 MB, a program on your Webmail will move your oldest
email to a folder in your home directory to ensure that you can
continue to receive incoming emails. You will be notified that happened.
If your inbox grows to 25 MB, you will not be able to receive new
emails and it will be returned to sender. These are all programmed to
ensure your e-mail continues to work well. Thanks for your Desk
cooperation.Help.
Important: Update email account verification!
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
