Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => scams@scamdex.com [delivery-date:] => Mon, 27 May 2013 23:02:47 -0700 [received:] => Array ( [0] => from 80-69-77-104.colo.transip.net ([80.69.77.104]:59802)by lester.newsblaze.com with esmtp (Exim 4.80)(envelope-from )id 1UhCze-0004sr-7zfor scams@scamdex.com; Mon, 27 May 2013 23:02:47 -0700 [1] => by 80-69-77-104.colo.transip.net (Postfix, from userid 0)id B5A552C1278; Tue, 28 May 2013 04:02:44 -0400 (EDT) ) [to:] => scams@scamdex.com [x-php-originating-script:] => 0:luv [from:] => HM Revenue Customs [mime-version:] => 1.0 [content-type:] => multipart/mixed;boundary="==Multipart_Boundary_xdfd00af91bcf44525df4ea639fc5d39ex" [message-id:] => <20130528080244.B5A552C1278@80-69-77-104.colo.transip.net> [date:] => Tue, 28 May 2013 04:02:44 -0400 (EDT) [x-spam-status:] => Yes, score=4.7 [x-spam-score:] => 47 [x-spam-bar:] => ++++ [x-spam-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seeroot\@localhost for details.Content preview: Request your Tax Refund Date 28 May Our Reference B/12550/18 Your Reference 35B/192/18 We have identified an error in the calculation of your tax from your fiscal year, amounting to GBP 363.79. In order for us to return the excess payment, we need you to confirm a few extra details after which the funds will be credited to your specified bank account. [...] Content analysis details: (4.7 points, 4.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP) 0.0 TVD_RCVD_IP TVD_RCVD_IP 0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS-1.1 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: racsgroup.com] 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 T_TVD_MIME_NO_HEADERS BODY: T_TVD_MIME_NO_HEADERS 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 T_OBFU_HTML_ATTACH BODY: HTML attachment with non-text MIME type 0.0 MIME_BASE64_BLANKS RAW: Extra blank lines in base64 encoding 0.0 T_HTML_ATTACH HTML attachment to bypass scanning? 0.4 RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS 3.9 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2) [x-spam-flag:] => YES [subject:] => ***SPAM*** Receive Refund To Your Anual Tax ! )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.