Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => submitted@scamdex.com [delivery-date:] => Sat, 21 Sep 2013 10:24:56 -0700 [received:] => Array ( [0] => from sitemail2.everyone.net ([216.200.145.36]:52061 helo=imta-38.everyone.net)by lester.newsblaze.com with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)(Exim 4.80.1)(envelope-from )id 1VNQvP-0005xV-Pvfor submitted@scamdex.com; Sat, 21 Sep 2013 10:24:56 -0700 [1] => from pps.filterd (m0004960.ppops.net [127.0.0.1])by imta-38.everyone.net (8.14.5/8.14.5) with SMTP id r8LHKHCJ031104;Sat, 21 Sep 2013 10:23:00 -0700 [2] => from WINDOWS-UURR390.home (55.107.128.122.static.pacdns.com [122.128.107.55])by dm0218.mta.everyone.net (EON-INBOUND) with ESMTP id dm0218.523b17f5.5eea6afor ; Sat, 21 Sep 2013 10:23:00 -0700 [3] => from localhost ([127.0.0.1]) by home with MailEnable ESMTP; Sun, 22 Sep 2013 01:16:50 +0800 [4] => from 203.201.51.166 ([203.201.51.166]) by webmail.let-glow.com(Horde Framework) with HTTP; Sat, 21 Sep 2013 17:16:49 +0000 ) [x-eon-delivered-to:] => [x-eon-dm:] => dm0218 [message-id:] => <20130921171649.19912dw8dcqw8eqs@webmail.let-glow.com> [date:] => Sat, 21 Sep 2013 17:16:49 +0000 [from:] => Denis Kirillov [reply-to:] => kirillovdenis@y7mail.com [to:] => undisclosed-recipients:; [subject:] => Prize Inquiry [mime-version:] => 1.0 [content-type:] => multipart/alternative;boundary="=_64kbowtlm680w" [content-transfer-encoding:] => 7bit [user-agent:] => Internet Messaging Program (IMP) H3 (4.3.9) [x-eon-alias-sig:] => AQI82n9SPdX05lN3DgEAAAAY,f60d2e6b67b1e51cfba20414948387f2 [x-proofpoint-virus-version:] => vendor=fsecure engine=2.50.10432:5.10.8794,1.0.431,0.0.0000definitions=2013-09-21_02:2013-09-20,2013-09-21,1970-01-01 signatures=0 [x-proofpoint-spam-details:] => rule=notspam policy=default score=3 spamscore=3 suspectscore=2 phishscore=0adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1engine=7.0.1-1305240000 definitions=main-1309210107 [x-spam-status:] => No, score=-1.8 [x-spam-score:] => -17 [x-spam-bar:] => - [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seeroot\@localhost for details.Content preview: -- Attn: We offer great interest to purchase with your company. Please get back to us with the following information. PLEASE QUATE 1. Prices FOB 2. Payment terms 3. Delivery Period 4. MOQ 5. Specified delivery date assuming from the Date of Order. Please your urgent reply will be highly appreciated. [...] Content analysis details: (-1.8 points, 4.0 required) pts rule name description---- ---------------------- ---------------------------------------------------3.0 URG_BIZ BODY: Contains urgent matter 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (cindy.wang19[at]yahoo.com) 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED-0.0 SPF_PASS SPF: sender matches SPF record 0.0 HTML_MESSAGE BODY: HTML included in message 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.