Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => scam@scamdex.com [delivery-date:] => Fri, 19 Sep 2014 15:42:00 -0700 [received:] => Array ( [0] => from mx1.snt.utwente.nl ([130.89.149.33]:51918)by lester.newsblaze.com with esmtps (TLSv1:AES256-SHA:256)(Exim 4.82)(envelope-from )id 1XV6sJ-0005qN-RHfor scam@scamdex.com; Fri, 19 Sep 2014 15:42:00 -0700 [1] => from huizebieramide.student.utwente.nl ([130.89.160.104] helo=User)by mx1.snt.utwente.nl with smtp (Exim 4.72)(envelope-from )id 1XV6s5-00018S-70; Sat, 20 Sep 2014 00:41:50 +0200 ) [message-id:] => [reply-to:] => [from:] => "M.J.F" [subject:] => Your Abandoned ATM Card Is Now In My Custody And Ready To Be Dispatchedutw [date:] => Fri, 19 Sep 2014 18:34:22 -0400 [mime-version:] => 1.0 [content-type:] => text/plain;charset="Windows-1251" [content-transfer-encoding:] => 7bit [x-priority:] => 3 [x-msmail-priority:] => Normal [x-mailer:] => Microsoft Outlook Express 6.00.2600.0000 [x-mimeole:] => Produced By Microsoft MimeOLE V6.00.2600.0000 [x-snt-signature:] => dced08e924bf6ce3f7711210756427772a47b226 [x-snt-spam-score:] => 31.9 [x-snt-spam-score-bar:] => +++++++++++++++++++++++++++++++ [x-snt-spam-report:] => Content analysis details: (31.9 points, 5.0 required) pts rule name description---- ---------------------- ---------------------------------------------------1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP 3.7 DEAR_BENEFICIARY BODY: Dear Beneficiary: 3.2 MILLION_USD BODY: Talks about millions of dollars 0.0 FSL_HELO_NON_FQDN_1 FSL_HELO_NON_FQDN_1 0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam 1.0 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam 0.0 FSL_RCVD_USER FSL_RCVD_USER 0.0 NSL_RCVD_HELO_USER Received from HELO User 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (mf6392048[at]usa.com) 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit () 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (mf6392048[at]usa.com) 1.0 MISSING_HEADERS Missing To: header 1.4 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/) 0.4 FSL_UA FSL_UA 1.4 MALFORMED_FREEMAIL Bad headers on message from free email service 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority 1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool 1.0 FROM_MISSP_NO_TO From misspaced, To missing 0.0 FSL_FREEMAIL_1 FSL_FREEMAIL_1 0.0 FSL_NEW_HELO_USER Spam's using Helo and User 1.7 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait 2.6 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE 0.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to 1.3 MONEY_ATM_CARD Lots of money on an ATM card 0.0 FROM_MISSPACED From: missing whitespace 0.0 MONEY_FROM_MISSP Lots of money and misspaced From 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 0.0 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors 0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope 0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable 0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419) 0.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419) 1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook 2.5 DOS_OE_TO_MX Delivered direct to MX with OE headers 2.1 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419) 0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money 0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money 0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases 0.4 FROM_MISSP_FREEMAIL From misspaced + freemail provider 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information 1.7 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money 0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money 0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases 2.0 MONEY_FORM_SHORT Lots of money if you fill out a short form 0.5 FORM_FRAUD_5 Fill a form and many fraud phrases [x-snt-spam-flag:] => YES )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.

U.S. Customs and Border Protection
Office of Border Patrol
Ronald Reagan Building, Washington, D.C.

Attention: Beneficiary

I am pleased to inform you that your ATM Card worth Ten Million, Five Hundred Thousand United 
States Dollars sent from Nigeria as part of your overdue payment/funds was returned to our office 
last week from Atlanta, Georgia where it was held due to one unavailable document. According to the 
information reaching my desk today, the ATM Card was returned due to your failure to pay the 
necessary charges required by the delivery company to enable it pass through the security agency.

However, after due investigation was conducted, I found out that your ATM Card was stopped 
unnecessarily. Georgia office told us that your ATM Card has no INTERNATIONAL DELIVERY PERMIT that 
was why you were told to pay huge amount of money which you did not pay. But after further 
investigation, it was very clear that your ATM Card has the INTERNATIONAL DELIVERY PERMIT attached 
to it therefore you will no longer pay the money you were asked to pay then. Now the only money you 
are required to pay is $90 only billed for NIGERIA CUSTOMS SERVICE CLEARANCE CERTIFICATE to clear 
your file so that you can receive your ATM Card without further delay. Note that the Nigeria 
customs will process the CUSTOMS CLEARANCE CERTIFICATE and send it to us as soon as you send the 
money to them to enable us release your ATM Card.

Kindly reconfirm your full name, home address, I.D and direct/cell phone number so that your ATM 
Card will be dispatched without any delay immediately you send the fee to them. Be rest assured 
that your ATM card will be dispatched to the address you provided as soon as you send the fee for 
the document. Secondly, be rest assured that there will be no delay on your ATM card delivery after 
you send the money and the clearance document is been issued in your name by the NIGERIA CUSTOMS 
SERVICE AUTHORITY.

Awaiting your timely response with the above stated details so that I will send you the information 
you will use in sending the money to them.

For more information about me, kindly visit here, 
http://www.cbp.gov/about/leadership/assistant-commissioners-office/border-patrol

You can also contact me here, cbp.mjf@qq.com

Regards,

Michael J. Fisher