Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => submissions@scamdex.com [delivery-date:] => Sat, 17 Jan 2015 10:09:17 -0800 [received:] => Array ( [0] => from ec2-23-21-121-194.compute-1.amazonaws.com ([23.21.121.194]:38261 helo=esdn.biz)by bigcat.newsblaze.com with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256)(Exim 4.84)(envelope-from )id 1YCXoC-0004w5-W9for submissions@scamdex.com; Sat, 17 Jan 2015 10:09:17 -0800 [1] => from [211.41.123.60] (port=52510 helo=User)by esdn.biz with esmtpa (Exim 4.72)(envelope-from )id 1YC8RE-0003qC-FU; Fri, 16 Jan 2015 15:03:53 +0000 ) [reply-to:] => [from:] => "EFCC" [subject:] => VERY URGENT REQUEST IN YOUR FAVOUR [date:] => Fri, 16 Jan 2015 07:04:01 -0800 [mime-version:] => 1.0 [content-type:] => text/html;charset="Windows-1251" [content-transfer-encoding:] => 7bit [x-priority:] => 3 [x-msmail-priority:] => Normal [x-mailer:] => Microsoft Outlook Express 6.00.2600.0000 [x-mimeole:] => Produced By Microsoft MimeOLE V6.00.2600.0000 [x-spam-flag:] => YES [x-spam-score:] => 25.8 (+++++++++++++++++++++++++) [x-acl-warn:] => Array ( [0] => drop condition = 1 [1] => Your message scored 25.8 SpamAssassin point. Report follows: [2] => Spam detection software, running on the system "ip-10-38-178-158.ec2.internal", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: Based on our investigation of your payment and we want to find out if you're still alive or did you sign any deed of assignment with(WILSON ORS)to receive your fund? if not, then reply us with your Names,Address and Phone #, to this email address ( efcc.nig241@outlook.com ) as $17.6M has been approved in your favour for payment, plz reply with the requested info above so that we can proceed with the transfer. [...] Content analysis details: (25.8 points, 5.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: outlook.com]-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% [score: 1.0000] 0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam 1.7 NSL_RCVD_HELO_USER Received from HELO User 1.5 SUBJ_ALL_CAPS Subject is all capitals 1.0 MISSING_HEADERS Missing To: header 0.6 URG_BIZ BODY: Contains urgent matter 0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100% [score: 1.0000] 0.0 HTML_MESSAGE BODY: HTML included in message 0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format 0.5 MISSING_MID Missing Message-Id: header 0.0 LOTS_OF_MONEY Huge... sums of money 1.5 FROM_MISSP_XPRIO Misspaced FROM + X-Priority 1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool 1.0 FSL_NEW_HELO_USER Spam's using Helo and User 0.4 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only 0.0 MONEY_FROM_MISSP Lots of money and misspaced From 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 1.4 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors 0.0 FROM_MISSPACED From: missing whitespace 0.0 XFER_LOTSA_MONEY Transfer a lot of money 0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable 1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook 2.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope 2.5 FROM_MISSP_FREEMAIL From misspaced + freemail provider 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information 1.7 MONEY_FORM_SHORT Lots of money if you fill out a short form 2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money ) )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.