An
Email with the Subject "Re:Validate" was
received in one of Scamdex's honeypot email accounts on 06 Jul 2020 04:28:00 -0000
and has been classified as a Advance Fee Fraud/419 Scam Email.
The sender shows as "Admin " <nhug_nh@baohiembaolong.vn>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
quota limitaccountvalidatemaildear
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[delivered-to:] => Array
(
[0] => unknown
[1] => scamdex@gmail.com
)
[received:] => Array
(
[0] => from imap.gmail.com (74.125.195.108:993) by mail.scamalot.com with IMAP4-SSL; 06 Jul 2020 04:28:00 -0000
[1] => by 2002:a05:6638:24f:0:0:0:0 with SMTP id w15csp884338jaq; Tue, 9 Jun 2020 12:07:56 -0700 (PDT)
[2] => from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id z14sor2450690edr.29.2020.06.09.12.07.55 for (Google Transport Security); Tue, 09 Jun 2020 12:07:56 -0700 (PDT)
[3] => from mail.crstdla.dz (mail.crstdla.dz. [193.194.80.166]) by gmr-mx.google.com with ESMTPS id p17si1219915edq.5.2020.06.09.12.07.55 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 09 Jun 2020 12:07:55 -0700 (PDT)
[4] => from localhost (localhost [127.0.0.1]) by mail.crstdla.dz (Postfix) with ESMTP id DFB1F15E31FD for ; Tue, 9 Jun 2020 20:48:17 +0200 (CEST)
[5] => from mail.crstdla.dz ([127.0.0.1]) by localhost (mail.crstdla.dz [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id sFCahrKNdhzt for ; Tue, 9 Jun 2020 20:48:17 +0200 (CEST)
[6] => from localhost (localhost [127.0.0.1]) by mail.crstdla.dz (Postfix) with ESMTP id 2688A1688A56 for ; Tue, 9 Jun 2020 18:17:43 +0200 (CEST)
[7] => from mail.crstdla.dz ([127.0.0.1]) by localhost (mail.crstdla.dz [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id jmh2hGgiJ5jh for ; Tue, 9 Jun 2020 18:17:43 +0200 (CEST)
[8] => from Shahzad.sgtdf1kynrze5oknzbujnfdbyd.bx.internal.cloudapp.net (unknown [172.16.0.1]) by mail.crstdla.dz (Postfix) with ESMTPSA id 2B52A15A5D78 for ; Tue, 9 Jun 2020 15:39:22 +0200 (CEST)
)
[x-received:] => Array
(
[0] => by 2002:a50:be8f:: with SMTP id b15mr27332696edk.182.1591729676085; Tue, 09 Jun 2020 12:07:56 -0700 (PDT)
[1] => by 2002:a05:6402:393:: with SMTP id o19mr28873935edv.28.1591729675873; Tue, 09 Jun 2020 12:07:55 -0700 (PDT)
)
[arc-seal:] => Array
(
[0] => i=2; a=rsa-sha256; t=1591729676; cv=pass; d=google.com; s=arc-20160816; b=SxUeshr2xDoLLUuTbSVDiWUFsvuk/3LyW79BBYCKl2/fP5LHelUj0OOqnfIhF/GnvQ zusxPC5pEE5omGz2UTp9zgJeuwiEnDsS8LaMJXx/4XaJFKLZWTx+nX5wJK54I7bjpnP5 uBNhovLvkO3CVGD44yLCrXC8PukLm2v9+qK8wb3gI9i/dtZh24oxfh7bgCa8r+IsgZfR xIbpTEDMnEkv/FGWyf2nZfpLUaA76U7kxzJy2l5HAulbY6cPby+gX0sXnsyfCufMT49U Kqg3BvcfQL7V1hESky6fpw6uAr07Mv+cRxKF8UUEpdEx4vPafFETSSspuNI8dE7ftRp3 kLIw==
[1] => i=1; a=rsa-sha256; t=1591729675; cv=none; d=google.com; s=arc-20160816; b=DACZe/WRglSgoUToSN4qOmkwtsldwZ5uxdChebRQvBpkW08Ki2RlJ2Wm0MiA4UQTZd d/SbRcxpGqc+SDZPlJb9rxeZne4DHD7Crwjg1mhpm4y15XPJxpVYuVUQkLKFHszq3IM4 mBtEk/uRGZZaCGEfxSdSsnm0pwBui40vPG1TbH0UeoBuzOX/KDF4wviq9gSMkuCu5RQq nBYB5dlwajVyojoEGTUQfgQjWItcrF+Uw78ivaXdMzaLEVdJjrhPrfkvkIMaHK+j1TEo lhsb7Lyj5kiLCkifH2H4heDBhQUTnmb+86SbK/+MMug/9WlHXuBucL4uflQ+tiY/YuIz 6HxA==
)
[arc-message-signature:] => Array
(
[0] => i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:from:to:subject:mime-version; bh=TnX+w+UozlkfreGz0kVp6Nii//ZGC8W+eChobHOXRow=; b=JN3kYZYAiI1G6ibmmspEqzIM7URyhmfwJSIvueh0+ld8DSvEPHfJQwTCLDIE3FDF3P +i3tQuazH6nHZs7+Tciqz79JKpwkfGbYUwhkDQRdCT8MWGQ57BOZKv38Q28+PKWVqxdf 2k6cSGzifuDXzwXhNY2vo5oJP5swgknkkYefq9Sxrx+5eS6lFjON7KxPbsYPmxD1xbFu URj4AZ0TE3Cqs3zzDIDdPYW8FJ65fz2aMJehXz60ALqImZ2I+pigA6ekzI7ijmcV6WVK A2s7CKqYqKeKvaOzOjKi+8ayNb6kMiBlkNf0GoYNEPDhCztaOXKZ2bn35sZk/oocNlWH l6BQ==
[1] => i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:from:to:subject:mime-version; bh=TnX+w+UozlkfreGz0kVp6Nii//ZGC8W+eChobHOXRow=; b=v40NBbHMItIpWZrf/5YdafSicUrryA2vUwnhtIOeZWfTXeiXSXQo6eiAd30LqAutQW L8meyO98y3YvOPwNLJvVjgY/E/H8f/KJ9+jRfogk7UMH6cvLLYmnn6gm1j4AnA5Pwk7t SHMMvM+0bm7l138FJwjctAX0N7Tw5zRasenu3RvHC0I2CnYmxutyPaMHReIct5E5NH8M GrR8TyPyF2VKWrTx04awKAyg0wUFrzGIJacAO3Xv+RvtilawXAqcmdVojEkkWvDB02Ac ebWo/2lSs/+aFQKjQGCL41bmqSJRivjCs3utahiZmNSVzufhCcTnb841fN5j8Fl5YrP1 4Nzg==
)
[arc-authentication-results:] => Array
(
[0] => i=2; mx.google.com; arc=pass (i=1); spf=softfail (google.com: domain of transitioning nhug_nh@baohiembaolong.vn does not designate 209.85.220.41 as permitted sender) smtp.mailfrom=nhug_nh@baohiembaolong.vn; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=baohiembaolong.vn
[1] => i=1; gmr-mx.google.com; spf=softfail (google.com: domain of transitioning nhug_nh@baohiembaolong.vn does not designate 193.194.80.166 as permitted sender) smtp.mailfrom=nhug_nh@baohiembaolong.vn; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=baohiembaolong.vn
)
[received-spf:] => Array
(
[0] => softfail (google.com: domain of transitioning nhug_nh@baohiembaolong.vn does not designate 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
[1] => softfail (google.com: domain of transitioning nhug_nh@baohiembaolong.vn does not designate 193.194.80.166 as permitted sender) client-ip=193.194.80.166;
)
[authentication-results:] => mx.google.com; arc=pass (i=1); spf=softfail (google.com: domain of transitioning nhug_nh@baohiembaolong.vn does not designate 209.85.220.41 as permitted sender) smtp.mailfrom=nhug_nh@baohiembaolong.vn; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=baohiembaolong.vn
[x-google-dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:mime-version :subject:to:from:date:message-id; bh=TnX+w+UozlkfreGz0kVp6Nii//ZGC8W+eChobHOXRow=; b=Zt6MmCbzibMMu46kHh+mW7wdEF5ZNoCxyy1zmW5IURz63gl6nWkI9t7IPX4YlI1trA DOZFcgCscfqeRKl3hzWbtynIMRejggMkQYpOOPDKjCtBv4IyuSCNp99wI4y0gy/d0RtW RBQKjmNn6kIZt50udelbcQdUyI9LfrznhjRiT/hjFA4OkwtEbIKrepYpQRtzmXhicYZS DYv1UCVcLxmauCvTFAtFNM/XZqjhHFNuNvOY1P0gYam1zmSsoJc3h7NF+uW8xWmBKLF3 mJIRUwczYhfNRx+pIxoIaz3lA6i8JYG+R1/o320CXohlPCn1oNazJXR9t5W7+wZVoTRS ekYw==
[x-original-authentication-results:] => gmr-mx.google.com; spf=softfail (google.com: domain of transitioning nhug_nh@baohiembaolong.vn does not designate 193.194.80.166 as permitted sender) smtp.mailfrom=nhug_nh@baohiembaolong.vn; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=baohiembaolong.vn
[x-gm-message-state:] => AOAM5323TWexQEI7/3tWq7HtacBRbUo68eNHfNebG55g6/5B/dFLx197 uFYwu3vCgAp8NwvaaE8OmgqNrcdwpSLCw6qVsQ==
[x-google-smtp-source:] => ABdhPJy/04WJTS5DHWn88zuVMxFJLYbibygtBuqRafmBfKnKYlsX+QSSSAijywNmCBir6cHx0t1m11jyO2bMqeTfrFVkS2tD5W4=
[x-virus-scanned:] => amavisd-new at mail.crstdla.dz
[content-type:] => multipart/alternative; boundary="===============1840329388=="
[mime-version:] => 1.0
[subject:] => Re:Validate
[to:] => jssubmissions@scamdex.com
[from:] => "Admin "
[date:] => Tue, 09 Jun 2020 13:39:20 +0000
[message-id:] => <20200609133923.2B52A15A5D78@mail.crstdla.dz>
[x-getmail-retrieved-from-mailbox:] => =?utf-8?q?=5BGmail=5D/Spam?=
[x-gmail-thrid:] => =?utf-8?q?1669046550657535280?=
[x-gmail-msgid:] => =?utf-8?q?1669049536645866978?=
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
Dear jssubmissions@scamdex.com ,
Your account has exceeded it quota limit as set by Administrator, and you may not be able to send or receive new mails until you Re-Validate your jssubmissions@scamdex.com account.
To Re-Validate jssubmissions@scamdex.com account, Please CLICK:Re-Validate jssubmissions@scamdex.com Account
Dear jssubmissions@scamdex.com ,
Your account has exceeded it quota limit as set by Administrator, and you may not be able to send or receive new mails until you Re-Validate your jssubmissions@scamdex.com account.
To Re-Validate jssubmissions@scamdex.com account, Please CLICK: Re-Validate jssubmissions@scamdex.com Account