Scam TagCloud

Scam Email Headers

EEEEEstdClass Object ( [return-path:] => [envelope-to:] => mc_mxw@o7e.net [delivery-date:] => Mon, 15 Jul 2013 00:56:47 -0700 [received:] => Array ( [0] => from c2mds.mailcentro.com ([208.67.179.143]:43551)by lester.newsblaze.com with esmtp (Exim 4.80.1)(envelope-from )id 1UydeI-00037Q-SZfor mc_mxw@o7e.net; Mon, 15 Jul 2013 00:56:47 -0700 [1] => from mail-ie0-f195.google.com (mail-ie0-f195.google.com [209.85.223.195])by c2mds.mailcentro.com (8.13.8(MC-AXH/MJD-001)/8.13.8.axh-mjd) with ESMTP id r6F7ugOg007168for ; Mon, 15 Jul 2013 00:56:43 -0700 [2] => by mail-ie0-f195.google.com with SMTP id c10so4786730ieb.6 for ; Mon, 15 Jul 2013 00:56:45 -0700 (PDT) [3] => by 10.64.51.163 with HTTP; Mon, 15 Jul 2013 00:56:45 -0700 (PDT) ) [x-mc-sender:] => okedanldai1@gmail.com [x-mc-ipaddr:] => mail-ie0-f195.google.com [209.85.223.195] [dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=fyRT+urfHGfcYyu7lyKugSDQsMv7/M3i//SU1/JXSDg=; b=kg+lg3Q1bXOmBLxAnWZyRnn34hmzfD1Kod6Dk9EGrzFSAx8dmzP5I/n+d0eCdoOF/x K4BQOSbxLbl4gmp2HlAF6OwnyFRQpXSJH/Jkxu4JTW5jivqkmYqeMxwJhV8SdjBBLeF6 Gs9Wu1aYRDW7jqPK4uSC6IKTej9le9z8XjHDtFt25l9zkAFQo6AyZ35yu8RVi+d8lpb8 WSl+7qgfb2jJ8l8Bq9xB2nXeb7qY+uPYJyKmP3zCexwkQpffNjea8kWjcn3FR0bd3YQE 0g4c7T7U2QuRhBwWJ4JAVNIfegfBUbgxmzOAWlZtXrdmgqCGG6uFupATZAJsq+Acksvj /HtA== [mime-version:] => 1.0 [x-received:] => by 10.50.57.1 with SMTP id e1mr6313844igq.32.1373875005670; Mon,15 Jul 2013 00:56:45 -0700 (PDT) [date:] => Mon, 15 Jul 2013 08:56:45 +0100 [message-id:] => [subject:] => [Bulk?]DR OKE DANLDAI PLEASE URGENT [from:] => oke danldai [to:] => oke_danldai2@hotmail.com [content-type:] => multipart/alternative; boundary=047d7bdc152eadcc7104e18833e6 [x-mc-filter:] => 7.6.9 [x-mc-filter-antivirus:] => Scanned for virus - Status 0 [x-mc-deliveryid:] => 130 [x-mc-ctfilter:] => CT RefID = str=0001.0A090205.51E3AB3E.007A,ss=3,pt=R_F_19363275,fgs=16 - Class:Bulk - Virus Threat:Unknown - Phishing Threat:Low [x-mc-filterskip:] => 0 [x-mc-spamscore:] => 40 T 49 [x-spam-status:] => No, score=3.5 [x-spam-score:] => 35 [x-spam-bar:] => +++ [x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seeroot\@localhost for details.Content preview: DR OKE DANLDAI PLEASE URGENT AM THE CHIEF ACCOUNTANT OF THE NIGERIA NATIONAL PETROLEUM (NNPC) LAGOS, NIGERIA. ALLTERNATIVE EMAIL : oke_danldai2@hotmail.com Dear Sir/Madam I and my senior colleagues in corporation have the sum of $26m twenty six million US dollar which we got from over-inflated contracts awarded to foreign contractors in the Nigeria National Petroleum Corporation N.N.P.C.We are seeking your permission to transfer this money into your account. This money will be shared between you and partners here in Nigeria.Your commission will be 30% of the total sum 10% will be mapped out to offset any expenses incurred during transaction. [...] Content analysis details: (3.5 points, 4.5 required) pts rule name description---- ---------------------- ---------------------------------------------------3.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'-2.0 NA_DOLLARS BODY: Talks about a million North American dollars 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (okedanldai1[at]gmail.com) 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (okedanldai1[at]gmail.com) 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 FREEMAIL_REPLY From and body contain different freemails 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419) 0.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419) 0.0 T_MONEY_PERCENT X% of a lot of money for you 1.1 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419) 0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money 0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money 0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information 0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money 0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases 3.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money 1.1 MONEY_FORM_SHORT Lots of money if you fill out a short form 0.0 FORM_FRAUD_5 Fill a form and many fraud phrases [x-spam-flag:] => NO )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.