An
Email with the Subject "Invitation: Dear Friend" was
received in one of Scamdex's honeypot email accounts on Wed, 04 Jul 2012 07:46:03 -0700
and has been classified as a Advance Fee Fraud/419 Scam Email.
The sender shows as Mr Ibrahim Mantu <mantumribrahim@yahoo.dk>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
next of kinbankmicrosoftebayaccountclaimurgent transfercustomfundbusinessmailbank yen the bank mantumribrahim@yahoo.dkibrahimmantu223@gmail.comdungnguyenvn2011@yahoo.comdungpc2002@yahoo.comfbm@gmail.comdungvn1900@yahoo.comdurgeshkabra@gmail.comduyhien_tnpr@gmail.comduyquang2712@yahoo.comduythienvasc@yahoo.comvn@gmail.commdvthuan_01@yahoo.comdznguyen98023@yahoo.comebu@gmail.com will yahoo.yahoo.comdearfs
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => ebay@scamdex.com
[delivery-date:] => Wed, 04 Jul 2012 07:46:03 -0700
[received:] => Array
(
[0] => from n6-vm2.bullet.mail.ne1.yahoo.com ([98.138.229.94]:20668)by lester.newsblaze.com with smtp (Exim 4.77)(envelope-from )id 1SmQqA-0000HE-F8for ebay@scamdex.com; Wed, 04 Jul 2012 07:46:03 -0700
[1] => from [98.138.226.175] by n6.bullet.mail.ne1.yahoo.com with NNFMP; 04 Jul 2012 14:46:01 -0000
[2] => from [67.195.9.83] by t4.bullet.mail.ne1.yahoo.com with NNFMP; 04 Jul 2012 14:46:01 -0000
[3] => from [98.136.168.82] by t3.bullet.mail.gq1.yahoo.com with NNFMP; 04 Jul 2012 14:46:01 -0000
[4] => from [127.0.0.1] by store172.c108.cal.gq1.yahoo.com with NNFMP; 04 Jul 2012 14:46:01 -0000
)
[x-yahoo-newman-expires:] => 1341416761
[date:] => Wed, 4 Jul 2012 14:45:58 +0000 (GMT)
[from:] => Mr Ibrahim Mantu
[sender:] => Mr Ibrahim Mantu
[reply-to:] => Mr Ibrahim Mantu
[to:] => ebay@scamdex.com
[message-id:] => <290361271.1237004.1341413158442.JavaMail.zimbra@store172.c108.cal.gq1.yahoo.com>
[subject:] => Invitation: Dear Friend
[mime-version:] => 1.0
[content-type:] => multipart/mixed; boundary="----=_Part_1237001_748552800.1341413158294"
[x-yahoo-newman-property:] => calendar-invite
[x-yahoo-newman-id:] => mantumribrahim:c6a696b8-229c-470c-856f-494dd0782cd8:1341413161570:ebay@scamdex.com
[x-spam-status:] => No, score=0.1
[x-spam-score:] => 1
[x-spam-bar:] => /
[x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: YAHOO! KALENDER - DU ER INVITERET! mantumribrahim@yahoo.dk har sendt en invitation: Dear Friend [...] Content analysis details: (0.1 points, 4.0 required) pts rule name description---- ---------------------- ---------------------------------------------------3.0 URG_BIZ BODY: Contains urgent matter-3.0 BANKING_LAWS BODY: Talks about banking laws 3.8 HK_SCAM_N2 BODY: HK_SCAM_N2-3.0 UNCLAIMED_MONEY BODY: People just leave money laying around 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (mantumribrahim[at]yahoo.dk)-3.0 DEAR_FRIEND BODY: Dear Friend? That's not very dear! 0.0 HTML_MESSAGE BODY: HTML included in message 1.2 HK_NAME_FM_MR_MRS HK_NAME_FM_MR_MRS 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 FSL_FREEMAIL_1 FSL_FREEMAIL_1 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 0.0 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419) 0.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419) 1.9 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419) 0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money 0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money 0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases 1.9 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money 0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money 0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases 1.8 MONEY_FORM_SHORT Lots of money if you fill out a short form 0.5 FORM_FRAUD_5 Fill a form and many fraud phrases
[x-spam-flag:] => NO
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
BEGIN:VCALENDAR
PRODID:Zimbra-Calendar-Provider
VERSION:2.0
METHOD:REQUEST
BEGIN:VTIMEZONE
TZID:Etc/GMT
BEGIN:STANDARD
DTSTART:19710101T000000
TZOFFSETTO:-0000
TZOFFSETFROM:-0000
TZNAME:GMT
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
UID:c6a696b8-229c-470c-856f-494dd0782cd8
SUMMARY:Dear Friend
DESCRIPTION:Dear Friend\n\nI know that this mail will come to you as a surpr
ise as we have never met before\, but need not to worry as I am contacting y
ou independently of my investigation and no one is informed of this communic
ation. I need your urgent assistance in transferring the sum of $11.3million
immediately to your private account.The money has been here in our Bank lyi
ng dormant for years now without anybody coming for the claim of it.\n\nI wa
nt to release the money to you as the relative to our deceased customer (the
account owner) who died a long with her supposed NEXT OF KIN since 31 Janua
ry 2000. The Banking laws here does not allow such money to stay more than 1
3 years\,because the money will be recalled to the Bank treasury account as
unclaimed fund.\n\nBy indicating your interest I will send you the full deta
ils on how the business will be executed.\n\nPlease respond urgently and del
ete if you are not interested. Waiting for your urgent reply confidentially
at my private email address .(ibrahimmantu223@gmail.com)\n \n\nRegards\,\nMr
.Ibrahim Mantu. \n\n\nS.U.: http://calendar.yahoo.com/mantumribrahim/rsvp?e=
ebay@scamdex.com&uid=c6a696b8-229c-470c-856f-494dd0782cd8&tk=BBQQ0Pvgo6uBm6z
UA0vcRlxlHhs-&hh=GzaE78txS2faPEChfD4d2XFuVHc-
ATTENDEE;RSVP=TRUE:mailto:dungngo2002@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:dungnguyen125xxx@ymail.com
ATTENDEE;RSVP=TRUE:mailto:dungnguyenvn2011@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:dungpc2002@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:dungpc2002@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:dungqtkd_k08@ymail.com
ATTENDEE;RSVP=TRUE:mailto:dungtv.fbm@gmail.com
ATTENDEE;RSVP=TRUE:mailto:dungvn1900@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:duong-yenxxx@ymail.com
ATTENDEE;RSVP=TRUE:mailto:duongchantroi_86@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:duongchilinh@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:duongminhtuanyhct@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:duongnvhp@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:duongquoccuong@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:durgeshkabra@gmail.com
ATTENDEE;RSVP=TRUE:mailto:durgeshkabra@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:dutn85@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:dutoang8@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:duyencoco@ymail.com
ATTENDEE;RSVP=TRUE:mailto:duyhien_tnpr@gmail.com
ATTENDEE;RSVP=TRUE:mailto:duyhummer96@ymail.com
ATTENDEE;RSVP=TRUE:mailto:duyphuong13@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:duyquang2712@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:duythienvasc@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:duytinh.vn@gmail.comM
ATTENDEE;RSVP=TRUE:mailto:duyvothanh@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:duyxxx@ymail.com
ATTENDEE;RSVP=TRUE:mailto:dvthuan_01@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:dznguyen98023@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:e-beatz@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:eMaster3@ymail.com
ATTENDEE;RSVP=TRUE:mailto:eangeladb@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:eat_chicken12@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:ebay@scamdex.com
ATTENDEE;RSVP=TRUE:mailto:eben_maria12@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:ebernal_green@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:ebmomsclub@ymail.com
ATTENDEE;RSVP=TRUE:mailto:ebu@gmail.com
ATTENDEE;RSVP=TRUE:mailto:ebuddy_chat@ymail.com
ATTENDEE;RSVP=TRUE:mailto:ebybill@ymail.com
ORGANIZER;CN=Mr Ibrahim Mantu:mailto:mantumribrahim@yahoo.dk
DTSTART;TZID="Etc/GMT":20120704T150000
DTEND;TZID="Etc/GMT":20120704T160000
STATUS:CONFIRMED
CLASS:PUBLIC
X-MICROSOFT-CDO-INTENDEDSTATUS:BUSY
TRANSP:OPAQUE
X-MICROSOFT-DISALLOW-COUNTER:TRUE
DTSTAMP:20120704T144553Z
SEQUENCE:0
END:VEVENT
END:VCALENDAR
invite.ics
File: application/ics