An
Email with the Subject "URGENT ACTION HIGHLY NEEDED." was
received in one of Scamdex's honeypot email accounts on Fri, 20 May 2011 04:15:21 -0700
and has been classified as a Advance Fee Fraud/419 Scam Email.
The sender shows as karim ahmed <karimahmed593@voila.fr>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
africaafricandeceasednext of kinbankcustomer40%10%50%urgentfundcustomproposal transferbusinessbank dollar our bank the bank your bank burkina fasocrashauditmutual benefitconfidentialtop secret will ouagadougoutreasury(b.o.a)(us$5,000,000)dear
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => scams@scamdex.com
[delivery-date:] => Fri, 20 May 2011 04:15:21 -0700
[received:] => Array
(
[0] => from nm29-vm2.bullet.mail.ne1.yahoo.com ([98.138.91.129])by chester.loopbiz.com with smtp (Exim 4.69)(envelope-from )id 1QNNfs-0004hT-P3for scams@scamdex.com; Fri, 20 May 2011 04:15:21 -0700
[1] => from [98.138.90.56] by nm29.bullet.mail.ne1.yahoo.com with NNFMP; 20 May 2011 11:15:19 -0000
[2] => from [98.138.87.12] by tm9.bullet.mail.ne1.yahoo.com with NNFMP; 20 May 2011 11:15:19 -0000
[3] => from [127.0.0.1] by omp1012.mail.ne1.yahoo.com with NNFMP; 20 May 2011 11:15:19 -0000
[4] => (qmail 26807 invoked by uid 60001); 20 May 2011 11:15:19 -0000
[5] => from [196.28.249.96] by web121815.mail.ne1.yahoo.com via HTTP; Fri, 20 May 2011 04:15:18 PDT
)
[x-yahoo-newman-property:] => ymail-3
[x-yahoo-newman-id:] => 498949.43593.bm@omp1012.mail.ne1.yahoo.com
[dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1305890119; bh=3DKmFX+hW0WQYHCRiaRjx6YGCr9xnK+ZUrMGJIDrXhs=; h=Message-ID:X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=04/W2qXMlgwhuvNtLLTbzsDDM5RZL+gGu+j9fA6qc32dg740mueNldE5WQDXppFW5Sj0GaLlkL6/bHdbOZnjpkK4kN8CdvINaZQDPmGsj1l8Pqzog/bqvuCe0ncWRBDbwfjN8ooXgAUGaqtGeuHBpbhWvPMjoFrt+rN5VLfHbdU=
[message-id:] => <86322.3987.qm@web121815.mail.ne1.yahoo.com>
[x-ymail-osg:] => hYCbVAwVM1mPUpYKw2HvGlslBfeGSwRaWmwXn0Tv0Q8TRuazcrfhNf6BKRV3Q2sWvTaVEWKBRffnN0e5Nmk_3Eykcy3qYlkwM7BhH.2oldW0atel8173rrV5JRnR9NdSRt6VEU_MAtt_ah2z6yZDoR4MYlnFpiHMu.gPnnGYQF_ljRl7K_9k0Z2JB3GodgBYvVhb1efsq.lW4wzuoCQ2t449vqTQG5xJDhqlmHR45k5RojXIfBrMw89WIXPSWbdeOuz3UyM0GZUu_pnIM3TrlqHZiXcMTMVXE2bxYeqN9XOHQ6o13YsBycQy.0vg8CqS3qXxVmyXkUKy31Ll5R.PxiOfDMFoX06E.Z7gxs3Klogu8ZtsaeGp0390b64aINorsKVt2gHCkLXfBdqp6hHLo8LsFAh479B193DsmB45ZN7oXDY6tpduqz6IEX_mGxgNK4X6v0qdR5wIhHhEvCXyW0RKJXq.bJ1mthEX3KYNoUFMaSeClS5jhfHSqBiqseerkYt8d2uo_HntfT33QlYndESug4VbZ5sgBfr3.1XWNwFS.wvzNEaGfWG047SzOGEATY.K_TpmfH0ZKP23cXB8bn2xB3qPIQ4HiVvTOMTbh2Z_vftTDc6X82hWrHpCd7Mk_X2rU5qAuAfMtGfGN4KUPdnT6rq_Q3UXGilWS5zIfcdRufntYLQPdT9699zlWhXIcWyrl7pIov_pp_W8VfhGxksKcKSS9G5OrtUyS4xALZdtOQ8Dck2_9iWUHJ58LBlHtpyLl4w.8njLXU9YW9tz0WbsUzJUMU86vG8yF511b0TUlOTvewklYZ9PPS2XGsEv5MKLOX58FVvXjhaRq3eCUYGvAzCyekIHMLeYDBJe2a6Qa6m3F_YWR6DPqGWZktIe.iTVSgYo_Wd5X4dsDevNeG6ZYN11aMBcxP5_8gbTuUWZXVco6khMdKqpDryjlzY74lsnt1rDjYZ42HHMXKjStCGtzeRcAnqYRvpLviUpOHaVGXjMh7QyDN0SR2_Apdc-
[x-rocketymmf:] => saidoukeita97
[x-mailer:] => YahooMailClassic/14.0.1 YahooMailWebService/0.8.111.303096
[date:] => Fri, 20 May 2011 04:15:18 -0700 (PDT)
[from:] => karim ahmed
[reply-to:] => karimahmed593@voila.fr
[subject:] => URGENT ACTION HIGHLY NEEDED.
[to:] => undisclosed recipients: ;
[mime-version:] => 1.0
[content-type:] => multipart/alternative; boundary="0-882069023-1305890118=:3987"
[x-spam-subject:] => ***SPAM*** URGENT ACTION HIGHLY NEEDED.
[x-spam-status:] => Yes, score=4.2
[x-spam-score:] => 42
[x-spam-bar:] => ++++
[x-spam-report:] => Spam detection software, running on the system "chester.loopbiz.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: DIRECTOR IN CHARGE OF AUDITING AND ACCOUNTING SECTION BANKOF AFRICA (B.O.A) OUAGADOUGOU, BURKINA FASO, WEST AFRICA, Dear Friend, [...]Content analysis details: (4.2 points, 4.0 required)pts rule name description---- ---------------------- ---------------------------------------------------0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, lowtrust[98.138.91.129 listed in list.dnswl.org]-3.0 URG_BIZ BODY: Contains urgent matter-3.0 MILLION_USD BODY: Talks about millions of dollars-2.0 NA_DOLLARS BODY: Talks about a million North American dollars0.0 HK_SCAM_N2 BODY: HK_SCAM_N20.0 FREEMAIL_FROM Sender email is freemail (karimahmed593[at]voila.fr)-2.0 SUBJ_ALL_CAPS Subject is all capitals2.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends indigit (karimahmed593[at]voila.fr)-2.0 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)-3.0 DEAR_FRIEND BODY: Dear Friend? That's not very dear!0.0 HTML_MESSAGE BODY: HTML included in message0.0 LOTS_OF_MONEY Huge... sums of money0.0 RFC_ABUSE_POST Both abuse and postmaster missing on sender domain3.5 FILL_THIS_FORM_LONG Fill in a form with personal information0.0 DECEASED_NO_ML Dead not via mailing list0.0 FILL_THIS_FORM Fill in a form with personal information1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)2.4 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)0.0 T_TO_NO_BRKTS_FREEMAIL T_TO_NO_BRKTS_FREEMAIL2.2 FILL_THIS_FORM_LOAN Answer loan question(s)0.0 T_MONEY_PERCENT X% of a lot of money for you0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money0.9 ADVANCE_FEE_3_NEW_FORM Advance Fee fraud and a form1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money0.8 ADVANCE_FEE_2_NEW_FORM Advance Fee fraud and a form0.0 MONEY_FORM Lots of money if you fill out a form0.5 MONEY_FRAUD_5 Lots of money and many fraud phrases0.8 MONEY_FRAUD_8 Lots of money and very many fraud phrases1.0 MONEY_FRAUD_3 Lots of money and several fraud phrases0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)0.5 FORM_FRAUD_5 Fill a form and many fraud phrases0.5 FORM_FRAUD_3 Fill a form and several fraud phrases
[x-spam-flag:] => YES
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
DIRECTOR IN CHARGE OF AUDITING AND ACCOUNTING SECTION
BANK OF
AFRICA (B.O.A) OUAGADOUGOU, BURKINA FASO, WEST AFRICA,
Dear
Friend,
STRICTLY
CONFIDENTIAL
I am the Director
in charge of Auditing section of Bank of African (B.O.A), I Hoped that you will
not expose or betray this trust and confident that I am about to repose on you
for the mutual benefit of our both families. I need your urgent assistance in
transferring the sum of Five Million United State Dollars Only (US$5,000,000)
immediately to your account.
I want to apply for release of the fund to you as the
nearest person to our deceased customer Mr.Sheu Yuan-dong from china (the owner
of the account) who died a long with his supposed next of kin in air crash since
on July 21 2003. I don't want the fund to go into our Bank treasury as an
abandoned fund, so this is the reason why I contacted you, so that my Bank will
release the fund to you as the nearest person to the deceased customer.
Please I
would like you to keep this proposal as a top secret and delete it if you are
not interested. Upon receipt of your reply, I will send you the application form
you will fill and send to the bank for transfer of the fund into your bank
account and also note that you will have 40% of the above mentioned amount if
you agree to help me execute this business. And also 10% had been mapped out for
you for the expense you will make in this transaction and 50% is for me. I need
you information so that I will send you the application
form.
YOUR FULL
INFORMATIONS
Your Name...
Your Home Addresses...
City... Country... Home Telephone...
Private
Telephone... Fax No... Marital Status... Age... Occupation...
Religion... International Passport
or ID card
Am Waiting for
your urgent reply so that we will starts immediately,
