An
Email with the Subject "Invitation: DEAR FRIEND YOU HAVE A GOOD NEWS" was
received in one of Scamdex's honeypot email accounts on Sat, 13 Oct 2012 07:00:13 -0700
and has been classified as a Generic Scam Email.
The sender shows as Khan Omar <khanomar447@yahoo.dk>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => scams@scamdex.com
[delivery-date:] => Sat, 13 Oct 2012 07:00:13 -0700
[received:] => Array
(
[0] => from n8-vm2.bullet.mail.ne1.yahoo.com ([98.138.229.158]:24160)by lester.newsblaze.com with smtp (Exim 4.77)(envelope-from )id 1TN2GC-0003vA-Hefor scams@scamdex.com; Sat, 13 Oct 2012 07:00:13 -0700
[1] => from [98.138.226.173] by n8.bullet.mail.ne1.yahoo.com with NNFMP; 13 Oct 2012 14:00:12 -0000
[2] => from [98.136.168.87] by t2.bullet.mail.ne1.yahoo.com with NNFMP; 13 Oct 2012 14:00:11 -0000
[3] => from [127.0.0.1] by store177.c108.cal.gq1.yahoo.com with NNFMP; 13 Oct 2012 14:00:11 -0000
)
[x-yahoo-newman-expires:] => 1350140411
[date:] => Sat, 13 Oct 2012 07:00:07 -0700 (PDT)
[from:] => Khan Omar
[sender:] => Khan Omar
[reply-to:] => Khan Omar
[to:] => scams@scamdex.com
[message-id:] => <748041350.28586.1350136807862.JavaMail.zimbra@store177.c108.cal.gq1.yahoo.com>
[subject:] => Invitation: DEAR FRIEND YOU HAVE A GOOD NEWS
[mime-version:] => 1.0
[content-type:] => multipart/mixed; boundary="----=_Part_28583_1415052543.1350136807732"
[x-yahoo-newman-property:] => calendar-invite
[x-yahoo-newman-id:] => khanomar447:510b2ba6-b80f-4bec-9ac7-87b1bb0ddac2:1350136811690:scams@scamdex.com
[x-spam-status:] => No, score=3.6
[x-spam-score:] => 36
[x-spam-bar:] => +++
[x-ham-report:] => Spam detection software, running on the system "lester.newsblaze.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: YAHOO! KALENDER - DU ER INVITERET! khanomar447@yahoo.dk har sendt en invitation: DEAR FRIEND YOU HAVE A GOOD NEWS [...] Content analysis details: (3.6 points, 4.0 required) pts rule name description---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (khanomar447[at]yahoo.dk) 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit (khan omar ) 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (khanomar447[at]yahoo.dk)-3.0 DEAR_FRIEND BODY: Dear Friend? That's not very dear!-2.0 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 FSL_FREEMAIL_2 FSL_FREEMAIL_2 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 FSL_FREEMAIL_1 FSL_FREEMAIL_1 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419) 3.3 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money 0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money 0.2 MONEY_FRAUD_3 Lots of money and several fraud phrases
[x-spam-flag:] => NO
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
BEGIN:VCALENDAR
PRODID:Zimbra-Calendar-Provider
VERSION:2.0
METHOD:REQUEST
BEGIN:VTIMEZONE
TZID:Etc/GMT
BEGIN:STANDARD
DTSTART:19710101T000000
TZOFFSETTO:-0000
TZOFFSETFROM:-0000
TZNAME:GMT
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
UID:510b2ba6-b80f-4bec-9ac7-87b1bb0ddac2
SUMMARY: DEAR FRIEND YOU HAVE A GOOD NEWS
DESCRIPTION:DEAR FRIEND YOU HAVE A GOOD NEWS\n\n\n\nI'm happy to inform you
about my success in getting the fund\ntransferred under the cooperation of\n
\na new partner from london. Presently Iâam in london for investment\nprojec
ts with my own share of\n\nthe total sum. Meanwhile\, I didn't forget your p
ast efforts and\nattempts to assist me in\n\ntransferring those funds despit
e that it failed us some how.\n\nNow contact my secretary\, his name is hass
an.ali and his Email Address\nsecretary email:(hassan.ali_12326@yahoo.dk )\n
\nask him to send you the total $3\,000.000.00\nwhich i kept for your\n\ncom
pensation for all the past efforts and attempts to assist me in\nthis matter
. I appreciated\n\nyour efforts at that time very much. so feel free and get
in touched\nwith my secretary Mr hassan.ali\n\nand instruct him where to se
nd the amount to you.\n\nPlease do let me know immediately you receive it so
that we can share\nthe joy after all the\n\nsufferness at that time. In the
moment\, i am very busy here because of\nthe investment projects\n\nwhich m
e and the new partner are having at hand\, finally\, remember\nthat I had fo
rwarded\n\ninstruction to the secretary on your behalf to receive that money
\, so\nfeel free to get in touch\n\nwith Mr (hassan.ali_12326@yahoo.dk) and
he will send the amount to you\nwith out any delay.\n\nwith best regards\nM
r Khan Oma\n\n\nS.U.: http://calendar.yahoo.com/khanomar447/rsvp?e=scams@sc
amdex.com&uid=510b2ba6-b80f-4bec-9ac7-87b1bb0ddac2&tk=11EyMgHUirlNS9szhZhpj_
15Fso-&hh=bZWHuwlDAZ_IhbV7OL9gfRoC30I-
LOCATION:hassan.ali_12326@yahoo.dk
ATTENDEE;RSVP=TRUE:mailto:sasosua@hotmail.es
ATTENDEE;RSVP=TRUE:mailto:satalways@yahoogroups.com
ATTENDEE;RSVP=TRUE:mailto:satheeshgandla@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:sathei@iupui.edu
ATTENDEE;RSVP=TRUE:mailto:sattar@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:satti101@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:saturninzongo@gmail.com
ATTENDEE;RSVP=TRUE:mailto:saulatbari@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:saulatbari@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:saulh@economia.unam.mx
ATTENDEE;RSVP=TRUE:mailto:savadogomou@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:savas_17_74@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:savina.bhat@yahoo.co.in
ATTENDEE;RSVP=TRUE:mailto:saviorwinnaa@yahoo.co.uk
ATTENDEE;RSVP=TRUE:mailto:savitabailur@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:saw_deric@yahoo.fr
ATTENDEE;RSVP=TRUE:mailto:sawadogoyambangba@yahoo.fr
ATTENDEE;RSVP=TRUE:mailto:sawadougou_zongo050@yahoo.co.jp
ATTENDEE;RSVP=TRUE:mailto:sawersmargaret25@yahoo.com.hk
ATTENDEE;RSVP=TRUE:mailto:sayedm@eg.ibm.com
ATTENDEE;RSVP=TRUE:mailto:sayehwawa@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:sayyad33@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:sba.khan@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:sbailey19@hotmail.fr
ATTENDEE;RSVP=TRUE:mailto:sballeith@gmail.com
ATTENDEE;RSVP=TRUE:mailto:sbcglobal@aol.com
ATTENDEE;RSVP=TRUE:mailto:sbcom_sillod1992@rediffmail.com
ATTENDEE;RSVP=TRUE:mailto:sbee.benin@hotmail.fr
ATTENDEE;RSVP=TRUE:mailto:sbiotechpro@yahoo.com
ATTENDEE;RSVP=TRUE:mailto:sbnatarajkit@yahoo.co.in
ATTENDEE;RSVP=TRUE:mailto:scamdex@scamdex.com
ATTENDEE;RSVP=TRUE:mailto:scams@scamdex.com
ATTENDEE;RSVP=TRUE:mailto:scamvictims@yahoo.co.uk
ATTENDEE;RSVP=TRUE:mailto:scawjn@aol.co.uk
ATTENDEE;RSVP=TRUE:mailto:scctn@mucc.mahidol.ac.th
ATTENDEE;RSVP=TRUE:mailto:schamra@hotmail.com
ATTENDEE;RSVP=TRUE:mailto:schandra777@gmail.com
ORGANIZER;CN=Khan Omar:mailto:khanomar447@yahoo.dk
DTSTART;TZID="Etc/GMT":20121012T140000
DTEND;TZID="Etc/GMT":20121012T150000
STATUS:CONFIRMED
CLASS:PUBLIC
X-MICROSOFT-CDO-INTENDEDSTATUS:BUSY
TRANSP:OPAQUE
X-MICROSOFT-DISALLOW-COUNTER:TRUE
DTSTAMP:20121013T140003Z
SEQUENCE:0
END:VEVENT
END:VCALENDAR
invite.ics
File: application/ics