An
Email with the Subject "Fwd: MR HENRY ALLEN" was
received in one of Scamdex's honeypot email accounts on Fri, 29 Feb 2008 09:05:45 -0800
and has been classified as a Generic Scam Email.
The sender shows as Marty Ellingwood <marty_ellingwood@yahoo.com>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
nigeriaafrican05 million us dollars million ivorydiednext of kindeceasedbankexpressmicrosoftbidcontactnumbersaccountclaim milliontransactionstaffcustomer40%business transfercustomfundmailbank bank accountdollar your bank commercial bank his bank abidjanmarty_ellingwood@yahoo.comhenry_allenn@yahoo.plhenry_allenn@yahoo.plihenry_allenn@yahoo.plbestdie will spamyahoo.comyahoofyahoo.yahoo!ach(no sig)(ehlo mail2.mx.core.com) ...(postfix, from userid 1000)(est)(version 3.1.7-deb)(2006-10-05)(if it isn't spam)(ivory coast)(ivory cost)($22.5 million us dollars)[...](14.0 points, 10.0 required)(nigerian 419)(authsmtp.core.com [216.9...(postfix)(est)received: from justi...(authenticated bits=0)(8.12.3/8.12.4)[private phone numbers] mr henry allen mr henry allendate: mr henry allen, mr markgarcia who ms outlookreturn-path: &... mr mark garcia mr mr markfinancial
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => submitted@scamdex.com
[delivery-date:] => Fri, 29 Feb 2008 09:05:45 -0800
[received:] => Array
(
[0] => from web55412.mail.re4.yahoo.com ([206.190.58.206])by bartok.o7e.net with smtp (Exim 4.68)(envelope-from )id 1JV8fx-0007CY-OTfor submitted@scamdex.com; Fri, 29 Feb 2008 09:05:45 -0800
[1] => (qmail 76314 invoked by uid 60001); 29 Feb 2008 17:05:28 -0000
[2] => from [71.210.227.144] by web55412.mail.re4.yahoo.com via HTTP; Fri, 29 Feb 2008 09:05:27 PST
)
[domainkey-signature:] => a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=GF+KTrW+64MT9gQdPGd6lpjf+ZFKcPwJF1DlNQ3MUbvHI3wLzvPhYHAkjHowb4PdVNIkEpLOtEKzVSnmxWXIsXuqm7nf8EBLE4hKe2H7kGmTa+kGEn/2myjNMpjV3UKVEbnR0Qs3T7Ki0jpVhRRnHt6TrrhxPHuJRU4pDKwB/XE=;
[x-ymail-osg:] => xOGg1SgVM1lqis6jUBU2VGlXcnfMGQa2yzaWO20oPQ8Rl4JbqQbzktDR57499Qim.3qx_Ar9nCKWkzgedBA4g_i_MIgmgMNKz6uObjJ7rbTD3Fvibq94eaX53kPZ4bL5kGMfDYm1oFg.czqx2Buf0Xs4
[date:] => Fri, 29 Feb 2008 09:05:27 -0800 (PST)
[from:] => Marty Ellingwood
[subject:] => Fwd: MR HENRY ALLEN
[to:] => "ScamDex.com"
[mime-version:] => 1.0
[content-type:] => multipart/alternative; boundary="0-1480263518-1204304727=:69675"
[content-transfer-encoding:] => 8bit
[x-mailer:] => <79549.69675.qm@web55412.mail.re4.yahoo.com>
[x-spam-status:] => No, score=2.0
[x-spam-score:] => 20
[x-spam-bar:] => ++
[x-spam-flag:] => NO
[message-id:] =>
[x-scamdex-scores:] => S:75 P:59 A:63 L:61 E:63 G:57
[x-scamdex-classtype:] => S
[x-scamdex-classscore:] => 75
[x-scamdex-totscore:] => 378
[x-scamdex-kw:] => kin ,\%,account,africa,bank,business,check,claim,contact,customer,deceased,die,dollars,fund,inc.,million,mobil,nigeria,numbers,sent,staff,transaction
[x-scamdex-em:] => henry_allenn@yahoo.pl,henry_allenn@yahoo.plBE,henry_allenn@yahoo.plI,henryallenn@sify.com,henryallenn@terra.com,m1T528k5015396@authsmtp.core.com,marty_ellingwood@yahoo.com
[x-scamdex-dir:] => S
[x-scamdex-id:] => S1207457826.M515026P12833V
[x-scamdex-copyright:] => This Email is Copyright Scamdex.com 2009, Reproduction Prohibited
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. Try it now.
ALLEN <henryallenn@sify.com> wrote: X-Apparently-To: marty_ellingwood@yahoo.com via 206.190.58.195; Thu, 28 Feb 2008 21:20:27 -0800 X-YahooFilteredBulk: 216.93.66.92 X-Originating-IP: [216.93.66.92] Return-Path: <henryallenn@sify.com> Authentication-Results: mta100.mail.re4.yahoo.com from=sify.com; domainkeys=neutral (no sig) Received: from 216.93.66.92 (EHLO mail2.mx.core.com) (216.93.66.92) by mta100.mail.re4.yahoo.com with SMTP; Thu, 28 Feb 2008 21:20:24 -0800 Received: by mail2.mx.core.com (Postfix, from userid 1000) id 217473FADC9; Fri, 29 Feb 2008 00:50:14 -0500 (EST) Received: from localhost by mail2.mx.core.com with SpamAssassin (version 3.1.7-deb); Fri, 29 Feb 2008 00:50:13 -0500 From: "ALLEN"<henryallenn@sify.com> To: undisclosed-recipients:; Subject: MR HENRY ALLEN Date: Fri, 29
Feb 2008 05:02:25 -0000 Message-Id: <200802290502.m1T528k5015396@authsmtp.core.com> X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.7-deb (2006-10-05) on mail2.mx.core.com X-Spam-Level: ************** X-Spam-Status: Yes, score=14.0 required=10.0 tests=ADVANCE_FEE_1, ADVANCE_FEE_2,ADVANCE_FEE_3,FORGED_MUA_OUTLOOK,NA_DOLLARS, NO_REAL_NAME,SUBJ_ALL_CAPS,UNDISC_RECIPS,UPPERCASE_75_100,lnc_NOK autolearn=disabled version=3.1.7-deb MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------=_47C79D15.2CCD0810" Content-Length: 5198
Spam detection software, running on the system "mail2.mx.core.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details.
Content preview: MR HENRY ALLEN ABIDJAN COTE
D'IVORE(IVORY COAST) henry_allenn@yahoo.pl I AM MR HENRY ALLEN, A STAFF OF ONE OF THE COMMERCIAL BANK IN ABIDJAN COTE D'IVOIR(IVORY COST)I HAVE A BUSINESS WHICH WILL BE BENEFICIAL TO BOTH OF US. THE AMOUNT OF MONEY INVOLVED IS ($22.5 MILLION US DOLLARS) WHICH I WANT TO TRANSFER OUT OF THIS COUNTRY TO YOUR BANK ACCOUNT, ALL TO OUR FINANCIAL BENEFIT. THIS MONEY WAS OWNED BY ONE OF THE CUSTOMER IN OUR BANK.THE MAN'S NAME IS CALLED MR MARK GARCIA WHO LEAVE AND DIE IN This country. A BUSINESS COMMERCIALIST IN WEST-AFRICAN REGIONS. HE HAS BEEN DEAD SINCE NEARLY SEVEN YEARS AGO. HE DIED ON HIS WAY TO THE AIRPORT ON ONE OF HIS BUSINESS TRIP WITH ALL HIS FAMILY MEMBERS. [...]
pts rule name description ---- ---------------------- -------------------------------------------------- 0.6 NO_REAL_NAME From: does not include a real name 0.9 UNDISC_RECIPS Valid-looking To
"undisclosed-recipients" 1.2 SUBJ_ALL_CAPS Subject is all capitals 4.0 lnc_NOK BODY: next of kin 0.6 NA_DOLLARS BODY: Talks about a million North American dollars 1.0 UPPERCASE_75_100 message body is 75-100% uppercase 1.8 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419) 0.0 ADVANCE_FEE_1 Appears to be advance fee fraud (Nigerian 419) 0.6 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419) 3.4 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Return-Path: <henryallenn@sify.com> Received: from authsmtp.core.com (authsmtp.core.com [216.93.66.70]) by mail2.mx.core.com (Postfix) with ESMTP id 8002D3FA77C; Fri, 29 Feb 2008 00:50:12 -0500 (EST) Received: from justice ([41.207.17.138]) (authenticated bits=0) by authsmtp.core.com (8.12.3/8.12.4) with ESMTP id m1T528k5015396; Fri, 29 Feb 2008 00:02:09 -0500 (EST) Message-Id:
<200802290502.m1T528k5015396@authsmtp.core.com> Reply-to: <henryallenn@terra.com> From: "ALLEN"<henryallenn@sify.com> Subject: MR HENRY ALLEN Date: Fri, 29 Feb 2008 05:02:25 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 To: undisclosed-recipients:;
MR HENRY ALLEN ABIDJAN COTE D'IVORE(IVORY COAST) henry_allenn@yahoo.pl
I AM MR HENRY ALLEN, A STAFF OF ONE OF THE COMMERCIAL BANK IN ABIDJAN COTE D'IVOIR(IVORY COST)I HAVE A BUSINESS WHICH WILL BE BENEFICIAL TO BOTH OF US. THE AMOUNT OF MONEY INVOLVED IS ($22.5 MILLION US DOLLARS) WHICH I WANT TO TRANSFER OUT OF THIS COUNTRY TO YOUR BANK ACCOUNT, ALL TO OUR FINANCIAL BENEFIT. THIS MONEY WAS OWNED BY ONE OF THE CUSTOMER IN OUR BANK.THE MAN'S NAME
IS CALLED MR MARK GARCIA WHO LEAVE AND DIE IN This country. A BUSINESS COMMERCIALIST IN WEST-AFRICAN REGIONS. HE HAS BEEN DEAD SINCE NEARLY SEVEN YEARS AGO. HE DIED ON HIS WAY TO THE AIRPORT ON ONE OF HIS BUSINESS TRIP WITH ALL HIS FAMILY MEMBERS.
AND SINCE THEN, NO ONE HAS COME EITHER AS HIS NEXT OF KIN OR FAMILY MEMBERS TO LAY CLAIM TO HIS BANK ACCOUNT AND PROPERTY, NOW I WANT TO TRANSFER THIS MONEY OUT OF THIS COUNTRY BUT SUCH FUND CAN NOT BE TRANSFERRED WITHOUT A NEXT OF KIN ATTACHED TO IT.
THIS FUND COULD BE TRANSFERRED IN THESE WAY,YOU SHALL PRESENT YOURSELF AS A RELATIVE OF THE DECEASED OR HIS NEXT OF KIN. AS DETAILS SHALL BE THAT YOU ARE THE CARE-TAKER BUSINESS ASSOCIATES? OF MR MR MARK GARCIA AND HIS PROPERTIES.
I SHALL MAKE AVAILABLE TO YOU MATERIALS AND INFORMATION WITH WHICH A SUCCESSFUL CLAIM SHALL BE PLACED ON THE FUND. I SHALL BE YOUR GUIDIANCE AND INSTRUCTOR THROUGHOUT THE DURATION OF THIS TRANSACTION SO AS TO ENSURE A SWIFT AND SURE
TRANSFER OF THE FUND TO YOUR BANK ACCOUNT.
I WANT YOU ALSO KNOW THAT THIS IS A DEAL WHICH I WANT YOU TO TREAT WITH ALL URGENCE, THAT IS THE REASON WHY I HAVE CONTACT YOU.
AS TO YOUR BENEFITS, YOU SHALL BE ENTITLED TO 40% OF THIS FUND FOR YOUR COOPERATION IN THIS TRANSACTION. SO IF YOU ARE INTERESTED,SEND A REPLY TO ME IMMEDIATELY AND IN YOUR REPLY PLEASE INCLUDE YOUR [PRIVATE PHONE NUMBERS] URGENCY HAS TO BE IMPLIED AND THIS BUSINESS MUST STRICTLY BE A DEAL BETWEEN BOTH OF US PLEASE CONTACT ME ON MY PRIVATE EMAILL ADDRESS BELOW.
THANKS AND HAVE A GOOD DAY.
henry_allenn@yahoo.pl BEST REGARDS, MR HENRY ALLEN
Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. Try it now.