An
Email with the Subject "FROM SGT. MATTHEW PEMBLE" was
received in one of Scamdex's honeypot email accounts on Sat, 26 Feb 2011 16:57:03 -0800
and has been classified as a Advance Fee Fraud/419 Scam Email.
The sender shows as "FROM SGT. MATTHEW PEMBLE" <mr.jerryntai@hotmail.com.hk>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
saddamkilledassistance$16 million u.s. dollars million united states do...diedsoldcontactsafejoy millionstaffserviceiraqurgentlegalsecuremailpackagesharedollarconfidentialdie will godach(staff sgt.)($16 million u.s. dollars)for assistance
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => scams@scamdex.com
[delivery-date:] => Sat, 26 Feb 2011 16:57:03 -0800
[received:] => Array
(
[0] => from mail.ltoscas.com.ar([200.43.197.4] helo=ltoscas.com.ar ident=qmailr)by chester.loopbiz.com with smtp (Exim 4.69)(envelope-from )id 1PtUwX-0001uz-NNfor scams@scamdex.com; Sat, 26 Feb 2011 16:57:03 -0800
[1] => (qmail 3699 invoked by uid 453); 25 Feb 2011 22:04:11 -0000
[2] => from localhost (HELO localhost) (127.0.0.1) by ltoscas.com.ar (qpsmtpd/0.40) with ESMTP; Fri, 25 Feb 2011 19:04:11 -0300
[3] => from 41.203.64.252 ([41.203.64.252]) by webmail.ltoscas.com.ar(Horde Framework) with HTTP; Fri, 25 Feb 2011 19:04:05 -0300
)
[x-virus-checked:] => Checked by ClamAV on ltoscas.com.ar
[message-id:] => <20110225190405.731747s8ncbcfvwg@webmail.ltoscas.com.ar>
[date:] => Fri, 25 Feb 2011 19:04:05 -0300
[from:] => "FROM SGT. MATTHEW PEMBLE"
[reply-to:] => sgt.matthewpemble@hotmail.com
[to:] => undisclosed-recipients:;
[subject:] => FROM SGT. MATTHEW PEMBLE
[mime-version:] => 1.0
[content-type:] => text/plain;charset=ISO-8859-1;DelSp="Yes";format="flowed"
[content-disposition:] => inline
[content-transfer-encoding:] => 7bit
[user-agent:] => Internet Messaging Program (IMP) H3 (4.3.5)
[x-spam-subject:] => ***SPAM*** FROM SGT. MATTHEW PEMBLE
[x-spam-status:] => Yes, score=4.9
[x-spam-score:] => 49
[x-spam-bar:] => ++++
[x-spam-report:] => Spam detection software, running on the system "chester.loopbiz.com", hasidentified this incoming email as possible spam. The original messagehas been attached to this so you can view it (if it isn't spam) or labelsimilar future email. If you have any questions, seethe administrator of that system for details.Content preview: FROM SGT. MATTHEW PEMBLE READ CAREFULLY AND REPLY URGENT.HOW ARE YOU AND YOUR FAMILY? HOPE ALL IS WELL? I BRING GOOD NEWS FROM THECAVES OF WAR FOR FREEDOM TO MY NATION. [...] Content analysis details: (4.9 points, 4.0 required)pts rule name description---- ---------------------- --------------------------------------------------1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net[Blocked - see ]-3.0 MILLION_USD BODY: Talks about millions of dollars-2.0 NA_DOLLARS BODY: Talks about a million North American dollars0.0 FREEMAIL_FROM Sender email is freemail(mr.jerryntai[at]hotmail.com.hk)1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT[200.43.197.4 listed in bb.barracudacentral.org]2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL[200.43.197.4 listed in psbl.surriel.com]1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)-2.0 SUBJ_ALL_CAPS Subject is all capitals0.0 LOTS_OF_MONEY Huge... sums of money-1.0 UPPERCASE_75_100 message body is 75-100% uppercase0.0 T_HK_NAME_FM_FROM T_HK_NAME_FM_FROM2.8 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain differentfreemails0.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)0.0 T_TO_NO_BRKTS_FREEMAIL T_TO_NO_BRKTS_FREEMAIL0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money0.5 MONEY_FRAUD_5 Lots of money and many fraud phrases1.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
[x-spam-flag:] => YES
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
FROM SGT. MATTHEW PEMBLE
READ CAREFULLY AND REPLY URGENT.
THE CAVES OF WAR FOR FREEDOM TO MY NATION.
SERVING IN THE MILITARY WITH THE ARMY'S 3RD INFANTRY DIVISION. WITH A
CONTACT YOU.
YOUR KIND ASSISTANCE TO MOVE THE SUM OF ($16 MILLION U.S. DOLLARS)
ASSURED THAT MY SHARE WILL BE SAFE IN YOUR CARE UNTIL I COMPLETE MY
SOURCE OF MONEY:
FARMHOUSE NEAR ONE OF SADDAM'S OLD PALACES IN TIKRIT-IRAQ DURING A
PART OF THIS MONEY BE SHARED AMONG BOTH OF US BEFORE INFORMING ANYBODY
ILLEGAL THING TO DO,BUT I TELL YOU WHAT? NO COMPENSATION CAN MAKE UP
MY BROTHER IN-LAW WAS KILLED BY A ROAD SIDE BOMB LAST TIME THE ABOVE
AS MY SHARE, AND TO CONCEAL THIS KIND OF MONEY BECAME A PROBLEM FOR
ENJOY SOME IMMUNITY,I WAS ABLE TO GET THE PACKAGE OUT TO A SAFE
CONTENTS OF THE PACKAGE, AND BELIEVES THAT IT BELONGS TO A
BEFORE GIVING UP, TRUSTED ME TO HAND OVER THE PACKAGE TO HIS FAMILY IN
TO YOU AT HOME FOR YOU TO PICK UP, AND I WILL DISCUSS THIS WITH YOU
MY MONEY WILL BE WELL SECURED IN YOUR HAND BECAUSE YOU HAVE FEAR OF GOD.
ASSISTANCE YOU WILL GIVE TO ME. ONE PASSIONATE APPEAL I WILL MAKE TO
REASONS TO REJECT THIS OFFER, PLEASE AND PLEASE DESTROY THIS MESSAGE
HERE IN IRAQ. I DO NOT KNOW HOW LONG WE WILL REMAIN HERE, MONTH OF MAY
HAVE BEEN SHOT,WOUNDED AND SURVIVED TWO SUICIDE BOMB ATTACKS BY THE
OUT FOR HELP, I HONESTLY WANT THIS MATTER TO BE RESOLVED IMMEDIATELY,
ADDRESS THAT IS FOR COMMUNICATION CONFIDENTIAL PURPOSE ONLY.
FROM SGT. MATTHEW PEMBLE
READ CAREFULLY AND REPLY URGENT.
HOW ARE YOU AND YOUR FAMILY? HOPE ALL IS WELL? I BRING GOOD NEWS FROM
THE CAVES OF WAR FOR FREEDOM TO MY NATION.
MY NAME IS (STAFF SGT.) MATTHEW PEMBLE; I AM AN AMERICAN SOLDIER,
SERVING IN THE MILITARY WITH THE ARMY'S 3RD INFANTRY DIVISION. WITH A
VERY DESPERATE NEED FOR ASSISTANCE, I HAVE SUMMED UP COURAGE TO
CONTACT YOU.
I FOUND YOUR CONTACT PARTICULARS IN AN ADDRESS JOURNAL. I AM SEEKING
YOUR KIND ASSISTANCE TO MOVE THE SUM OF ($16 MILLION U.S. DOLLARS)
SIXTEEN MILLION UNITED STATES DOLLARS TO YOU, AS FAR AS I CAN BE
ASSURED THAT MY SHARE WILL BE SAFE IN YOUR CARE UNTIL I COMPLETE MY
SERVICE HERE.
SOURCE OF MONEY:
SOME MONEY IN VARIOUS CURRENCIES WERE DISCOVERED IN BARRELS AT A
FARMHOUSE NEAR ONE OF SADDAM'S OLD PALACES IN TIKRIT-IRAQ DURING A
RESCUE OPERATION, IT WAS AGREED BY STAFF SGT MARK BAFF AND I THAT SOME
PART OF THIS MONEY BE SHARED AMONG BOTH OF US BEFORE INFORMING ANYBODY
ABOUT IT SINCE BOTH OF US SAW THE MONEY FIRST. THIS WAS QUITE AN
ILLEGAL THING TO DO,BUT I TELL YOU WHAT? NO COMPENSATION CAN MAKE UP
FOR THE RISK WE HAVE TAKEN WITH OUR LIVES IN THIS HELL HOLE. OF WHICH
MY BROTHER IN-LAW WAS KILLED BY A ROAD SIDE BOMB LAST TIME THE ABOVE
FIGURE WAS GIVEN TO ME
AS MY SHARE, AND TO CONCEAL THIS KIND OF MONEY BECAME A PROBLEM FOR
ME, SO WITH THE HELP OF A BRITISH CONTACT WORKING HERE AND HIS OFFICE
ENJOY SOME IMMUNITY,I WAS ABLE TO GET THE PACKAGE OUT TO A SAFE
LOCATION ENTIRELY OUT OF TROUBLE SPOT. HE DOES NOT KNOW THE REAL
CONTENTS OF THE PACKAGE, AND BELIEVES THAT IT BELONGS TO A
BRITISH/AMERICAN MEDICAL DOCTOR WHO DIED IN A RAID HERE IN IRAQ, AND
BEFORE GIVING UP, TRUSTED ME TO HAND OVER THE PACKAGE TO HIS FAMILY IN
UNITED STATES.
I HAVE NOW FOUND A VERY SECURED WAY OF GETTING THE PACKAGE OUT OF IRAQ
TO YOU AT HOME FOR YOU TO PICK UP, AND I WILL DISCUSS THIS WITH YOU
WHEN I AM SURE THAT YOU ARE WILLING TO ASSIST ME, AND I BELIEVE THAT
MY MONEY WILL BE WELL SECURED IN YOUR HAND BECAUSE YOU HAVE FEAR OF GOD.
I WANT YOU TO TELL ME HOW MUCH YOU WILL TAKE FROM THIS MONEY FOR THE
ASSISTANCE YOU WILL GIVE TO ME. ONE PASSIONATE APPEAL I WILL MAKE TO
YOU IS NOT TO DISCUSS THIS MATTER WITH ANYBODY, SHOULD YOU HAVE
REASONS TO REJECT THIS OFFER, PLEASE AND PLEASE DESTROY THIS MESSAGE
AS ANY LEAKAGE OF THIS INFORMATION WILL BE TOO BAD FOR US SOLDIER'S
HERE IN IRAQ. I DO NOT KNOW HOW LONG WE WILL REMAIN HERE, MONTH OF MAY
WAS THE DEADLIEST MONTH FOR US OUT HERE.TOTALLY, WE LOST 127 MEN AND I
HAVE BEEN SHOT,WOUNDED AND SURVIVED TWO SUICIDE BOMB ATTACKS BY THE
SPECIAL GRACE OF GOD.
THIS AND OTHER REASONS I WILL MENTION LATER HAS PROMPTED ME TO REACH
OUT FOR HELP, I HONESTLY WANT THIS MATTER TO BE RESOLVED IMMEDIATELY,
PLEASE FURTHER CORRESPONDANCE TO ME SHOULD BE TO MY PRIVATE EMAIL
ADDRESS THAT IS FOR COMMUNICATION CONFIDENTIAL PURPOSE ONLY.
email : sgt.matthewpemble@hotmail.com
GOD BLESS YOU AND YOUR FAMILY.
SGT MATTHEW PEMBLE