Scammers trying to catch me out?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Nov 14, 2007 7:18 pm

Evening all,

Ive got a bait going to a guy in the US at the moment. When i use the ip locator it comes up with a map of Witchita in Kansas....nothing odd yet.

Today i received another fresh proposal from another scammer, so before replying i checked out his ip address and guess what?.....Witchita, Kansas.

Both email addresses are from different providers so can i rule out any kind of internet routing station thingy - like somewhere that sends the emails overseas (Do you know what i mean?)? or is there a possiblity that this is the same scammer running a seperate scam (probably to others as well) to try and see if he can catch me out because he thinks i may reply to both?

I hope this makes sense!!

Cheers all

TP

Posted: Wed Nov 14, 2007 7:29 pm

I'd consider letting the 2nd one go ignored. BTW it's Wichita.... I live not too far from there.

Posted: Wed Nov 14, 2007 7:33 pm

Sometiimes you get a relay server that does routing for multiple providers.
I wouldn't rule that out yet.
If you want to post your message headers, maybe we can put another pair of eyes on it, and see if there's something recognizable.

Posted: Wed Nov 14, 2007 7:36 pm

Mod Edit: Full requote of previous post removed. See it here ^^^^

If i post the headers on here - doesnt that make them googleable?

Oh, sorry for getting the name wrong!! honest mistake....TP

Posted: Wed Nov 14, 2007 8:09 pm

^^There's only a tiny tiny tiny tiny chance your lad will google anything that shows up in his header. You can delete his and your addy.

Posted: Wed Nov 14, 2007 9:47 pm

Don't worry about it being googled. Post the Headers and maybe somebody can figure out what is going on. Wichita is rather poor city, no offense to anyone that lives there I have had a few friends living there, so it wouldn't surprise me if there are scammers there, but I doubt that they are.

Posted: Wed Nov 14, 2007 11:00 pm

Templeton Peck wrote:

... or is there a possiblity that this is the same scammer running a seperate scam (probably to others as well) to try and see if he can catch me out because he thinks i may reply to both?

Happens all the time. If you keep your story consistent in replying to both, and it is the same lad, you can get him to chop his own dolla, which is nice! Twisted Evil

Posted: Thu Nov 15, 2007 7:20 am

This header is from my active bait

Quote:

From tim McCARRON Fri Nov 9 11:04:58 2007
Return-Path:
Authentication-Results: mta110.mail.ukl.yahoo.com from=hotmail.com; domainkeys=neutral (no sig)
Received: from 65.54.246.237 (EHLO bay0-omc3-s37.bay0.hotmail.com) (65.54.246.237)
by mta110.mail.ukl.yahoo.com with SMTP; Fri, 09 Nov 2007 11:15:44 +0000
Received: from BAY136-W8 ([65.55.141.43]) by bay0-omc3-s37.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 9 Nov 2007 03:04:58 -0800
Message-ID: <[email protected]>
Return-Path:
Content-Type: multipart/alternative;
boundary="_b2026c09-85c5-4242-9754-c4af8400949c_"
Reply-To:
From:
To:
Subject: URGENT
Date: Fri, 9 Nov 2007 04:04:58 -0700
Importance: Normal
MIME-Version: 1.0
Content-Length: 2489

and this is from the email i received yesterday

[/quote]From Wed Nov 14 18:06:32 2007
Return-Path:
Authentication-Results: mta140.mail.ukl.yahoo.com from=yahoo.de; domainkeys=neutral (no sig)
Received: from 209.239.36.229 (EHLO host4.oneononeinternet.com) (209.239.36.229)
by mta140.mail.ukl.yahoo.com with SMTP; Wed, 14 Nov 2007 18:11:56 +0000
Received: from localhost.localdomain (localhost [127.0.0.1])
by host4.oneononeinternet.com (8.12.11.20060614/8.12.10) with ESMTP id lAEI6Wmt010699;
Wed, 14 Nov 2007 13:06:32 -0500
From:
Reply-To:
Subject: INHERITANCE PAYMENT NOTIFICATION
Date: Wed, 14 Nov 2007 14:06:32 -0400
Message-Id: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset=iso-8859-1
Content-Length: 3193[/quote]

**Email addresses have been removed**

Both are coming from Wichita according to www.ip-adress.com

See whay you all think.

Cheers

TP

Posted: Thu Nov 15, 2007 7:54 am

I am no IP address expert but I get

65.55.141.43 for the first one which leads to here

City: Redmond
StateProv: WA
PostalCode: 98052
Country: US

I would guess this is microsoft corp

And

8.12.11.200 for the second one which seems to be here

City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

Dont take my word for it but to me it looks like 2 different people.

I wouldn't be surprised if someone is just about to come along and tell me I am wrong.

Even if they are different people in different locations it still could be the same group.

You could also try sending an ASEM to the second one from a different addy and see what happens

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

I agree with the first, it's a Hotmail server. That seems odd, because I didn't think Hotmail hid IP addresses. Maybe it was spoofed, but that would be unusual in an ongoing bait.

Quote:

Received: from BAY136-W8 ([65.55.141.43]) by bay0-omc3-s37.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);

The IP address there is a look-up by the server to find the IP address that BAY136-W8 refers to. However it is not necessarily the IP address that actually connected to it (unless someone knows MS SMTPSVC better than I do.)

Your second IP there is a date and time.

It comes from OneOnOne Internet, who appear to hide the IP address too.

Quote:

Received: from localhost.localdomain (localhost [127.0.0.1])
by host4.oneononeinternet.com (8.12.11.20060614/8.12.10) with ESMTP id lAEI6Wmt010699;

Like the first, it reports the name that the lad's PC identified itself as, and it reports what IP address that name relates to. But it doesn't report the IP address that the lad used. banghead

If we accept that the IP addresses given are correct, then someone has hacked a Hotmail server and a OneOnOne Internet server. That doesn't seem likely.

Posted: Thu Nov 15, 2007 9:23 am

IP address: 65.55.141.43
IP country: United States
IP Address state:
IP Address city:
IP latitude: 38.0000
IP longitude: -97.0000
ISP: Microsoft Corp
Organization: Microsoft Corp
Host: bay136-w8.bay136.hotmail.com

IP address: 8.12.11.200
IP country: United States
IP Address state:
IP Address city:
IP latitude: 38.000000
IP longitude: -97.000000
ISP: Level 3 Communications
Organization: Level 3 Communications

I got both resolved to NW120th Street and NW River Valley Road, between Route 196 and Route 77
On Google earth it looks like farmland there, Transmission tower possibly, I'm picking a Sat bounce to the Network. Your lad could be anywhere,

edit: I missed this , our old friend IP address: 127.0.0.1 it's the Gilat Sat off the coast of Ghana, serving Nigeria, Ghana, Benin etc. Your lad is probably in Nigeria.

edit, if you google mta110.mail.ukl.yahoo.com it takes you to the romance anti scammers site

Posted: Thu Nov 15, 2007 2:41 pm

I agree with the first is a hotmail server.
The second server net name (oneononeinternet.com) resolves to the 209.239.36.229 address.

Quote:

IP address: 209.239.36.229
Host name: host4.oneononeinternet.com
209.239.36.229 is from United States(US) in region North America

NetRange: 209.239.32.0 - 209.239.63.255
CIDR: 209.239.32.0/19
NetName: ALABANZA-BALT-1
(Baltimore MD)

The 8.12.11.x range resolves to just outside of Wichita KS (Satellite IP).
The 127.0.0.1 is the loopback address of the gateway server of the 8.12.11.x net.

Quote:

Received: from 209.239.36.229 (EHLO host4.oneononeinternet.com) (209.239.36.229)
by mta140.mail.ukl.yahoo.com with SMTP; Wed, 14 Nov 2007 18:11:56 +0000
Received: from localhost.localdomain (localhost [127.0.0.1])
by host4.oneononeinternet.com (8.12.11.20060614/8.12.10) with ESMTP id lAEI6Wmt010699;
Wed, 14 Nov 2007 13:06:32 -0500

I think the lad is posting from an account that is served by a domain that hides the workstation IP, much like Gmail.
It's a sat bounce to the tower in KS, the net servers are in Baltimore.

In short, the lad could be anywhere.

Posted: Thu Nov 15, 2007 2:52 pm

For addies that hide IPs, you can send an email through readnotify.com and track it that way. You can sign up for a free two week trial there. (Thank Jojobean for that tip.)

My money is on West Africa for your lad(s), but I'll keep an open mind. Wink

Posted: Fri Nov 16, 2007 2:55 am

@ Templeton Peck, I liked your work on A-Team as Face. I even recognized the line in your Location line. Thanks for the memory! Wink

Murry Guru wrote:

City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

My IP regularly resolves to this location. I am 300 miles away from there (and I am not in Kansas). If "Faceman" checks often he will see that the IP location is dynamic in Eastern Colorado. Often it shows up in Hudson, Broomfield, Parker and a couple other cities.

irishemigrant wrote:

ISP: Level 3 Communications
Organization: Level 3 Communications

My ISP also uses Level 3 Communications, though the actual ISP is NOT Level 3.

Thank you Al Coholic for teaching me this. Very Happy

Scammers trying to catch me out?	View next topic View previous topic