this lad is in the u.s.

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Not quite a Newb Joined: 08 Nov 2008 Posts: 43

People, I need help getting this guy shut down. He is in the u.s. I want him to be caught. The i.p. shows a comcast.net i.p. and comcast should have his address on record.
Delivered-To:
Received: by 10.181.50.13 with SMTP id c13cs190056bkk;
Mon, 24 Nov 2008 16:50:26 -0800 (PST)
Received: by 10.150.219.18 with SMTP id r18mr8107088ybg.50.1227574225228;
Mon, 24 Nov 2008 16:50:25 -0800 (PST)
Return-Path: <[email protected]>
Received: from QMTA02.westchester.pa.mail.comcast.net (qmta02.westchester.pa.mail.comcast.net [76.96.62.24])
by mx.google.com with ESMTP id 6si12712718gxk.75.2008.11.24.16.50.23;
Mon, 24 Nov 2008 16:50:25 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 76.96.62.24 as permitted sender) client-ip=76.96.62.24;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 76.96.62.24 as permitted sender) [email protected]
Received: from OMTA13.westchester.pa.mail.comcast.net ([76.96.62.52])
by QMTA02.westchester.pa.mail.comcast.net with comcast
id jA9D1a00M17dt5G52Cpt9e; Tue, 25 Nov 2008 00:49:53 +0000
Received: from amailcenter01.comcast.net ([204.127.225.101])
by OMTA13.westchester.pa.mail.comcast.net with comcast
id jCqH1a0092BtKCC3ZCqH4r; Tue, 25 Nov 2008 00:50:22 +0000
X-Authority-Analysis: v=1.0 c=1 a=9gcvaYQOSA8A:10 a=JArQ0ooXjKsA:10
a=I815Vq00yxIA:10 a=8Vn9EmQ7Df4rq_GTDeUA:9 a=cj5-G3zahZf3fgm7J6IxrfTq6CIA:4
a=c5zHXd76wwQA:10 a=W4p2O1RRCiKvpHYRjpyNxtl0mxk=:19
Received: from [41.219.244.46] by amailcenter01.comcast.net;
Tue, 25 Nov 2008 00:50:16 +0000
From: [email protected]
Subject: Question about your item in www.craigslist.org
Date: Tue, 25 Nov 2008 00:50:16 +0000
Message-Id: <112520080050.18979.492B4BC70005BB8200004A232212020784CD0A0207009C070A03CD09020705040E9B@comcast.net>
X-Mailer: AT&T Message Center Version 1 (Oct 30 2007)
X-Authenticated-Sender: dGFsa2luZzJtZWlzZmluZTJAY29tY2FzdC5uZXQ=

--
Hello Seller,

Is this item still available for sale and in good condition? I will like to make an immediate purchase of the item if still available and will be making the payment by a Bank certified check , I am comfortable with the price for the item and will make the payment as soon as possible.

If you are willing to sell this item for me understand this condition, you should get back to me with your full name and address and also your phone# so i can have the payment mailed to you, also get back to me with the final asking price so I can be sure i am making the precise payment while making the payment. A pick up of the item will be schedule as soon as the payment process for item is been completed. I await your response asap.

Name:
Address:
City:
state:
Zipcode:
phone#
Final asking price:

I await your reply................

Posted: Sat Dec 27, 2008 3:24 am

Strange I get 41.219.244.46 Nigeria (Ibadan)*

Baiting Guru Joined: 07 Jan 2007 Posts: 2922

^^^

Me too...

Not quite a Newb Joined: 19 Nov 2007 Posts: 65

Regardless of where he is, however, the comcast.net email means his paying for Comcast service. So you could get his internet service shut down, oh what a trophy that would be, Under Comcast's TOS Restrictions it says:

I. Prohibited Uses and Activities from Comcast wrote:

undertake or accomplish any unlawful purpose. This includes, but is not limited to, posting, storing, transmitting or disseminating information, data or material which is libelous, obscene, unlawful, threatening or defamatory, or which infringes the intellectual property rights of any person or entity, or which in any way constitutes or encourages conduct that would constitute a criminal offense, or otherwise violate any local, state, federal, or non-U.S. law, order, or regulation;
post, store, send, transmit, or disseminate any information or material which a reasonable person could deem to be unlawful;
upload, post, publish, transmit, reproduce, create derivative works of, or distribute in any way information, software or other material obtained through the Service or otherwise that is protected by copyright or other proprietary right, without obtaining any required permission of the owner;
transmit unsolicited bulk or commercial messages commonly known as "spam;"
send very large numbers of copies of the same or substantially similar messages, empty messages, or messages which contain no substantive content, or send very large messages or files that disrupts a server, account, newsgroup, or chat service;
initiate, perpetuate, or in any way participate in any pyramid or other illegal scheme;
participate in the collection of very large numbers of e-mail addresses, screen names, or other identifiers of others (without their prior consent), a practice sometimes known as spidering or harvesting, or participate in the use of software (including "spyware") designed to facilitate this activity;
collect responses from unsolicited bulk messages;
impersonate any person or entity, engage in sender address falsification, forge anyone else's digital or manual signature, or perform any other similar fraudulent activity (for example, "phishing");
violate the rules, regulations, or policies applicable to any network, server, computer database, or Web site that you access;

So in theory with some work you could get comcast to kill his internet access, and possibly blackball him from other providers. Although the later is much less likely.

Posted: Sat Dec 27, 2008 5:55 am

Fich80 wrote:

Regardless of where he is, however, the comcast.net email means his paying for Comcast service. So you could get his internet service shut down, oh what a trophy that would be,

How would getting a lad's email account closed be a trophy?

I also might add that absolutely nothing in the body of that email even remotely appears to be anything other than a genuine reply from an interested/potential buyer.

While it is a fairly reasonable assumption for a baiter to make that the buyer (lad) will soon turn this into a fake check/overpayment scam, Comcast is going to assume that you're a nutter if you try to get a paid email account shut down for the content of the email in the OP.

EDIT>> If you can get the lad to follow through with his scam you can try to get his paid account closed, but you will need enough to convince Comcast that he is scamming from that account. He may try to switch to a free email addy if he's had a paid addy closed before.

Posted: Sat Dec 27, 2008 6:31 am

ditto to what jose says.... ^^^^

Not quite a Newb Joined: 08 Nov 2008 Posts: 43

Obviously he said "a pickup of the item will happen after payment has been received" and that is obviously supicous because if someone sends me a check, they can expect me to mail the item to them not have them come to my door. That is like invasion of privacy and risky and dangerous. How do I know he is not a serial killer or someone looking to randomly shoot people. Use your common sense Eliza and Jose.

Posted: Sat Dec 27, 2008 8:05 am

How do I (or anyone else for that matter) know what you're selling??? It just says "item". Are you selling a pencil or a 20 ton WWII surplus tank?

While the first could be easily sent via mail, I think the latter would have to be collected by other means.

I AGREE THAT YOU ARE DEALING WITH A LAD!

I'm only suggesting that you provide credible evidence, to Comcast, that the lad is scamming from the account in question so they will close it.

Not quite a Newb Joined: 08 Nov 2008 Posts: 43

I'm a comcast paying customer and maybe they won't mind closing his account since they will keep me as a customer. I think this lad used social engineering or a trojan to get the login info for comcast.net to login from Nigeria.

Posted: Sat Dec 27, 2008 9:45 am

Well that changes everything! Why didn't you say so? Being a paying Comcast customer will most likely make all the difference in the world in your efforts to get the account closed. Very Happy

I give up...

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

In my experience being a paying customer makes one the lowest of the low. They've got you now; it's the new customers they are offering all the sweeteners.

By all means continue with the bait. When you've got cast-iron proof, pop into the fake banks forum to learn how to write a letter of complaint.

Posted: Sat Dec 27, 2008 3:52 pm

To add to the others' good advice, keep in mind that the Comcast customer may have had his account phished by the lad.

I'm not certain about Comcast, but I know Verizon allows account-holders to create aliases (with a Verizon addy), and designate non-Verizon emails as an alternate account.

The lad could be using the Comcast address for his opening format, then forward his victims replies to his own free account.
In the case of Verizon, forwarded messages do not remain in the Verizon inbox.

If the account owner seldom uses his account, he may never see what the lad has done.

Again, I'm suggesting this as an alternate possibility, which still should be reported to Comcast, once you have enough information to know this is a scam.

Posted: Sat Dec 27, 2008 9:34 pm

Chances of the account actually being paid for by a scammer are slim. I also get Nigeria from the IP, btw.

Assuming Comcast only provides emails to paid service subscribers (I believe this is true, but haven't really researched) the account is likely:

In any of the above cases, it is possible that the victim does not log into this account and has no idea what is happening.
It is possible, but less likely, that it is the account of an exceptionally ignorant US accomplice. I say exceptionally ignorant because with the number of free emails out there, most knowing accomplices would just grab a free email rather than use an account that could easily trace back to them.

If the email belongs to a victim, while it may not be a trophy in the site-killing sense, if you can collect the evidence (as others have said, it's obviously a scam, but the ad response itself is not proof) and Comcast takes action, the owner of the email will likely become aware of the situation, and you may save a victim, which is (IMO) a bigger win!

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

How have we gone from a standard suspicious email to the far realm of social engineering?

I do like the exasperated sarcasm in the middle, though.

Not quite a Newb Joined: 08 Nov 2008 Posts: 43

I sent an [email protected] email regarding this and hopefully they will shut it down but if not you guys on here can help me out. Yep that is definately a comcast i.p. address because it starts with 76 and mine also starts with 76.

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

The 76 address is not the scammer. OMTA13 and OMTA02 are Comcast server machines. MTA stands for Mail Transfer Agent.

Although the timestamp is not the latest one, I think in this case it is because someone has their clock wrong by half a minute, and you will find this is the important IP address:

Quote:

Received: from [41.219.244.46] by mailcenter01.comcast.net; Tue, 25 Nov 2008 00:50:16 +0000

Rule of thumb: If in doubt, the IP address that tracks to Nigeria is the original one.

A traceroute on that address goes nowhere near Comcast. It is provided by SkyVision. "SkyVision is investing over 2 Billion NGN to enable every person in Nigeria to enjoy a reliable, high quality and affordable Broadband Internet connectivity"

It looks to me like a phished Comcast account. You can check email on www.comcast.net, so the scammer will be using that. However I don't see any way to get a Comcast email account without having equipment provisioned by them.