Baiter baiting?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Not quite a Newb Joined: 26 Jan 2009 Posts: 77

This one looked odd to me, and I don't like the idea of a "baiter" baiting me, so here goes:

FEDEX COURIER SERVICE.
DELIVERY DEPARTMENT.
48 AIRPORT ROAD,
ABUJA.
NIGERIA.
WEST AFRICA.

Dear Rev Fl@tus M@ximus,

How are you today?.I received your email,along with your contact details.Regarding your package with FedEx.We have been wating to hear from you for a very long time now,hope all is well with you?.

In the letter sent to you by the FedEx Online Management Team Mrs.Mandy Blaire,hope you were made aware that there is a Security Keeping Fee of $215USD,which you have to pay to enable us deliver your package to you?.

The security keeping fee is necessary because we really do not know when exactly you will be contacting us for the collection of your package.And more so to avoid the problem of missing package.

Note that all other charges,included VAT & Shipping charges as well as Insurance fees have been paid,before your package was registered with us.You are only to pay for the security keeping of your package,which is $215USD.

Below is the information of our account clerk which you are to send the payment to.

Account Clerk: Frank Richards
Address : 48 Airport Road,
Abuja, Nigeria.

You are to send the payment via any Western Union Money Transfer/Money Gram
outlet close to you.

As soon as you are done with the payment,you are to send the following payment details to me.

Sender's Name :
Amount Sent :
(MTCN) Money Transfer Control Number :

The delivery of your package commence to you,as soon as payment for your package Security Keeping Fee have been confirmed by our account clerk.Note that is you get the payment send today,your package will get to you at the most on Thursday this week.

Have a Blessed day. Please call me anytime you need assistance.

I await your payment details as soon as possible.

Mr.Charles Brown.
+234 -703 686 9999.
Dispatch Director.
All rights reserved.©1995-2008 FedEx.

I know I "ordered" this one, but I think this may be "baiter baiting". Please respond.

Thank you.

Posted: Tue Feb 17, 2009 6:09 am

Hey Proto419!

What makes you think a baiter is baiting you? Sounds pretty typical to me.

Do you have headers?

Very Happy

Posted: Tue Feb 17, 2009 9:47 am

I hate to say it but it looks like an amatuer baiter pretending to be a lad, and doing a really shitty job of it, while there are indeed some lad mannerisms in there, they are not consistent.

Badgers are a very rare, almost extinct animal, who's only purpose in life is to spend their days living in the basement with no friends besides their right hand, even left wont have them.

Chances are it's not one but I can see why there are questions.

As Dora said, post up the header and we will get a much better idea

Posted: Tue Feb 17, 2009 10:03 am

Funny, looking at the punctuation and grammar it reminds me off Mr F. Focker. I highly doubt it though.

Posted: Tue Feb 17, 2009 12:10 pm

What was the context of this email? it looks like it came out in the midst of an ongoing bait.

If you have already been discussing a mysterious package with high value, currently held by a shipping company, I see a lot of things that very much resemble standard lad messages concerning the collection of a consignment (not an extremely large fee to be paid, explanation that many other fees have already been paid in advance, generic recipient name and request for WU/MG, urgent deadline, nigerian mobile number). The "shipper" character in such a scam never "knows" the contents of the package, so the vagueness here is to be expected).

If this message came out of nowhere, this particular message would be more unusual (although check to see whether it may relate to one of your ongoing baits).

The lack of spaces after . , and the use of ?. is very distinctive but this doesn't necessarily signal anything unusual (I've had lads do this before). just wondering what gave you the idea this might not be a lad?

Anyway, as others have mentioned, email headers would be useful in answering this question.

Baiting Guru Joined: 03 Mar 2006 Posts: 7103 Location: Yes

Why not just call the number and see if he answers?

Not quite a Newb Joined: 26 Jan 2009 Posts: 77

How do I get a header from gmail webmail? I understand it is easy with regular POP3 mail, but is it possible with webmail?

Baiting Guru Joined: 03 May 2007 Posts: 18313

When you're looking at the email, look over to the right. Next to the reply button there is a little arrow. When you click it you get a drop down menu. Choose "show original" and the whole text, including header, will pop up in a new window.

Posted: Tue Feb 17, 2009 5:50 pm

It can't be done with Gmail webmail.

Not quite a Newb Joined: 26 Jan 2009 Posts: 77

@Ima, Thanx.

Here is what I got:

Delivered-To: [email protected]
Received: by 10.151.85.21 with SMTP id n21cs240814ybl;
Mon, 16 Feb 2009 16:11:04 -0800 (PST)
Received: by 10.142.48.14 with SMTP id v14mr1646316wfv.79.1234829463241;
Mon, 16 Feb 2009 16:11:03 -0800 (PST)
Return-Path: <[email protected]>
Received: from bay0-omc2-s9.bay0.hotmail.com (bay0-omc2-s9.bay0.hotmail.com [65.54.246.145])
by mx.google.com with ESMTP id 27si13697814wff.48.2009.02.16.16.11.02;
Mon, 16 Feb 2009 16:11:03 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 65.54.246.145 as permitted sender) client-ip=65.54.246.145;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 65.54.246.145 as permitted sender) [email protected]
Received: from BAY112-W31 ([64.4.26.131]) by bay0-omc2-s9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 16 Feb 2009 16:10:27 -0800
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_d11fed4c-1cf7-4cc9-bdef-9d07d18b1d35_"
X-Originating-IP: [213.185.118.194]
From: FedEx Express Courier <[email protected]>
To: <[email protected]>
Subject: Your FedEx Package(Rev Flatus Maximus)
Date: Tue, 17 Feb 2009 01:10:27 +0100
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 17 Feb 2009 00:10:27.0725 (UTC) FILETIME=[2338BBD0:01C99094]

--_d11fed4c-1cf7-4cc9-bdef-9d07d18b1d35_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

I presume that "X-Originating-IP: [213.185.118.194] " is the operable line?

Baiting Guru Joined: 03 May 2007 Posts: 18313

Yes, you're right, it's this line: X-Originating-IP: [213.185.118.194]

If you plug it into an IP tracing tool you'll get Nigeria.

This is a tool we use a lot here. You can copy/paste the whole header into it: http://headertool.apelord.com

Posted: Tue Feb 17, 2009 11:33 pm

Per: http://headertool.apelord.com/

213.185.118.194 Nigeria (Bénin)

Very Happy

ETA: Dang. Beaten by Ima! Wink

Posted: Tue Feb 17, 2009 11:42 pm

I don't see anything unusual with the format. Looks like typical lad mail to me.

I don't understand why you think otherwise so I must be missing something.

Posted: Wed Feb 18, 2009 12:21 am

Quote:

which you have to pay to enable us deliver your package to you?.

The syntax here, and of the rest of the email, is typically Western.

Upspeak at its finest.

Posted: Wed Feb 18, 2009 4:16 am

TheLovelyJill wrote:

Upspeak at its finest.

I had to look this up?

Eater never ceases to amaze me? Laughing

Master Baiter Joined: 23 Jan 2009 Posts: 241

I believe we have been sprung and the lads are fighting back. I have received numerous request to complete forms out of the blue which I thought was a bit weird.

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Well, given that most scam mails are weird to begin with, I'm curious how you came up with that. Wink

There aren't lads out there who work to counter baiters; you may get a smart ass, but lads are lads - they do this for money.

The IP traces back to a lad; it is a lad. Just an ordinary lad, and nothing more nefarious.

Posted: Wed Feb 18, 2009 6:01 am

ramsey wrote:

I believe we have been sprung and the lads are fighting back. I have received numerous request to complete forms out of the blue which I thought was a bit weird.

Post them up with headers of course.

Don't get paranoid, I already have that own cold! Wink

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

Tsnerd wrote:

nefarious.

Have you been playing with your thesaurus again?

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Only when I'm sure nobody is watching.

Posted: Wed Feb 18, 2009 8:51 am

I must admit that when I saw this thread I couldn't work out why the mail wasn't just seen as standard Lad scam crap.

Some Lads do get their formats from well educated contacts who often write in a form which appears 'authentic' though often, even then, it is a stilted or old-fashioned form.

When dumb Lads try their hands at formats the results can be hilarious and mind numbing.

Quote:

SILVESILVERLOANOFFER
768BV OFF OSUMA ROCK
ABUJA
NIGERIA
45UJ AIR POT POTHARCUT
NIGERIA

This one can't even spell locations in his own country. Shocked