Can someone check this header for me?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Elite Baiter Joined: 19 Jan 2009 Posts: 1440

This one - attached to a new (for me) scam, has me puzzled:
----------------------------------------------------------------------------

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9Ng==
X-Message-Status: n:0
X-SID-PRA: Kathie Lockhart
X-SID-Result: SoftFail
X-Message-Info: 0Lct38uk7fNfDK3hObzd9PCWaTvCpiacdmJ+g/maGB/31eVw9s3jt7RQj4ZE8af6jeCMmuJLCJJgKvJGJCuSBcRrbShwIwRV
Received: from tomts21-srv.bellnexxia.net ([209.226.175.183]) by bay0-pamc1-f5.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Mon, 20 Apr 2009 07:52:50 -0700
Received: from toip46.srvr.bell.ca ([67.69.240.47])
by tomts21-srv.bellnexxia.net
(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP
id <20090420145249.IHDX1522.tomts21-srv.bellnexxia.net@toip46.srvr.bell.ca>;
Mon, 20 Apr 2009 10:52:49 -0400
Received: from toip16.srvr.bell.ca ([67.69.240.18])
by toip46.srvr.bell.ca with ESMTP; 20 Apr 2009 10:52:41 -0400
Received: from relay01.alog.com.br (HELO relay04.alog.com.br) ([200.150.150.22])
by toip16.srvr.bell.ca with ESMTP; 20 Apr 2009 10:52:39 -0400
Received: from USER-PC (unknown [211.152.42.149])
(Authenticated sender: [email protected])
by relay04.alog.com.br (Postfix) with ESMTP id 8DBF647329C;
Mon, 20 Apr 2009 11:50:16 -0300 (BRT)
Reply-To:
From: "Kathie Lockhart"
Subject: Re: Survey Evaluation 2009
Date: Mon, 20 Apr 2009 15:50:47 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients:;
Return-Path: [email protected]
X-OriginalArrivalTime: 20 Apr 2009 14:52:50.0708 (UTC) FILETIME=[AD4F5540:01C9C1C7]

April - 20th - 2009
Re: Customer Evaluation Survey

We are carrying out a survey and we are inviting you to be a participant, International Money Transfer Company – Money Gram Systems Inc/Western Union is sponsoring a study of the quality of customer services provided to its reliable clients located at most Wal-Mart departmental stores, the aim of this survey is to help “Money Gram/Western Union Int'Transfer (MGIT) & (WU)” serve its customers better because (MGIT) & (WU) is committed to continuous improvement of its services.
You were randomly selected as part of a study of members who received services through WAL-Mart departmental stores. Your participation is, of course, voluntary, and your benefits and services will not be affected in any way, whether or not you choose to participate.
If you choose to participate, your survey site will be at any Money Gram/Western Union Int'Transfer shop, located mainly at WAL-Mart Stores.

Your survey task is to act as a potential customer sending funds to a friend or family member (we will provide you all required details), which your main survey objective is to evaluate and observe the efficiency of customer's service being offered and we would like to hear about your experiences with MGIT services and your suggestion on how MGIT can improve on customer satisfaction.
This is a breakdown of the funds that will be attached to your survey task:

Survey Amount: $1,105:00 ---
Service Fee: $145:00 ---
Survey Paid Expense: $250.00
Total: $1,500:00 ---
Your entitled pay for each survey is $250:00.

If you would like to know more about the survey and you would like to participate, kindly reply this e-mail and provide us with your full names and your full valid postal mail address, a customer service evaluation form will be enclosed in your first assignment, we will expect you to fill out this form to the best of your knowledge, which will depend and be determined by the customer service offered to you at any of the survey participating location, the responses you provide will go to an independent research organization, and will be combined with the information we get from all participant, your individual answers will never be disclosed, all information about you will be kept strictly private; we hope you will take this opportunity to tell us about the quality of customer services at (MGIT) & (WU), your participation in this survey is very much appreciated and this survey will be at no cost to you. (Oh goody!)
Thank you for your support.

Yours sincerely,
Kathie Lockhart.
P.S - Survey is only open to United States, Canadian and United Kingdom residents

Posted: Mon Apr 20, 2009 3:57 pm

from Apelord:

Quote:

211.152.42.149 China (Shanghai)*
* The last IP listed is usually the originating IP address

Elite Baiter Joined: 19 Jan 2009 Posts: 1440

Yes, I saw the Shanghai too, but was puzzled by the "@medstudents" thing and when I hit Reply to this mail, the return addy is @prokonto.pl, which is Polish.

I thought I was missing something. Thank you!

419Eater is my life Joined: 25 Feb 2009 Posts: 299

If that's the first email you got from them then it could be that the spammer is located in Shanghai but the actual lad is somewhere else. Just because its a .pl domain doesn't mean to person is in Poland - I could register a .fr french email address easily. Maybe its a lad pretending to be Polish?

Posted: Mon Apr 20, 2009 5:06 pm

ScammedOut wrote:

Return-Path: [email protected]

My first thought was that this would be a mail.com address, but it's actually a free Brazilian email provider. Deffo a Chinese lad though.

It's quite a common scam lately, usually known as a mystery shopper scam.

Can someone check this header for me?	View next topic View previous topic