Possibly a US Scammer landed in my catcher account

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Elite Baiter Joined: 15 Sep 2008 Posts: 1006

^^^ Click on the arrow next to reply and then on "show original"

Posted: Tue Jun 16, 2009 8:12 pm

^^^^ Thanks! Missed that when I was poking around.

My "US" lad who had generated the South-eastern US IPs is now generating ....
surprise a Legos one: 196.3.183.73 when using his Yahoo.cn account.

Legos is more to be expected, but the ability to get US IPs into his first
email would seem to be useless if he's just as quickly let it go. Spoofing
for no purpose in other words. I wonder what he had in mind by doing what he did.

In any event, the headers in a standard reply to me explaining WU is
easy and to be careful not to tell anyone anything (Oh, and that
mysteriously he is having Gmail problems).

Quote:

Delivered-To: [email protected]
Received: by 10.90.35.15 with SMTP id i15cs203727agi;
Sat, 13 Jun 2009 21:41:01 -0700 (PDT)
Received: by 10.114.52.16 with SMTP id z16mr9070513waz.220.1244954460054;
Sat, 13 Jun 2009 21:41:00 -0700 (PDT)
Return-Path: <[email protected]>
Received: from web92207.mail.cnh.yahoo.com (web92207.mail.cnh.yahoo.com [203.209.250.120])
by mx.google.com with SMTP id 9si5098349pzk.112.2009.06.13.21.40.56;
Sat, 13 Jun 2009 21:40:58 -0700 (PDT)
<<<bunch of crap removed to keep from blowing out the thread>>>

of [email protected]) client-ip=203.209.250.120;
<<<bunch of crap removed to keep from blowing out the thread>>>
203.209.250.120 is neither permitted nor denied <<<bunch of crap removed to keep from blowing out the thread>>>
of [email protected]) [email protected]; dkim=pass (test mode) [email protected]
Received: (qmail 63183 invoked by uid 60001); 14 Jun 2009 04:40:56 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn;
s=s1024; t=1244954456;
bh=D5TuxbRZ3kvJ+GEBuwOq8WqyHCm2Jqs+gNI8+DUmcgA=;
h=Message-ID:X-YMail-OSG:Received:X-
Mailer:Date:From:Subject:To:Cc:MIME-Version:Content-Type;
b=Pnq5RVtbKKHPVsAlvo97QSMOZVnh6WodX+qpbTjLr5ngY68q0dIlxYg5Ui
Gf26VFI++O33F8sHdAJnygDVwxtC6LxJhcWfjAs3OdDhHKMM3XnbR/T1gCk
aLdBf6UcT2niMu8k2cgA+5PELXtvF2g1+6UsHAhpg4PmDp5fqUidBI=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.cn;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:Cc:MIME-Version:Content-Type;
b=LhxvTZdMSzdwhKl8OGFPx1exJjc14WyEgeAfJv+EiBmI3anJeM+WuLLm7
KANo/OLt3tl9oANtXoW97Hii/3mNasIFMxzVKYbZrz0gz2Ye6019tgxRtojFy3F
Fxk5AKDco6l/p5kAT9XYpiHnzsoT54xB2puBIu2r6sc3arfMllM=;
Message-ID: <[email protected]>
X-YMail-OSG: kIQQdkkVM1k.mMdrjVEjnnE37SIpBqiHwy49yTIpFXpfSk75wGQcHQnfk85
myfDsoaw.vKwN.2IvVeKMHFldHFf3W2pj.TH5rG71rWgbbGLExc3UPyVTc6V
7zkRJH3b2hwnoSJWfS6tfpTbjUk4JIWI5KR8hLfZk71X7HaPfh_OZXe.w2fQv
FwASbP21wE6h0WDOR2qCbMF8Xwc-
Received: from [196.3.183.73] by web92207.mail.cnh.yahoo.com via HTTP; Sun, 14 Jun 2009 12:40:55 CST
X-Mailer: YahooMailClassic/5.4.12 YahooMailWebService/0.7.289.15
Date: Sun, 14 Jun 2009 12:40:55 +0800 (CST)
From: B4rrister 3ll1s Bry4n <[email protected]>
Subject: =?utf-8?B?UkU6IEF0dG46IENsb20gVGFuY2V5ID4+PiBERUxJVkVSWSBVUERBVEUuI
ChV?=
=?utf-8?B?UkdFTlQpLuKAjw==?=
To: [email protected]
Cc: [email protected]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1217712244-1244954455=:62201"

--0-1217712244-1244954455=:62201
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Attn: xxxxxxxxxxx
=C2=A0
Its okay, to transfer money through Western Union is easy.
=C2=A0
Just go into any of their offices around you and send funds with the detail=
s given to you ealier.=C2=A0
=C2=A0
Be informed that this is truly very legal=C2=A0as=C2=A0you will notice that=
your cheque will be accompanied by some other documents such as the origin=
of funds certificate and also a=C2=A0letter from the issuing bank certifyi=
ng that funds is valid and ready to be cashed. All these documents will=C2=
=A0ensure that you cash your funds without any complications at all.
=C2=A0
All you need to do is email me Immediately you send the funds out, the sum =
of 220 Euros=C2=A0and I will call the delivery firm and inform them. Delive=
ry will be made to your address within 2 working days=C2=A0after=C2=A0your =
payment has been confirmed.
=C2=A0
Note: I am currently having problems with my windows live email account hen=
ce we have to communicate through my alternative email xxxxxxxxx@y=
ahoo.cn
=C2=A0
I will be waiting to hear from you soon.
=C2=A0
=C2=A0
Thanks and God Bless.
=C2=A0
=C2=A0
Sincerely,
Mr Ellis Bryan
=C2=A0

=C2=A0

Posted: Tue Jun 16, 2009 8:15 pm

Mod - can you mask the email addy I missed?

[edit] I can't seem to see through these glasses!!! oh and I fixed up the post above [/edit]

I can't seem to edit this now that it's posted as I've been able to on others. Thanks.

Regards,

Posted: Tue Jun 16, 2009 8:23 pm

Scroll the page to the right, the edit-button should still be there, just out of view because of the blowout. While you're at it, delete the very long string that causes the blowout.

ETA: The e-mail addy made be laugh Razz

Posted: Tue Jun 16, 2009 8:44 pm

^^^^ These glasses have to go...I didn't even see the scroll bar.....thanks.

Regards,

Possibly a US Scammer landed in my catcher account	View next topic View previous topic