First scam bait?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Jul 16, 2009 10:43 am

OK I have just received my first email since signing up to this site. I beleive this is the same sort of scam with just another BS story.

It goes as follows.

From Staff Sgt. Jeffrey Karl My name is (Staff Sgt.)Jeffrey Karl I am an American soldier, serving in the military with the army’s 3rd infantry division. I have a very desperate need for assistance and have summed up courage to contact you. I found your contact particulars in an address journal and am seeking your kind assistance to move the sum of Eight Million United States Dollars (US$8,000,000.00) to you, as far as I can be assured that my share willbe safe in your care until I complete my service here. Source of Money: Some money in various currencies were discovered in barrels at a farm house near one of Saddam’s old palaces in Tikrit-Iraq during a rescue operation, and it was agreed by staff Sgt Kenneth Buff and I that some part of these money be shared between both of us before informing anybody about it since both of us saw the money first. This was quite an illegal thing to do, but I tell you what! No compensation can make up for the risk we have takenwith our lives in this hell hole, of which my brother in-law was killed by road side bomb blast last time. The above figure was given to me as my share, and to conceal this kind of money became a problem for me but with the help of a British contact working here and with his office enjoying some immunity, I was able to get the package out to a safe location entirely out of trouble spot. He does not know the real contents of the package, and believes that it belongs to a British/American medical doctor who died in a raid here inIraq, and before giving up, trusted me to hand over the package to his family in United States. I have now found a very secured way of getting the package out of Iraq to you at home for you to pick up, andI will discuss this with you when I am sure that you are willing to assist me and that my money will be well securedin your hand. I want you to tell me how much you will take from this money for the assistance you will give to me. One passionate appeal I will make to you is not to discuss this matter with anybody, should you have any reasons to reject this offer, please and please destroy this message as any leakage of this information will be too bad for the U.S soldiers here in Iraq. I do not know how long we will remain here, month of may was the deadliest month for us out here. Totally, we lost 127 men and I have been shot, wounded and survived two suicide bomb attacks by the special graceof God. This and other reasons I will mention later has prompted me to reach out for help. I honestly want this matterto be resolved immediately, May God bless you and your family.Sgt.Jeffrey KarlEmail : [email protected]

OK! I have a few questions (and im sorry if they were covered elsewhere)

-Retreaving the IP off the headers. I dont know how to do this anymore since the new Hotmail layout.
-When copy and pasting from email like above - its quite messy. Am I able to paste it up neater?
- I wonder what I could start off with as a first post from my non legit email, got the voice mailbox and basic character info already Smile

- Im not sure how I wanna start my first FISH!

Posted: Thu Jul 16, 2009 11:05 am

I replied with:

I am sorry to hear about your brother, I have nothing but respect for what you and other men and women do over there. I would love to help you!

Please get back to me!

PS: I am sorry for late reply, I have been on holiday!

However delivery failed... I wonder why? Scammer email shut down?

Posted: Thu Jul 16, 2009 11:19 am

Was the addy at the end of the email the same one you replied to? Sometimes Lads send from accounts knowing that they'll be closed down for spamming, and ask you to reply to another account.

Posted: Thu Jul 16, 2009 11:33 am

Why yes. The email at the ends differs from the one that it was sent on, I never realized.

I have now emailed to the correct address. Lets see what happens

* I really wanna play this game but I got work soon Sad

And wont be back home for 24hours.

Baiting Guru Joined: 03 Mar 2006 Posts: 7103 Location: Yes

Don't worry -- the lad won't go anywhere. And often, they will delay in getting back to you anyway.

With these military scams, be sure not to press too hard for details in an effort to show up the lad -- they will just quit on you if it gets too hot. Rather, start making up all sorts of military terminology and you may want to find it a remarkable coincidence that you too served in 3d Infantry... Wink

Posted: Fri Jul 17, 2009 3:49 am

Hi AJ please try the following,,

Quote:

-Retreaving the IP off the headers. I dont know how to do this anymore since the new Hotmail layout.

Don't open the e-mail, just right click on the e-mail title, not the
name. Then when the little screen drops down left click "view message source''

Quote:

When copy and pasting from email like above - its quite messy. Am I able to paste it up neater?

Ether click on the "quote" box, before you cut & paste your message, or type in brackets quote brackets. When you have finished click quote again, or write in "brackets /quote brackets"

Quote:

I wonder what I could start off with as a first post from my non legit email,

keep it simply and short, don't go into details. A simply "hallo thanks for your mail, do tell me more" will do. make them do the work, not you.
And the more you tell them the more you need to remember

Posted: Fri Jul 17, 2009 9:28 am

Thanks for the help - I will do this later Im in a rush now as just got back home early hours in morning, I got a meeting now!

But this is what the guy said. STRAIGHT TO BUSSINESS!

Quote:

OKAY LET ME HAVE YOUR FULL NAME , ADDRESS , PERSONAL PHONE AND FAX LINE AND COPY OF YOUR ID

THANK YOU

I am guessing that Im looking for IP's addresses. THis was from the email I got at start. I shall have to check my gmail which i replied in to see the other headers (if this is possible)

Quote:

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9Ng==
X-Message-Status: n:0
X-SID-PRA: SGT JEFFREY KARL <[email protected]>
X-Message-Info: /UPnKeip+FyrK6nWn+ECANa0RDNX/Cn4/EoJI0uJZcw2SYx+3J3II0NIa88UxlfGvnkgWmb3pjPhHoa6SnmRFYsG7Jg9+O9U
Received: from MEDICISSRV ([88.191.72.222]) by SNT0-MC3-F33.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Wed, 15 Jul 2009 14:44:59 -0700
Received: from User ([82.128.26.241])
(authenticated user [email protected])[snipped out personal info-ghost]
by MEDICISSRV (Kerio MailServer 6.7.0 patch 1);
Wed, 1 Jul 2009 00:49:53 +0200
Reply-To: <[email protected]>
From: "SGT JEFFREY KARL"<[email protected]>
Subject: From Staff Sgt. Jeffrey Karl
Date: Tue, 30 Jun 2009 15:49:49 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 000773-1, 09/06/2007), Outbound message
X-Antivirus-Status: Clean
Bcc:
Return-Path: [email protected]
Message-ID: <[email protected]>
X-OriginalArrivalTime: 15 Jul 2009 21:44:59.0334 (UTC) FILETIME=[803EB660:01CA0595]

He didnt even thank me or respond to "sorry about your brother" emotionless BASTARDS! lol

Posted: Fri Jul 17, 2009 3:48 pm

I am unsure of what he wants my copy of ID? Should I email back asking him why he wants these details?

Posted: Fri Jul 17, 2009 3:53 pm

nope since 9/11, onset of swine flu, climate change, international shortage of squirrels it is no longer allowable to provide copies of passports/driving licence, whatever

eta: and I get lagos from the email header

Posted: Fri Jul 17, 2009 4:13 pm

What is it I am looking for (the useful bit to you guys) that I need out of the headers, What shall I do with the useful information? like IP addresses?

Also cannot see any personal infotmation in those headers relating to me.

I have emailed the scammer back! Lets see how it unfolds.

Im going to have to do some more reading for more ideas to keep this thing rolling without the scammer been in such control. At the moment hes just demanded information without really saying anything else.

So Im going to ask many questions (good idea - yes?) Laughing

Posted: Fri Jul 17, 2009 4:23 pm

Your own email address was in the headers. See where Ghost replaced it with green X's.

You can either pull the last IP address and put it into any online IP address research site, or copy and past the entire header into http://headertool.apelord.com/ What you will get (hopefully, not always) is a location for the scammer.

Posted: Fri Jul 17, 2009 4:27 pm

i went and rechecked the header info and the email under auth was medic something, which was nothing to do with me.

And Im guessing my scammer is from 82.128.26.241 Nigeria (Lagos) which is not the USA like he said he was, really disapointed in this liar!

Thanks for that tool DOR it shall be useful I'm guessing. Very Happy

his IP address registraw is "ripe.net"?