Email header Analysis help for newbie please

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

Hi, complete newbie to baiting here, but with a 35+ year technical IT career mainly as a Sysprog behind me & time now on my hands to play!

I've gone through all the hints & tips, Baiter university & read hundreds of excellent classic baits.
I've fallen in love with the site & principals behind it & I am ready to go!

So, the first interesting mail in my catcher is:

ROBERT MUELLER III.
EXECUTIVE DIRECTOR FBI.
FEDERAL BUREAU OF INVESTIGATION FBI.WASHINGTON D.C.
FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP INTERNET.

ATTENTION: BENEFICIARY, blah blah blah.

Written in typical "ladeese" English, so I would have bet a large sum it came from e.g. Nigeria; But surprise surprise.....

Here's the header.....................

From Robert Mueller Fri Jul 29 04:15:40 2011
X-Apparently-To: [email protected] via 77.238.189.162; Fri, 29 Jul 2011 03:15:43 +0000
Return-Path: <[email protected]>
X-YahooFilteredBulk: 98.139.213.158
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: JUlMhD0WLDuY1hfN0wml4iJcZB82jQt0tCxBtsfx3WwRKv0_
N.<snip>
X-Originating-IP: [98.139.213.158]
Authentication-Results: mta1096.mail.ird.yahoo.com from=att.net; domainkeys=neutral (no sig); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm2-vm1.bullet.mail.bf1.yahoo.com) (98.139.213.158)
by mta1096.mail.ird.yahoo.com with SMTP; Fri, 29 Jul 2011 03:15:43 +0000
Received: from [98.139.212.152] by nm2.bullet.mail.bf1.yahoo.com with NNFMP; 29 Jul 2011 03:15:40 -0000
Received: from [98.139.213.11] by tm9.bullet.mail.bf1.yahoo.com with NNFMP; 29 Jul 2011 03:15:40 -0000
Received: from [127.0.0.1] by smtp111.mail.bf1.yahoo.com with NNFMP; 29 Jul 2011 03:15:40 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1311909340; bh=8ptLaTNHck/T1ZEz3JfU/3z8bRn3KYYFM1hrHHqrA0I=; h=X-Yahoo-Newman-Id:Message-ID:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE; b=t<snip>
X-Yahoo-Newman-Id: [email protected]
Message-ID: <[email protected]>
X-Yahoo-Newman-Property: ymail-5
X-YMail-OSG: <snip>
Received: from User ([email protected] with login)
by smtp111.mail.bf1.yahoo.com with SMTP; 28 Jul 2011 20:15:40 -0700 PDT
Reply-To: <[email protected]>
From: "Robert Mueller"<[email protected]>
Subject: AS A MATTER OF URGENCY
Date: Thu, 28 Jul 2011 23:15:40 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 5674

A quick trip to IpTRACKERonline shows:

ipTRACKERonline.com wrote:

Header Analysis Quick Report Originating IP: 66.255.63.182 Originating ISP: KNOXVILLE ORAL & MAXILLOFACIAL SURGERY City: Knoxville Country of Origin: United States * For a complete report on this email header goto ipTRACKERonline

If I read this right, it originates in Sunnyvale, CA (potentially, though that's probably an AT&T Point of Presence) from an AT&T account through a US based ISP that is also a dental surgery!

I'm a bit suspicous of the "domain of att.net does not designate permitted sender hosts" warning... Does AT&T not publish SPF records for it's mail servers?

Alternatively, is AT&T email web based (think Yahoo) thus accessible from any server? If so, the SPF warning explains itself.

Also, detailed analysis shows:

Originating hostname: uslec-66-255-63-182.cust.uslec.net which is shown as KNOXVILLE ORAL & MAXILLOFACIAL SURGERY. I can't see where this info comes from as WHOIS for USLEC.NET shows
an expired domain, & web site shows as PAETEC, which as far as I can tell is the domain registration service trying to get you to reuse the site.

The reply to address is an AOL one, which again confirms the US link... I'm a bit confused & any help untangling things is welcome.

I might well reply using Spyp1g & try to nail return address down geographically before I play any more.

Regards,
willewontee

snipped keys due to forum blowout-dorothy

Not quite a Newb Joined: 15 Jul 2011 Posts: 20

Hi there!

Welcome to the forums, i'm a noobie too but am really behind the site.

I've had something similar recently checked the headers got a new york ip. Spypig confirmed it. Didn't know what to make of that one so knocked it on the head.

Just wanted to say try spypig or who read me, one of the forum memebers pointed me to these two sites recently.

Happy Baiting!

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

Hi thanks for the welcome & welcome yourself. I will try a Spypig on it, but a bit odd getting a typical W. African scam from a US address. Think I will leave it alone if it is a US address.

Regards,

willewontee

Posted: Mon Aug 01, 2011 8:21 pm

Welcome to 419eater willewontee and 419muguhunter
Always 'Bait Safely' = Never use your Real Life information or email in a bait.

Take a look around Eater University. Read the Stickys. Sign up for the Cherrie Mentor Program.
Most of all have Fun!!

Posted: Mon Aug 01, 2011 8:34 pm

It's possible that the original sender exploited a bug in a computer at the oral surgeon to send the message. Send a reply and see where the reply to that comes from.

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

I've just been notified by Spypig my reply was opened:

Recipient Location: San Francisco, California, United State

The accuracy is approximately 98% on the country level and 70% on the city level for US cities,so I guess it's in the USA.

Let's see if I get a reply....

Regards,

Willewontee

Posted: Tue Aug 02, 2011 1:33 pm

Quite a few scammers phish or hack into universities email account and it sounds like some how the KNOXVILLE ORAL & MAXILLOFACIAL SURGERY has had it happen to also. I am in receipt of one who phished or hacked or something into the Republican Party of Pennsylvania.

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

Just done some futher analysis on the Spypig notification, what it seems to be doing is detecting the email leaving the last random TOR node rather than someone actually opening the email, so it looks like SPYPIG does not work with TOR.

Regards,

Willewontee

Posted: Tue Aug 02, 2011 9:48 pm

Tor will hide you quite well.
In my opinion, if you host an exit node, you are technically exposing your internet account to be used for illegal purposes (amongst other things).

Unless you are monitoring both the incoming and outgoing packets from the exit node, it's nigh impossible to work out which requests came from each IP. If you can monitor in and out going packets, it is possible to work out which requests are going to and from each connection.

Most lads wouldn't have a clue what Tor is, however.

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

Yes, it does hide one quite well as you say.

I agree about hosting a node... I had the same thoughs about it & so decided to just use it as a smoke screen.
Today I have been mailing from USA, GB, South Africa, Canada, Greenland, etc... 3 random in & 3 random out nodes.
I might look at setting a fixed exit node somewhere far away from me in case I hit a lad with enough savvy to interpret an email header.

It surprised me where Spypig seems to think email is being opened, seemingly it's reporting now at every TOR node it goes through, but not once it exits TOR .... great way to trace TOR nodes, but not what I want. I will see if I can find out how Spypig actually works & maybe try some different notifiers.

I tried for some easy piggies with ASEM on about 100 likely lads picked from Baiters hot list, but no one wanted to play.

I'm playing straight baiting with about 20 odd various modality lads on the go now, to get my hand in, going well so far & some promising looking ones in there.

What surprised me as a newbie is even though "I" am 74 years old & deaf as a post, about a quarter of the lads will not come out to play unless I ring them first.

Regards,
Willewontee

Posted: Tue Aug 02, 2011 10:37 pm

Quote:

X-Originating-IP: [98.139.213.158]

That's Sunnyvale. Yahoo is based there, and is mentioned in the headers. I'm not sure what is happening here.

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

The opinion seems to be it's a bit odd & indicitive of someone hacking a server & email addresses. I took advice from more experienced baiters including Morgain Le Fay & have contacted the relevant organisations & reported all email addresses & servers involved.
I've not had anything back yet

Regards,
Willewontee

Posted: Wed Aug 03, 2011 7:43 am

Late to the party, but I just noticed "NNFMP" in the header. That means the scammer is using a nifty device to hide his location.

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

All I can find (authoritively) about NNFMP (from Yahoo themselves):

NNFMP is an internal protocol not recognised by IANA or the RFC's. Yahoo uses this protocol to internally route e-mail traffic across their network. The acronym stands for "Newman No-Frills Mail Protocol". It's a simple, high-performance protocol comparable to QMTP.

So it is not neccessarily indicitive of fraud.

Regards,

Willewontee

Posted: Wed Aug 03, 2011 9:26 am

Of course not. Very Happy

I'ts just something lads love to use.

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

So yes, just another pointer to a potential lad & it all adds up Very Happy

Hello I'm New here! Joined: 22 Jul 2011 Posts: 15

Well, would you believe it, after all the reports I got from Spypig that turned out to be TOR nodes,
it's eventually reported the mail being opened at another IP address...
116.203.102.186 which shows as India, but no more detail available.

So the trail seems to have left the US & gone somewhere where their "ladeese" written opening script seems more believable.

Regards,
Willewontee

Email header Analysis help for newbie please	View next topic View previous topic