Anyone want a scammer to bait? -- [email protected]

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 15 Nov 2011 Posts: 3

This one was interesting because she hid out on a personals site, the profile said she lived near me. Next thing you know she claimed to be in the UK and need a plane flight... ha ha. I'm not clever enough to keep it going but if someone else wants to bait her go right ahead! (I can even pass off my email to you, it's a throwaway yahoo one)

Quote:

Hunnie i can make it to u this weekend, i want so much of u, all i need do here is renew my visa and make flight reservation, that i can do today and will have my ticket ready for the weekend, wow u are really serious about this and i can see u got class and taste.. its gonna be so much fun for us and we will do just great, i have got saving here my love so i will be taking some of my money to pay travel expenses all i ask u is to help me with a little of the differences i have got left, i need name of the closest airport to u, city and zip code.. and also tell me how much u can spare for me .. i gotta be there hun.xoxoxoxo

Hello I'm New here! Joined: 15 Nov 2011 Posts: 3

By the way, this person actually had a webcam on yahoo messenger, how did they do that? It seemed pre-recorded but still, that's quite an involved scam.

Baiting Guru Joined: 27 Mar 2011 Posts: 21158

Webcam can be spoofed. Someone smarter than I will be along to explain how that works later.

If you want someone to work at this one, we need a post in Surplus with header information and the first mail to start with.

Posted: Thu Nov 17, 2011 11:49 pm

True romance scammers (lads) do usually set up profiles on dating or social networking sites. The ones who randomly send out emails usually turn into refugee scammers pretty quickly.

What site did you meet "her" on? Is the profile still there?

That writing style is pretty clearly African-since the address is yahoo, headers would be helpful to see if we can get a true location (odds are it will be Nigeria, Ghana, or Malaysia).

As far as faked webcam goes, it is becoming increasingly common, especially with scammers posing as females. Many lads are now choosing porn actresses or more obscure model/actresses so that they can have plenty of photos and video at the same time. There is software designed to make it very easy to fake webcam with existing video, and it is sold openly in the scammer-to-scammer world.

With the right software, the scammer can not only loop the video, but he can select certain actions in the video (e.g. lifting up her shirt) and tie them to a keystroke command--so that his character can "perform" for the victim on webcam. It's pretty easy, and it helps scammers to appear much more believable.

Hello I'm New here! Joined: 15 Nov 2011 Posts: 3

So here are the headers, warning, it's quite long. The site was er, Ashley Madison, so you might say I got what I deserved. (I'm single so no foul, but the site isn't exactly for honest folk.) "She" was listed in Oregon near Portland as "whatyouwantigive" or something like that.

Quote:

From Maggie Flora Sat Nov 12 10:26:18 2011
X-Apparently-To: [email protected] via 98.138.206.173; Sat, 12 Nov 2011 02:26:21 -0800
Return-Path: <[email protected]>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
dCBoZXJlwZwNpbWFnZS9qcGVnAwMyOQJyZXN0aW5uLmpwZwNpbWFn
ZS9qcGVnAwMzNA--
X-YMailISG: 7IQ6
GH0uea9bwg-
X-Originating-IP: [98.138.91.163]
Authentication-Results: mta1041.mail.sk1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm3-vm4.bullet.mail.ne1.yahoo.com) (98.138.91.163)
by mta1041.mail.sk1.yahoo.com with SMTP; Sat, 12 Nov 2011 02:26:21 -0800
Received: from [98.138.90.51] by nm3.bullet.mail.ne1.yahoo.com with NNFMP; 12 Nov 2011 10:26:19 -0000
Received: from [98.138.89.171] by tm4.bullet.mail.ne1.yahoo.com with NNFMP; 12 Nov 2011 10:26:19 -0000
Received: from [127.0.0.1] by omp1027.mail.ne1.yahoo.com with NNFMP; 12 Nov 2011 10:26:19 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 78224 invoked by uid 60001); 12 Nov 2011 10:26:19 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1321093578; bh=OY6YwUnJDR2/i4tekZumbgD0SaWskhhGr26y3xFx0sk=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type; b=I9lonwTPkQ9MccHSKprTdO6YjhiXo/qnDZLTkgYwBNgGKstxE=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type;
b=G7ulmJvuTWVm3J2wfXQ8andkGuid7F_kvOAcKnhy.VJ2aMIeanmseuK
x5LzZ2A--
Received: from [41.3.227.213] by web121608.mail.ne1.yahoo.com via HTTP; Sat, 12 Nov 2011 02:26:18 PST
X-Mailer: YahooMailClassic/14.0.11 YahooMailWebService/0.8.115.325013
Message-ID: <[email protected]>
Date: Sat, 12 Nov 2011 02:26:18 -0800 (PST)
From: Maggie Flora <[email protected]>
Subject: Re: 'lookingforlovely' from AM
To: Cheeky Monkey <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="-421711944-439458348-1321093578=:75235"
Content-Length: 195489

Posted: Fri Nov 18, 2011 6:50 am

Welcome to Eater, cheekymonkey0921!

ipTRACKERonline.com wrote:

Header Analysis Quick Report Originating IP: 41.3.227.213 Originating ISP: Vodacom (pty) Ltd. City: Cape Town Country of Origin: South Africa * For a complete report on this email header goto ipTRACKERonline

A long ways from Portland! Very Happy

Anyone want a scammer to bait? -- [email protected]	View next topic View previous topic