What do you think about this one?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 27 Mar 2012 Posts: 4

Hi. Long time lurker, first time poster.

I am currently in correspondence with a gentlemen, communicating with me through a rocketmail email, and with the senders name coming up with his first and last name's initials. Those parts of the picture are dodgy.

He writes in exactly the way scammers do, disjointed hard to follow english, making full use of his attachment to god and how many blessings I should or should not receive in a given day.

The suspected scammer came onto the scene responding to a post in an australian aviation trader magazine, for an old aircraft that he supposedly operates 88 of in a silent christian movement organisation all around the world.

While a lot of scammers are god motivated, what is swimming through my head is the following:

Scammers are people. There is obviously a demographic of people somewhere in the world that naturally type in the way they do, christian referenced abound with impeccable spelling and terrible grammar.

However, the things he is asking about are legitimate. He is talking about some fairly specific aviation topics and is quite keen to have some of his staff inspect the aircraft, not very scammerlike.

a short snippet:

Quote:

Have a GREAT GODLY DAY Damian, and Kindly hank You for your Fast Response.
From which kind of Christian Denomination are you.
It's real good and nice to deal with same kind of type operations.
Are you the Owner of the company.
I am just the Logistic Auditor for 22 regions worldwide.
We are not as yet based in Australia.
Our FAIACM has wordlwide 88 C-207.
We are in the way and possibly make all aircraft as Experimentals.
Board yet not have made final decisions.
We have 11 already converted, using 1/2 fuel per hour, as we use full Ethanol.
Price of Ethanol just US$0.65c a liter.
We can yet use the fuel in all the world, but it's coming that way.
The 3 Pilots for AUS are already ex-QF captains already working for us and ex 1 Tiger, plus 2 more ex-V.B.
Our Maintenance will be Parafield SA and Darwin NT.
About finances, we can talk over the Proposal from you or what kind of ideas would you suggest.
The Operation would start in mid October this year.

I'm not stupid and am staying on the cautious side, but this guy knows his stuff and is the one playing hard ball against my vague responses that may or may not expose him as being totally illegitimate.

Christian movements do exist, people that type like that in every day life with good intentions exist as well. Either he is REALLY good at scamming, or is genuine. [/quote]

Not quite a Newb Joined: 25 Feb 2011 Posts: 60

Does he mean 88 Casa c-207's?

Hello I'm New here! Joined: 27 Mar 2012 Posts: 4

lol nah. Cessna 207s

Not quite a Newb Joined: 25 Feb 2011 Posts: 60

OK.

Is he active in Africa somewhere?

At our airport, maintenance is carried out for one ngo, active in Congo - and yes, using Cessna C207's.

The president and the pilots of that ngo are residents in my country, so I could ask them for more info about "your" man?

Or you send me a PM.

Posted: Tue Mar 27, 2012 1:40 pm

@Faction Could you post up the headers, please so we can take a look. If you are uncertain as to find headers in the email let us know. We will be glad to help. With the header information we can ascertain his location.

Hello I'm New here! Joined: 27 Mar 2012 Posts: 4

Code:

Received: from nm38-vm4.bullet.mail.ne1.yahoo.com ([98.138.229.148]) by SNT0-MC3-F36.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Mon, 26 Mar 2012 11:24:39 -0700
Received: from [98.138.90.52] by nm38.bullet.mail.ne1.yahoo.com with NNFMP; 26 Mar 2012 18:24:39 -0000
Received: from [98.138.87.7] by tm5.bullet.mail.ne1.yahoo.com with NNFMP; 26 Mar 2012 18:24:39 -0000
Received: from [127.0.0.1] by omp1007.mail.ne1.yahoo.com with NNFMP; 26 Mar 2012 18:24:39 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 18453 invoked by uid 60001); 26 Mar 2012 18:24:39 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; s=s1024; t=1332786278; bh=N9f66wvW3OIGDcDjtEXhiz/ONDNwdvR+IIuk10n3P7c=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=M3MlQY1J3mRSrV6jTDYBBMSSbkssN1dpTMHjZH2kvoxKFFTlcg4z+zBeLpjJf4FMGfm6MroFLAC4K0p/R3phBQJzuyYPuFnEs1FxE/AX7uhelDIeM8k1mGCNF8RFD+3OqfpKCc/O/ukI7fdMwCz1Dy87HmcnKGD0o0wMFlwOwss=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=rocketmail.com;

p38cyq... sending you a message Smile

Posted: Tue Mar 27, 2012 4:08 pm

Sunnyvale California?

ipTRACKERonline.com wrote:

Header Analysis Quick Report Originating IP: 98.138.87.7 Originating ISP: Yahoo! City: Sunnyvale Country of Origin: United States * For a complete report on this email header goto ipTRACKERonline

Could Lad be using a Proxy?

Baiting Guru Joined: 27 Mar 2011 Posts: 21158

Isn't Sunnyvale the Yahoo location? There may be more in the original header there. I think is is an incomplete header.

Hello I'm New here! Joined: 27 Mar 2012 Posts: 4

Iv'e ip searched every ip in there and they are all originating from the USA. When he called he did say that i where hes from..

the entire source:

Code:

x-store-info:SmXCjkY1Un5L3qlTmewTw69gy3Wq4YV3YiBjSdfHKErOqfxeYrALMGtAcrGFrndfl7TMY82a4R1myaHEkjsnbC/50o5/9DqPGcE/oevuJlgzVvjDYtby9w==
Authentication-Results: hotmail.com; sender-id=none (sender IP is 98.138.91.176) [email protected]; dkim=pass (testing mode) header.d=rocketmail.com; x-hmca=pass
X-SID-PRA: [email protected]
X-SID-Result: None
X-DKIM-Result: Pass(t)
X-Message-Status: n:0:n
X-AUTH-Result: PASS
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtHRD0wO1NDTD0w
X-Message-Info: DFa+w7oqK+9KtdTT4RrJBXcURuOs6/BbhRnlcFSOjUYdlLQ+cjUG/oOy5/9TY22WBLmSaCzEKf3a2O34HS/y86klMNRU8oJvJQ2Cmnqw0w1rUn2YUpw9ZNoESWfoftIM6ZQt4PDMaIL6l9NrTrIwdA==
Received: from nm16-vm4.bullet.mail.ne1.yahoo.com ([98.138.91.176]) by SNT0-MC3-F36.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Tue, 27 Mar 2012 09:57:20 -0700
Received: from [98.138.90.49] by nm16.bullet.mail.ne1.yahoo.com with NNFMP; 27 Mar 2012 16:57:19 -0000
Received: from [98.138.89.165] by tm2.bullet.mail.ne1.yahoo.com with NNFMP; 27 Mar 2012 16:57:19 -0000
Received: from [127.0.0.1] by omp1021.mail.ne1.yahoo.com with NNFMP; 27 Mar 2012 16:57:19 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 25043 invoked by uid 60001); 27 Mar 2012 16:57:19 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; s=s1024; t=1332867439; bh=WlcY+w3SdXlxxIarBzcYp0IoDT335beQ/A3P3bvt8jE=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=ym1psuK9d5onCyKlokpoP1XPEv2YhR4HhlBF4qPE5Inp/jbLSb3gnlNBPYsrTwGZl8YXArhwmgRasKA8XxAe4VHB831CnOuLs66Send0QQjyKyypMa7oPYIrZ2maROJCZqcYqFNbeYYaph5PfYtsCMVFoFr9JkHf+QyKJkrG0Ok=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=rocketmail.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=dayujw57kxmDRlOPdmwlWd0pdP0Y8H/+ncRRIZzZQ73CuK2bR7e8AtpWahFHejV5s3ujOnJzYoO+zVV0Jft7xBavyjc0Qcvv1DalW5by78+uXPSJnaflwRICAB68/AZtvU6V685Irdz5BbhObtwYEk0tS6EEizf+fZgDwnjK3Z4=;
X-YMail-OSG: gCtMUsgVM1kNMDuF.nRFqlNrMf9grmOUdAoKZ_SAVTXOqWo
Avye6w1GF2Tgdm.AktqmWXQQEfAzU4kHICkSX9Cg6.VOyQvHfzFxfZmVcAvr
tM0uZXdnmKzND8SvRKD_mtBn4rqXjZNTMoU6Ci.fxDKmeiJ1_tAU78G8.5IA
JfqX2nJ_5isZbMkpyfvK0dhvkip2.B8w83GuGaE4LmTrISeQb1SBzF97PA9S
8KTZr.uG6hwCnz0C5Lqr_vG83iRwm4od8JJxu0MlClitgk6jwnRulaJsssFh
l8WNRxywPkOWadpqrGON.V4MlzOIDTO8vmzVO4S1oWaz6TloooALbkGcTjUV
.kw.Hm_8Fd9o3OUfuuX6RYz_HsJvIeoE1q1cD0fbRhq4qzmN47aWgHUPasEk
owRzI1uEnqq8p_QlO0Tu9t_6jPl6wp.bx4ZK_0WV.JYt8UDjNd6FyX616HBj
8xHj4mKcYQA52FspfN4bbKstWaOOWULdMOWTu1TbF5R9.0nARMIdQ.QBK1OW
5A80kU_sEsEVnh55PeO1fXtEcteeZbQwXAIJS9YUaeBA8du4BDzDZA_5egOb
VlRyClUnusHkEHEle6g8E4B9CnQHApuMo1bO7ab_bJMHDIPBbVHInx.2VEiD
WnZG2BA.WIYFyv8wvT8fPCBObZLxmJrEvzmro1q.oOr6jJrm.gQzgOTVRmJy
gZLNwfxdqTcjmrBYxpC23k1HtsT0-
Received: from [69.171.164.71] by web121201.mail.ne1.yahoo.com via HTTP; Tue, 27 Mar 2012 09:57:19 PDT
X-Mailer: YahooMailWebService/0.8.117.340979
References: <[email protected]> <[email protected]>,<[email protected]> <[email protected]>,<[email protected]> <[email protected]>,<[email protected]> <[email protected]>
Message-ID: <[email protected]>
Date: Tue, 27 Mar 2012 09:57:19 -0700 (PDT)
From: W B <[email protected]>
Reply-To: W B <[email protected]>
Subject: Re: G'Day Madam..
To: >
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="1402361269-573894-1332867439=:16446"
Return-Path: [email protected]
X-OriginalArrivalTime: 27 Mar 2012 16:57:20.0358 (UTC) FILETIME=[AC657860:01CD0C3A]

Baiting Guru Joined: 27 Mar 2011 Posts: 21158

The only oddity there is the leap wireless out of Houston. The other 3 are yahell.

Posted: Tue Mar 27, 2012 6:39 pm

Faction You said he called. Did he leave you a contact number? If so, is is also a US number?

Not quite a Newb Joined: 21 Mar 2012 Posts: 58

The Houston IP is the one that's where the originating node's IP normally appears.

Do you have any more info on this fellow? Phone number, format, etc? Also, was that the only e-mail you got from him, or were there more? If there were, could you post the headers from a few more of those as well. A pattern would help us recognize if the Houston IP is coincidental or not.

Baiting Guru Joined: 27 Mar 2011 Posts: 21158

This may be similar to the BlackBerry thing.

Not quite a Newb Joined: 21 Mar 2012 Posts: 58

Not to say that that isn't the case, but with the Blackberry thing, the IP line was tagged:

Quote:

Received: from b25.c16.bise7.blackberry ([email protected] with xymcookie)

The one in this header seems entirely generic.

Baiting Guru Joined: 27 Mar 2011 Posts: 21158

This may be useless, but leap leads to cricket. http://en.wikipedia.org/wiki/Leap_Wireless

Not quite a Newb Joined: 21 Mar 2012 Posts: 58

Leap leads to cricket

Sounds like a fake Confucius quote. Laughing

Silly names aside, both of those networks only provide services to US customers, so...

Master of Master Baiters Joined: 26 Sep 2008 Posts: 689

It doesn't smell like a fish even if the language looks like a fish. Don't bait until you are sure.

Wannabe Baiter Joined: 07 Oct 2010 Posts: 82

The email is only 5 months old!!!! Rocketmail email addresses you can check their profile to see how old they are. This one was created 5 months ago. That would make me think it is highly suspicious. Just out of curiosity, when did you first start talking to this guy, or when was the magazine published that contained the ad?

Posted: Wed Mar 28, 2012 11:58 pm

There are many classified/trading scams out there, and it may very well be the case that a scammer running classifieds happened upon a topic, aviation, he knows a lot about in non-scamming life.

He also could be genuine. Best way to find out is to act as if you presume he is authentic and see if he makes any unusual demands.

Or drop some Igbo slang references in there and see if he does a double take or accepts it offhand...

Not quite a Newb Joined: 27 Jan 2010 Posts: 36

Doctor Seviche wrote:

Or drop some Igbo slang references in there and see if he does a double take or accepts it offhand...

I would love to see hat he says if you drop ladspeak on him.

What do you think about this one?	View next topic View previous topic