Coincidence?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Mon Feb 11, 2013 12:24 pm

I'm currently baiting two lads in the Benin Republic - two different scams, different names and email addresses.

So when they both got round to the question of sending payment, I replied by saying I'd received an email from their 'business associate' saying that I was to send the money to them instead. Of course I then doctored a couple of forwarded emails and passed them details of the other lad I was baiting in each instance, to make it look as if they had been dollar chopped by each other.

The result wasn't quite what I expected. One lad hasn't replied at all and the other has sent me a further payment request but now with the other lad's details as the intended recipient, exactly as I had amended it!

I'm not sure whether he just hasn't read it properly or whether both lads are actually the same person. What's the chances of that? Shocked

I shall await further developments, but even I'm getting confused now Very Happy

Posted: Mon Feb 11, 2013 1:19 pm

Is the IP the same? Same IP could indeed be same lad.

Posted: Mon Feb 11, 2013 1:22 pm

He's going to impersonate the other lad?

Posted: Mon Feb 11, 2013 2:55 pm

Captain Grey wrote:

I'm not sure whether he just hasn't read it properly or whether both lads are actually the same person. What's the chances of that? Shocked

Not too slim, actually, but the odds of course depends on how you dragged him into your web in the first place. Wink

But yeah, it's absolutely possible. Some lads are stupid enough to try to run different formats on the same mugu, others does it to test the mugu. It has definitely happened to me before - far more than once, I've found mail from a lad I was baiting with another character, in the spamfilter of an unrelated account. Wink

Elite Baiter Joined: 19 Jan 2009 Posts: 1440

The lads often get their email accounts shut down by angry people. Of course they set up a new one in 2 minutes and it's business as usual, but they don't recall who they sent an email to.

This may have happened with your lad and when you sent him his other email, he realized his blunder which is why he's not sending you a bunch of voodoo curses.

Impossible to know if it's the same lad without the IP addy.

Posted: Mon Feb 11, 2013 3:10 pm

This is not uncommon, I think. For example, I'm currently baiting at least three lads from the same gang at the same time. I know they must be from the same gang because they've each sent me the same bank account, which I've reported to Alan three times. The way I know they aren't the same lad is because I've played my characters in a different way with each of them, and none of them has called me on it or twigged. Apparently they don't compare notes on their magas.

Posted: Mon Feb 11, 2013 4:55 pm

This is one of the lad's email headers:

Quote:

Received: from [41.216.44.173] by web163006.mail.bf1.yahoo.com via HTTP; Wed, 16 Jan 2013 01:31:07 PST
X-Mailer: YahooMailClassic/15.1.2 YahooMailWebService/0.8.130.494
Message-ID: <[email protected]>
Date: Wed, 16 Jan 2013 01:31:07 -0800 (PST)
From: "Mr.John West" <[email protected]>
Reply-To: [email protected]
Subject: Re: PAYMENT HAS BEEN SENT TODAY

and this is the other:

Quote:

Received: by 10.50.11.49 with SMTP id n17csp81777igb;
Mon, 14 Jan 2013 12:47:39 -0800 (PST)
X-Received: by 10.68.232.195 with SMTP id tq3mr258330323pbc.70.1358196458881;
Mon, 14 Jan 2013 12:47:38 -0800 (PST)
Return-Path: <[email protected]>
Received: from blu0-omc1-s22.blu0.hotmail.com (blu0-omc1-s22.blu0.hotmail.com. [65.55.116.33])
by mx.google.com with ESMTP id a6si15655387paw.197.2013.01.14.12.47.38;
Mon, 14 Jan 2013 12:47:38 -0800 (PST)
Received-SPF: neutral (google.com: 65.55.116.33 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=65.55.116.33;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 65.55.116.33 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from BLU156-W9 ([65.55.116.7]) by blu0-omc1-s22.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 14 Jan 2013 12:47:11 -0800
X-EIP: [RkXKJDvwEcM/xmINjHXH2N60KmQkla5k]
X-Originating-Email: [[email protected]]
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_025ccff1-50ae-4ef1-9775-58f55886555e_"
From: "Dr. John Hillary" <[email protected]>

I still have a lot to learn about IP identification, so the above doesn't mean a lot to me I'm afraid Confused

Posted: Mon Feb 11, 2013 6:50 pm

The menu under the 419Eater banner at the top of the page ^^^ has "Track IP Address". Click that, then IP Address -> Email Header Analysis. Paste the header in the box and you'll be told the originating IP.

The first one you posted resolves to Benin, the second to Microsoft's servers. Currently email headers from messages in hotmail, outlook, and live.com are all resolving to Microsoft, effectively masking the IP.