Is this a Safari?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri May 11, 2007 12:04 pm

Okay so I have been working with my mentor TheDevGuy and Jojobean on this.... so hopefully they will read it and advise as well.

We got this guy.... the original e-mail IP puts him in South Africa. We sent him a WU form that could only be received in Abuja. He originally wanted the money sent to him in Lagos. I just got an e-mail claiming that he is in Abuja and the WU there says that the form I sent him is no good. A couple questions

(1) Did Jojo lie to me about this money? Laughing

(2) attached are the headers. I need help parsing the IP's. The second one I can only get to tell me is in Nigeria, but not what city....

Thanks for any help you can give. He is of course beging now for the MTCN..... so if he is traveling I think I will give him a fake one. If he is not traveling off to McDuck he goes!

Original Header:

Delivered-To: @gmail.com
Received: by 10.78.47.12 with SMTP id u12cs483453huu;
Wed, 9 May 2007 22:39:16 -0700 (PDT)
Received: by 10.100.166.14 with SMTP id o14mr446030ane.1178775556359;
Wed, 09 May 2007 22:39:16 -0700 (PDT)
Return-Path: <@yahoo.com>
Received: from web59215.mail.re1.yahoo.com (web59215.mail.re1.yahoo.com [66.196.101.41])
by mx.google.com with SMTP id c30si14627661ana.2007.05.09.22.39.15;
Wed, 09 May 2007 22:39:16 -0700 (PDT)
Received-SPF: pass (google.com: domain of @yahoo.com designates 66.196.101.41 as permitted sender)
DomainKey-Status: good (test mode)
Received: (qmail 48325 invoked by uid 60001); 10 May 2007 05:39:15 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com; Snip to prevent blowout
_bR6wkg--
Received: from [196.47.88.158] by web59215.mail.re1.yahoo.com via HTTP; Wed, 09 May 2007 22:39:15 PDT
Date: Wed, 9 May 2007 22:39:15 -0700 (PDT)
From: @yahoo.com>
Subject: thanks
To: @gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1230848287-1178775555=:48263"
Content-Transfer-Encoding: 8bit
Message-ID: <[email protected]>

--0-1230848287-1178775555=:48263
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

Abjua header:

Delivered-To: [email protected]
Received: by 10.78.47.12 with SMTP id u12cs558324huu;
Fri, 11 May 2007 04:33:40 -0700 (PDT)
Received: by 10.100.240.19 with SMTP id n19mr2103707anh.1178883220246;
Fri, 11 May 2007 04:33:40 -0700 (PDT)
Return-Path: <[email protected]>
Received: from web59205.mail.re1.yahoo.com (web59205.mail.re1.yahoo.com [66.196.101.31])
by mx.google.com with SMTP id b14si22758401ana.2007.05.11.04.33.39;
Fri, 11 May 2007 04:33:40 -0700 (PDT)
Received-SPF: pass (google.com: domain of @yahoo.com designates 66.196.101.31 as permitted sender)
DomainKey-Status: good (test mode)
Received: (qmail 372 invoked by uid 60001); 11 May 2007 11:33:39 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
NerYXXCm7LwserIRnHXbyWO5mUtc2feyLqnHwxPfO4 (snip to prevent blowout)
Received: from [41.204.237.188] by web59205.mail.re1.yahoo.com via HTTP; Fri, 11 May 2007 04:33:38 PDT
Date: Fri, 11 May 2007 04:33:38 -0700 (PDT)
From: <@yahoo.com>
Subject: NO PASSWORD FOUND IN ZENITH BANK ABUJA
To:
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1529187682-1178883218=:94360"
Content-Transfer-Encoding: 8bit
Message-ID: <[email protected]>

--0-1529187682-1178883218=:94360
Content-Type: text/plain; charset=iso-8859-1

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

Quote:

% Information related to '196.47.88.0 - 196.47.88.255'

inetnum: 196.47.88.0 - 196.47.88.255
netname: MWEB_AFRICA_VSAT_Block29
descr: VSAT-EUTELSAT-5-MWEB-AFRICA
country: NA
admin-c: FS2-AFRINIC
tech-c: FS2-AFRINIC
status: ASSIGNED PA
mnt-by: MWEB_AFRICA
source: AFRINIC # Filtered
parent: 196.47.64.0 - 196.47.95.255

person: Frederik Strauss
address: Private Bag x0001
address: N1 City
address: 7463
address: South Africa
phone: +27215968537
e-mail: [email protected]
nic-hdl: FS2-AFRINIC
source: AFRINIC # Filtered

Quote:

% Information related to '41.204.232.0 - 41.204.239.255'

inetnum: 41.204.232.0 - 41.204.239.255
netname: DIRECTONPC-VSAT-ISP-NETBLK
descr: Wireless broadband Internet service of Direct On PC Ltd. These
descr: IP address are used for V-sat broadband connectivity static IP
descr: pools.
country: NG
admin-c: SD4-AFRINIC
tech-c: SD4-AFRINIC
status: ASSIGNED PA
mnt-by: DOPCNG-MNT
mnt-lower: DOPCNG-MNT
source: AFRINIC # Filtered
parent: 41.204.224.0 - 41.204.255.255

person: Saroj Dey
address: Direct On PC Ltd
Plot B,
Block 1,
Ilupeju Industrial Avenue,
Ilupeju,
Lagos,
Nigeria
phone: +23412701700
fax-no: +23412713554
e-mail: [email protected]
nic-hdl: SD4-AFRINIC
source: AFRINIC # Filtered

His ISP is based in Lagos but they have offices in Abuja and Port Harcourt. They were the offical ISP for Miss World 2002 in Abuja, (or would have been.) He could be anywhere in the country.

Posted: Fri May 11, 2007 1:35 pm

Well, the two IPs are definately from South Africa and Nigeria. So, if this is in fact the same guy emailing you, then yes, that is certainly a nice long safari. The obvious question is whether or not it is the same individual that emailed you. I have been pestering a lad for months now that was born and raised in Nigeria but now lives in South Africa. It would be all too easy for him to have a friend or relative show up at a bank in Nigeria if I set that up. As the baiter, only you have a good enough feel for whether or not your lad is the same guy that emailed from both locations. If it's him, congrats on a great safari.

Posted: Mon May 14, 2007 3:35 pm

Quote:

(1) Did Jojo lie to me about this money?

Don't know why everyone is having such a problem with WU Secure lately.

As YW said, you generally have to measure the lad emails. DO they appear to be from the same lad- same misspellings, phrases, typing habbits, etc. If I remember correctly, we sent him a large enough amount of money to encourage him to spend that money in travel. South Africa lads generally have more money to spend and are a bit more willing to travel, in my experience anyway.

Posted: Mon May 14, 2007 4:11 pm

My gut is that he made the trip. I was originally supposed to send him $1,000.00 but when I "had" to send it to another city we made it $2,999.00 to cover travel related expense. He then tried to get the money in Lagos for a few days, but then claims to have made the trip. Now he is freaking out e-mailing me twice a day for the MTCN and going on about how he had to borrow money to make the trip and now has to pay it back.... I hope the loan shark takes care of him, but that is another story.

Anyway, I am feeling confident enough to call it a safari based on the e-mails having the same tennor of how they were written and mis-spelling etc.

I have to give much of the credit to Jojo as he helped with sending information to the lad from WU. Thanks jojo!

BTW this lad is still on the hook and I am going to see about getting him over to McDuck today Twisted Evil

Then to Beavis and his crew Twisted Evil