NEW TYPE OF SCAM?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 26 Jan 2009 Posts: 3

Hi to everyone here, I was just wondering if anyone has come across this type of scam. I sell goods over the internet and lately I have had a lot of e-mails from interested buyers who some want large amounts of my product and some who don't, but they all have one thing in common, they are willing to pay for these goods but they want them shipped to Nigeria either to their relatives or because they own some kind of shop there, their emails come from USA and UK, they want to arrange payments to my bank account and they don't shy away when I mention that payment will be with Paypal, is there a new type of scam where they use Paypal?

Posted: Mon Jan 26, 2009 12:19 pm

Stolen and hacked paypal accounts are reasonably common... even more common these days are approaches via listing sites where you may have posted your email address.
What items do you sell? Many scammers want high value mobile phones etc, but really they want anything that they can sell off for cash. They prefer to pay via fake cheque, but stolen Credit Cards and Paypal accounts can and are used. More likely is that these scammers will pay by cheque after they encounter "problems" with paypal.

scamtracker wrote:

their emails come from USA and UK

Are you sure? It's not unheard of, but not common really. Do the email addresses lead you to believe that, or have you tried analysing the message header yet? I only ask as something that appears to be from the UK (for example yahoo.co.uk) can be from anywhere in the world.

If you need help analysing headers, just ask.

Welcome to 419eater! Smile

Hello I'm New here! Joined: 26 Jan 2009 Posts: 3

Yes Thank you, I could use some help on understanding Headers here is one

Return-Path: <[email protected]>
Authentication-Results: mta176.mail.re2.yahoo.com from=gmail.com; domainkeys=pass (ok); from=gmail.com; dkim=pass (ok)
Received: from 209.85.217.33 (EHLO mail-gx0-f33.google.com) (209.85.217.33) by mta176.mail.re2.yahoo.com with SMTP; Mon, 26 Jan 2009 01:06:00 -0800
Received: by gxk14 with SMTP id 14so2916365gxk.19 for <[email protected]>; Mon, 26 Jan 2009 01:06:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=2ES/KVK61xg1+UPsmyavpV2ZIUUGbEl7z7u1j4CuB6A=; b=HovAsXVCjGYK6vp5kytyRh09vRma9T/nXgjki2hpwaGXVkBFDOWltg1FRLF7GNNVGh lcFBDa62wEnHKL8BVbbIOzmbTBuys/8lOdqnbS/oAKPCHJNBjvDdhyidgV50leSoMSGB 5YSwDgD6qXMH9+hNKWxDBrFHtO1P47xU6fNts=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=qSD1sRsIXvCtbbpMzy0fwERMtw/fzWzrHiAhE5rOPS+WUn+h+kkfRpG2Qa76rEzuuN wEEPGJu5O43ugRbF1FXqLVGqkj+t5AJyRsUD6sFNIBuXhJ9TF5uECZmrfECfKUWrYVw0 Ym5y0fn9MA6i+HOJ8Jylhmzf3T/ga6mhKuUzc=
MIME-Version: 1.0
Received: by 10.100.126.15 with SMTP id y15mr403228anc.38.1232960760193; Mon, 26 Jan 2009 01:06:00 -0800 (PST)
In-Reply-To: <[email protected]>
References: <[email protected]> <[email protected]>
Date: Mon, 26 Jan 2009 01:06:00 -0800
Message-ID: <[email protected]>
Subject: =?ISO-8859-7?B?UmU6IFBzcCBTbGltIMrh6e3v9fHp4Q==?=
From: This sender is DomainKeys verified
Davies Andrew <[email protected]>

Posted: Mon Jan 26, 2009 12:41 pm

For easy analyzing of email headers you can use this tool:

http://headertool.apelord.com/headers

Unfortunally, the email you got was send from Google Mail
And Google doesn't tell you the originating IP when used from the web frontend.

Posted: Mon Jan 26, 2009 12:41 pm

He's using Gmail, so no chance of tracing him. It's one of the few email providers that masks/strips originating IPs. No matter, from what you've said about shipping to Nigeria, he's in all likelyhood in Nigeria.

If you ever get mails like this from other sellers that are using other email providers such as hotmail or yahoo for example, you can enter the whole header at http://headertool.apelord.com/ and it will break it down for you. The last IP is usually the originator. That IP can be entered at http://www.ip-adress.com/ip_tracer/ for an accurate trace (or about as accurate as you'll get.

There is another thread running right now with the same queries, I'll link to it in a moment:
Here you go: http://forum.419eater.com/forum/viewtopic.php?t=156323&highlight=

Edit: Beaten to the punch by viking.

Hello I'm New here! Joined: 26 Jan 2009 Posts: 3

Thanks for all the info and help