A scam that my Wife received.

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Feb 05, 2009 12:04 am

This is my first post here so please bear with me. My wife received an email from a friends email address. She thought it sounded fishy. I took a look at the header and saw that it came from Lagos, Nigeria. Is this a common scam and does the scammer have her friends address and password to be able to send this type of email? My wife will call her friend tomorrow to let her know about the email. I put x's in place of the friends name. Also, the "to" and "from" was both the friends name.

Here is the email followed with the header info and a whois query:

email:

Quote:

> Date: Wed, 4 Feb 2009 10:10:06 -0800
> From: [email protected]
> Subject: Urgent!!!
> To: [email protected]
>
> Hello
> How are you? Hope everything is ok? I just want to know if you can be of help to me. Something terrible happened to me on a trip. I came to visit a new researchers' complex in Wolverhampton, Imperial College, Gallery Section,UK. Well to my utmost Dismay i the Hotel i lodged got razed by fire caused by an electricity spark.i have lost virtually all i have with me (which included my cash, diaries and credit cards). My cellphones were not brought along since I did not get to roam anybody before coming over. The phone cables have been burnt including internet connection cables and the Hotel's database has been compromised as well.I have spoken to the Embassy and they are responding to the matter effectively, and I have also filed a report with the British police.
>
> Please I need you to lend me about $2,730. You should help me have it sent via Western Union Money Transfer so I can re-arrange myself and return back home. I will refund the money back to you once I am out of here . Below is the information you require
>
> NAME-xxxxxxx xxxxx
> ADDRESS-FOX HOTELS(HARBOUR VIEW ROAD
> CITY-WOLVERHAMPTON
> COUNTRY-UK
> ZIPCODE-WH 11AD
>
> Once again i want to assure you this is not an hoax!!immediately you have the money transfered,please help me scan or write out the MTCN Number given to you at the western union outlet.i will be waiting anxiously for your positive response.
> Thanks

Header:

Quote:

Wed, 4 Feb 2009 10:10:16 -0800
Received: (qmail 3388 invoked by uid 60001); 4 Feb 2009 18:10:08 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Message-ID;
b=AGJTLAo2mhfvBkkwySPREU9NtlbvwUlo8wA64xXxbh5XQjwSQDUTSucub
DlUmAX7PVhbIsOtEOzETFl5t108nW+UEMMj9auDYhKzTujVGCOUtER5CXu
usdgIA1921aosyaCc3Sjv0//ObM8ZohK4lAHffn/1ZyvpX2ovTfZHRc=;
broke up domain key to fix thread blowout -Ima

Received: from [213.181.90.250] by web65511.mail.ac4.yahoo.com via HTTP; Wed, 04 Feb 2009 10:10:06 PST
X-Mailer: YahooMailWebService/0.7.260.1
Date: Wed, 4 Feb 2009 10:10:06 -0800 (PST)
From: xxxxxxx xxxxx <[email protected]>
Reply-To: [email protected]
Subject: Urgent!!!
To: [email protected]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-ID: <[email protected]>
Return-Path: [email protected]
X-OriginalArrivalTime: 04 Feb 2009 18:10:17.0004 (UTC) FILETIME=[D54566C0:01C986F3]

Whois Query:

Quote:

% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net[whois]/db/copyright.html

% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '213.181.64.0[whois][trace][reverse ip] - 213.181.95.255[whois][trace][reverse ip]'

inetnum: 213.181.64.0[whois][trace][reverse ip] - 213.181.95.255[whois][trace][reverse ip]
org: ORG-BL4-RIPE
netname: NG-BROADBANDTECH-20000327
descr: BT Limited
country: NG
admin-c: IO243-RIPE
tech-c: IO243-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered

organisation: ORG-BL4-RIPE
org-name: BT Limited
org-type: LIR
address: BT Limited
8B Ademola Street , Off Awolowo Road, S. W. Ikoyi
Lagos
Nigeria
phone: +234 1 2693192
fax-no: +234 1 2693192

Elite Baiter Joined: 19 Jan 2008 Posts: 1043

It's not an uncommon scam, but it certainly is a scam. A scammer has her friend’s password. It's good that your wife is telling her, but you may also want to send a quick email to any mutual friends giving them a warning.

I think yahoo are pretty good about getting accounts back, but you should tell her to do it quickly, also, she will want to change the passwords on any other account that may have been compromised. I.E. she may have used the same password, confirmation emails in the cracked account, etc etc. Also, if she does online banking, notify the bank and ask them to watch for any suspicious transactions.

Edit: Well done on catching this and doing the research. Welcome to the forum, have a read and see if you'd like it here. We're a nice bunch really.

Posted: Thu Feb 05, 2009 12:25 am

Thanks for the quick reply Newdonym.

I've been registered here a while and I'm trying to learn how to bait. I guess I need to get a Mentor and start baiting. I usually have a couple of hours a day that I could play around with the Lads.

Thanks also to the person who fixed the blowout. I wasn't sure how important the format should be on the header.

Elite Baiter Joined: 19 Jan 2008 Posts: 1043

My pleasure Dingbat.

I should have noticed that - I really need to get some sleep. A mentor is a wonderful thing and a couple of free hours is more than enough. Newdonym's top tip is "Never do more work than your lads".

you can get down with a nice straight bait whilst you wait for a mentor. I'm sure you already know, but all you have to do is get an untracable gmail account and a few letters from surplus, then you're good to go.

Also, Eater-U is full of great info and hot co-eds (we keep that bit quiet for fear of a stampede).

Posted: Thu Feb 05, 2009 1:58 am

Well done for spotting it! Time is of the essence for these scams - your wifes friend needs to contact her email provider immediately to get the account frozen before more damage is done or any fallings out occur from friends trying to help and losing money. If she can't do that tonight, make it the first thing she does.

In fact it may be worth you emailing her email provider straight away asking for a suspension (forward them the email and full headers) on the grounds that it's a fraudulently hijacked account - they may not take your instruction though, which is fair enough I guess!

Posted: Thu Feb 05, 2009 4:38 am

Welcome dingbat! Very Happy

I am sorry for the problem that brought you here, but you sure did some nice gathering of information.

Good advice above. Phishing is a way that scammers get people's passwords. Evil or Very Mad

It looks like you have good instincts to be a baiter. I hope you will stay around and get up to speed on baiting.

Posted: Thu Feb 05, 2009 2:37 pm

Thanks for the compliments and advice. I've passed the information on to my wife.

Scammers make me mad! Evil or Very Mad

Baiting Guru Joined: 03 Mar 2006 Posts: 7103 Location: Yes

Welcome to the club. Wink

Posted: Thu Feb 05, 2009 5:49 pm

dingbat wrote:

Scammers make me mad!

That's a fairly common sentiment in these parts buddy.

We encourage anger and resentment towards these slime. Grab a few of them in the Surplus forum and take them for a nightmare ride!

Welcome to eater!

Very Happy

Posted: Thu Feb 05, 2009 5:58 pm

The only thing I would add to the good advice already given is I'd suggest your wife's friend take steps to protect her ID. Access to email can give the scammer access to passwords used to access shopping sites and cc sites.

Posted: Thu Feb 05, 2009 6:16 pm

embalmer wrote:

The only thing I would add to the good advice already given is I'd suggest your wife's friend take steps to protect her ID. Access to email can give the scammer access to passwords used to access shopping sites and cc sites.

Thanks for the info. My wife tried to call her and the phone has been disconnected. I wonder if this ID theft has been going on long enough to have caused other problems for her. A mutual friend is in the process of trying to reach her.

I wish there was a way to find this scammers other scams (assuming there are others), so as to be able to bait the SoB into oblivion.

Posted: Thu Feb 05, 2009 8:24 pm

We *all* have a few scammers who particularly rile us who we'd love to nail, it's a shame you can't guarantee personal revenge, the next best thing is to just torture the whole group and hope one of your fellow baiters is making yours suffer...

A scam that my Wife received.	View next topic View previous topic