How are they stealing all these email addys?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Elite Baiter Joined: 19 Jan 2009 Posts: 1440

For the last few weeks I've noticed many of the scam emails are showing someone else's legit email addresses in the "From"line.

Silly lads try to distract me by putting **PLEASE REPLY TO (muguscammer)@hotmail** or whatever) right in the subject line, then mentioning many times in their blurb to only reply to THAT address. Guess the dumbasses think I wouldn't notice. Fool can't even spell his name right - Micheal?

Of course I email the real person and inform them their addy has been hijacked by scammers. Quite a few wrote back to say thanks.

Pretty soon it will be impossible to trace scam mail. Anyone else noticing this trend?

Sample: (Mr. C. was happy I let him know about this)

Assets: CONTACT ME ON THIS EMAIL : [email protected]‏
From: R*** C****** (**********@svsu.org)
Sent: March 15, 2009 4:26:57 AM
To:

Dear Sir/Madam,
You have to contact the Email address: [email protected]

I know this will come to you as a surprise because you do not know me, I amBarrister Micheal Ben, the family attorney of theformer Delta state governor Chief James Onanefe Ibori who is presently in detention. My client has mandated me to seek for a trustworthy and capable person that willassist in repatriating his only secured fund that is already with a SecurityCompany, this fund was deposited by himself (Chief James Onanefe Ibori ) beforehis arrest. The true content of the package is $35m (£17m) USD all in 100.00bills. However, this deposit was tagged as family effects, as some of his assetshas been frozen and refrozen. As such I will advise you visit the link below formore details and clarification. http://news.bbc.co.uk/2/hi/africa/7035427.stm Base on the above details, I advise on utmost confidentiality even if you arenot willing to help out, as this is his only securedfund Untouched at the moment. Please kindly furnish me with the following: (a) Your full names,(b) Yourcontact address,(c) Your phone and fax numberss,(d) Company name and address(ifany). Yours Faithfully,Barr. M1cheal Ben.(San)
Email : USE THIS EMAIL [email protected]

Master Baiter Joined: 23 May 2008 Posts: 226

When a program sends an email it is just putting everything in a certain format for you. If you know this format or "Header" you can make a script to send it how you want it. I can send you an email from Bill Gates if you want me to. I do not need access to his email for this to work. I could also take a mugu email and send out a 1,000 emails to other mugus from him.

Posted: Thu Mar 19, 2009 7:06 pm

Yep - sadly the From address is separate to the Reply-To address. If you read the RFC for SMTP (basically the instructions for how to 'do' email) you'll see there's no burden of proof that you truly *are* from the email address you gave - this is because email works by passing the message from server to server, and each one can't check. This means it is a trivial job to forge the 'From' address Sad

Posted: Thu Mar 19, 2009 7:16 pm

Spammers have been doing that for many years. It means than bounces and complaints go to the real owner of the spoofed address.
It's happened to me a couple of times. It doesn't usually last more than a couple of days though.

Posted: Thu Mar 19, 2009 7:34 pm

Yeah, one of my baiting mailboxes just received about 160 bounces from a scam email that someone had obviously sent using my email addy in the TO field. Kinda pissed me off. So naturally I started baiting the lad from another addy. Twisted Evil

Posted: Thu Mar 19, 2009 8:23 pm

One of my catcher accounts got clogged up by several thousand bounces when a Lad put that email address in the FROM field of a cheque scam message.

So naturally I called for a mass bait on the mugu. This is still in progress...

Posted: Thu Mar 19, 2009 8:35 pm

I got this one check lad mad at me when he figured out that he wasn't getting the money. He threatened me with legal action. I wrote back to tell him that he was a big giant chicken, and that he should lay an egg for me. I also told him he needed to walk around like a chicken, bob his head back and forth, and flap his arms like wings while making clucking noises.

He then told me that I'd be very sorry for saying that.

Within three days there were 14000+ bounced messages to that account I was baiting him from.

It wasn't about a scam, it was actually a spam on some software product or something like that.

How are they stealing all these email addys?	View next topic View previous topic