SmartFeedSmartFeed          

Porsche Hangout


WELCOME - YOU ARE CURRENTLY VIEWING 419EATER AS A GUEST

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

ScamWarners.com - Internet Anti-Fraud Center - now open!


 Lad writes from his friends phone, ideas?

View next topic
View previous topic
 
Post new topicReply to topic
Author Message
Master of Puppets
Baiting Guru


Joined: 12 Mar 2009
Posts: 3295
Location: Pulling the Strings


PostPosted: Sat Sep 26, 2009 5:59 pm Reply with quoteBack to top

This is interesting. The lad was supposed to send my character's boss a form this weekend, instead my character received this:

Quote:

Dear Charlie xxx,

i am very sorry for attaching the form is i told,i am not close to my house i want for a burier ceremony,i am writing you from my friend phone,please when i arrive i will attach the form i have fill the form all i need to do is to attach it.

i am truely sorry for the delay please dont be angry with and your boss...ok

THANKS

LUCKY xxxx


Thing is, his IP still shows him in Nigeria but it HAS changed. Any idea's?

New Header is this:
Quote:

Delivered-To: [email protected]
Received: by 10.204.99.79 with SMTP id t15cs65399bkn;
Sat, 26 Sep 2009 04:19:23 -0700 (PDT)
Received: by 10.220.107.227 with SMTP id c35mr2256744vcp.0.1253963962280;
Sat, 26 Sep 2009 04:19:22 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mx.000webhost.com (ns01.000webhost.com [66.197.153.229])
by mx.google.com with ESMTP id 42si6991363vws.54.2009.09.26.04.19.20;
Sat, 26 Sep 2009 04:19:21 -0700 (PDT)
Received-SPF: neutral (google.com: 66.197.153.229 is neither permitted nor denied by domain of [email protected]) client-ip=66.197.153.229;
Authentication-Results: mx.google.com; spf=neutral (google.com: 66.197.153.229 is neither permitted nor denied by domain of [email protected]) [email protected]; dkim=pass (test mode) [email protected]
Received: from n11b.bullet.mail.mud.yahoo.com (n11b.bullet.mail.mud.yahoo.com [209.191.125.178])
by mx.000webhost.com ([000webhost.com Mail System]) with SMTP id D2A881C0082
for <[email protected]>; Sat, 26 Sep 2009 07:21:07 -0400 (EDT)
Received: from [68.142.200.227] by n11.bullet.mail.mud.yahoo.com with NNFMP; 26 Sep 2009 11:19:19 -0000
Received: from [67.195.9.82] by t8.bullet.mud.yahoo.com with NNFMP; 26 Sep 2009 11:19:19 -0000
Received: from [98.137.27.212] by t2.bullet.mail.gq1.yahoo.com with NNFMP; 26 Sep 2009 11:19:19 -0000
Received: from [127.0.0.1] by omp122.mail.gq1.yahoo.com with NNFMP; 26 Sep 2009 11:19:19 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 20677 invoked by uid 60001); 26 Sep 2009 11:19:19 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1253963959; bh=zAt1TsuSX2U8YVzgM+Mr2rmUo/ZkPHQY1vzv1J+VMV8=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=<blowout-snip>
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=<blowout-snip>
Message-ID: <[email protected]>
X-YMail-OSG<blowout-snip>
Received: from [41.184.22.14] by web112509.mail.gq1.yahoo.com via HTTP; Sat, 26 Sep 2009 04:19:18 PDT
X-Mailer: YahooMailClassic/7.0.14 YahooMailWebService/0.7.347.2
Date: Sat, 26 Sep 2009 04:19:18 -0700 (PDT)
From: Lucky xxxxxxx <[email protected]>
Subject: DONT BE ANGRY
To: Charlie xxxxxx <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1856307415-1253963958=:20164"

--0-1856307415-1253963958=:20164
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable


Old header was this:
Quote:

Delivered-To: [email protected]
Received: by 10.204.99.79 with SMTP id t15cs44101bkn;
Wed, 23 Sep 2009 12:08:05 -0700 (PDT)
Received: by 10.220.78.13 with SMTP id i13mr4221156vck.36.1253732884892;
Wed, 23 Sep 2009 12:08:04 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mx.000webhost.com (ns01.000webhost.com [66.197.153.229])
by mx.google.com with ESMTP id 3si1895416vws.4.2009.09.23.12.08.03;
Wed, 23 Sep 2009 12:08:03 -0700 (PDT)
Received-SPF: neutral (google.com: 66.197.153.229 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=66.197.153.229;
Authentication-Results: mx.google.com; spf=neutral (google.com: 66.197.153.229 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]; dkim=pass (test mode) [email protected]
Received: from web112518.mail.gq1.yahoo.com (web112518.mail.gq1.yahoo.com [98.137.26.190])
by mx.000webhost.com ([000webhost.com Mail System]) with SMTP id BB06D1C096C
for <[email protected]>; Wed, 23 Sep 2009 15:09:38 -0400 (EDT)
Received: (qmail 73856 invoked by uid 60001); 23 Sep 2009 17:30:19 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1253727019; bh=PrdQ9oH6EQNDGAEwBniSwYvHSraxKAv9mCxT0HDrOas=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=F7RL6tbEQnkSSMpdBYucQ4z+jx0DW0/hRtC/sfYZsUZ0vG6RNpQU1Sh94MZ2MleN+27ENmGhZgLPIIB2lxYcf3txRQf9M49y4dpuUu4qKdJGbRlCbU+EFwsNvisX7BSCNqddsFKpzAK4N1RBBlhIkDcDuWb6u7Y+AJctzNOW9wY=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=nmChfKrxJ7FP4pbTvpDPZHM75EBemTC9xOUD4bAI6c0qWwd/1hTiJZ4QqW+Q8oQt8rhs91f1X3Z29s5jr5dge30tBGKD+R5+qczqOfAE/LzQ427HbBr28Mh42vMg/QeLO9hg5OtHZNwtX/pHKav2ezpnxJAOuwvG3IjugPk2EPo=;
Message-ID: <[email protected]>
X-YMail-OSG: p869Cn0VM1m8rCHtqJ6BltjpnoQH.rESmsWVLHHzVq4_Iz2G5QxMIFoT26tV9rV8V5ribEDOCxNX.1t3yNwJq3dOfROJqT.1RZpkBJYJ2j0klibNKgCdokmdXcel9yS6rqJ_xJAEsEekvECe40qWSPb72uZaDF8gjiX5NwRFXXEWC7zxLDeQQf5woSchS62sFKn76OECoBMC_KJw4BT42Wfo8aptemuSzvEhkV8o
Received: from [41.219.192.129] by web112518.mail.gq1.yahoo.com via HTTP; Wed, 23 Sep 2009 10:30:19 PDT
X-Mailer: YahooMailClassic/7.0.14 YahooMailWebService/0.7.347.2
Date: Wed, 23 Sep 2009 10:30:19 -0700 (PDT)
From: Lucky tony <[email protected]>
Subject: I NEED YOUR URGENT ATTENSION
To: Charlie Attle <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-2043122590-1253727019=:72858"

_________________
Closed lad accounts x4 Goat Easter Egg
Oke: Todger club entry submission + T.W.A.T (Co-bait with Albator)

Last edited by Master of Puppets on Sat Sep 26, 2009 6:08 pm; edited 1 time in total
View user's profileSend private message
sir scam alot
Doesn't share his goats


Joined: 19 Mar 2008
Posts: 5076
Location: Louisiana


PostPosted: Sat Sep 26, 2009 6:03 pm Reply with quoteBack to top

That's definitely Yahoo used from a mobile device. IP comes back as IPNX Nigeria Ltd.

_________________
Safari = Rev. JB Johnson. Lome to Parakou "i thought it will just be a day jouney. unknowingly to me that it will last up to one week."
Safari2 = Harrison: Owerri, Nigeria to Cotonou, Benin and Accra, Ghana "i know ive been a sucker for twat "
Safari = (Group safari) Oy3nka Ch1dinma: Lagos to Cotonou: "Thank you so much for the embrassment."
Safari = Group safari - Dan Nkwerre: Port Harcourt to Abeche, Chad
Safari2 = Barr. Mustapha Marlick: Lome, Togo to Abuja Nigeria and Accra, Ghana.
pony Mortar x15 (some survived) Closed lad accounts x280 T.W.A.T Nurse Nastys Audi TT United States
<b>Have you kicked your lad today?<b>
Over $1 million USD in fake checks/money orders confiscated Easter Egg
View user's profileSend private message
Master of Puppets
Baiting Guru


Joined: 12 Mar 2009
Posts: 3295
Location: Pulling the Strings


PostPosted: Sat Sep 26, 2009 6:06 pm Reply with quoteBack to top

Thanks for that SSA Wink

What I actually wanted to ask, but forgot to do: Who safari'd my lad?

_________________
Closed lad accounts x4 Goat Easter Egg
Oke: Todger club entry submission + T.W.A.T (Co-bait with Albator)
View user's profileSend private message
sir scam alot
Doesn't share his goats


Joined: 19 Mar 2008
Posts: 5076
Location: Louisiana


PostPosted: Sat Sep 26, 2009 6:12 pm Reply with quoteBack to top

He could be anywhere with that IP. For example. I live in Florida but my mobile phone comes up with a South Carolina or Kansas IP, sometimes California.

In a nutshell, probably didn't go for a safari, just had to take care of other stuff. Looks like he may have been telling the truth for once.

Then again, if you ever dollachop him, he may suspect the friend. Wink

_________________
Safari = Rev. JB Johnson. Lome to Parakou "i thought it will just be a day jouney. unknowingly to me that it will last up to one week."
Safari2 = Harrison: Owerri, Nigeria to Cotonou, Benin and Accra, Ghana "i know ive been a sucker for twat "
Safari = (Group safari) Oy3nka Ch1dinma: Lagos to Cotonou: "Thank you so much for the embrassment."
Safari = Group safari - Dan Nkwerre: Port Harcourt to Abeche, Chad
Safari2 = Barr. Mustapha Marlick: Lome, Togo to Abuja Nigeria and Accra, Ghana.
pony Mortar x15 (some survived) Closed lad accounts x280 T.W.A.T Nurse Nastys Audi TT United States
<b>Have you kicked your lad today?<b>
Over $1 million USD in fake checks/money orders confiscated Easter Egg
View user's profileSend private message
Display posts from previous:      
Post new topicReply to topic


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



E-Mail Header Analysis


All Content © 2003 - 419Eater.com
Powered by phpBB © 2001, 2002 phpBB Group :S5: FI Theme :: All times are GMT