Silly question on surplus scams

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Not quite a Newb Joined: 24 Jul 2010 Posts: 68

I have been posting a few surplus scams - and happy to do it too if it helps anyone here. I get a lot of scams in my catcher account and was wondering if anybody uses the surplus scams.

If people want more, I've a lot more to post - but don't want to be appearing to be spamming the surplus forum.

Posted: Sat Aug 21, 2010 8:01 am

Lots of members use the "Surplus" forum for baiting. Its not behind a log-in and therefore its also a good way of getting scammers email addresses into Google so that potential victims can find scammers emails.

Please feel free to post as many scam mails as you want. make sure you strip out your own email addy and read the posting guidelines on the forum (you'll save all the Mods , but especially Branwen, lots of time editing posts and titles)

Not quite a Newb Joined: 24 Jul 2010 Posts: 68

Thanks MusicMan. I got a lovely PM from Branwen earlier thanking me for being neat in posting my surplus scams. Did blush, I did.

Posted: Sat Aug 21, 2010 8:36 am

Aussiegal
Just had a look at your posts - Nice done, and quite a bunch Shocked

Everybody
I have a problem with the headers as my catcher account is a gmail account - Does anyone know how to get the header out of a gmail?

Posted: Sat Aug 21, 2010 8:43 am

^^^^ Click the down arrow next to Reply, at the top-right of the message pane and choose (Show original)

Posted: Sat Aug 21, 2010 9:00 am

Thanks Subway
Now that you tell me, it becomes so obvious that I'm all embarrassed Embarassed

Please don't tell anyone Confused

Posted: Sat Aug 21, 2010 11:07 am

I post a lot of letters in surplus and get most of my lads from there. I use my "catcher" account strictly for sending and recieving lads I'm working but thats it. I get enough junk mail, including scam mails from my RL accts. (Which I NEVER use for baiting)

Posted: Sat Aug 21, 2010 11:56 am

Aussigal I've just had a look at your surplus scams and I agree with Branwen - they are so well laid out and easy to read.

You've also taught me a few things - for instance I've been deleting the bunch of random coding that appears sometimes, but it looks like it's useful to include anyway. I shall include it from now on.

Plus you've managed to find IP addresses for Gmail and can tell if it's a satellite provider - how do you do that? Shocked

I'm still a novice at reading headers, and although I know to go for the last "received from" I'm lost if it doesn't mention HTTP.

I'm trying to remember to also post my scam letters into ww.scamwarners.com as well, so that Google has another go at hooking on to the details.

Not quite a Newb Joined: 24 Jul 2010 Posts: 68

Hi Dungdigger,

I copy the whole header into http://headertool.apelord.com/ and it tells me what the header means. Too easy.

I don't know what is important in the header details, and what is not, so I just leave it all in. Branwen would be able to tell you what should and shouldn't be there.

I'm really glad to note that people really use the surplus. It's a little something I can contribute in return for all the help I'm getting from everyone here.

Posted: Sat Aug 21, 2010 1:19 pm

^ I believe the tool simply searches out the IP's and the buttom one in the result is usually the origin.

I don't know if it can be cheated via a proxy server, but I guess it's possible Sad

Posted: Sat Aug 21, 2010 4:51 pm

Thanks Aussiegal. I've been using the WhoIs site, but that leaves me in the dark if I don't see an HTTP and I don;t know which bit of their site to use if I'm stuck! Embarassed

I'll bookmark the apelord site and use that in future. Thanks! Very Happy

Posted: Sat Aug 21, 2010 7:01 pm

IF you know which IP address is the relevant one, then this is a good place to look it up:

http://whatismyipaddress.com/ip-lookup

because it will also show you when it is a proxy/network sharing device or a satellite provider.

The 'relevant' IP address is usually the one just above the 'date' part of the header:

Quote:

Received: from [196.207.248.47] by web46108.mail.sp1.yahoo.com via HTTP; Mon, 10 Nov 2008 07:48:34 PST
X-Mailer: YahooMailWebService/0.7.260.1
Date: Mon, 10 Nov 2008 07:48:34 -0800 (PST)
From:<[email protected]>
Reply-To: [email protected]
Subject: Thank You Sincerely

Try that first. If it is not as 'expected' - a country you wouldn't immediately expect a scam mail to come from (like this one below: 208.36.123.145 is a US IP address) - then look for an X-originating IP address and try that:

Quote:

-OB-Received: from unknown (208.36.123.145)
by wfilter3.us4.outblaze.com; 16 Apr 2009 14:41:36 -0000
Received: by ws1-10.us4.outblaze.com (Postfix, from userid 1001)
id B4BD61BF297; Thu, 16 Apr 2009 14:41:25 +0000 (GMT)
Content-Transfer-Encoding: 7bit
Content-Type: multipart/alternative; boundary="_----------=_1239892881327100"
MIME-Version: 1.0
From: <[email protected]>
To: <[email protected]>
Date: Thu, 16 Apr 2009 09:41:21 -0500
Subject: NEW ACCOUNT
X-Originating-Ip: 80.248.71.115

If that is 'unexpected' as well, then, for posting in Surplus, just give up and leave the 'sender's location' unentered. Some are just too confusing, to put it honestly.

As for the parts of the headers you can 'safely' omit:

(a) Look for 'DKIM-Signature'. Delete all that follows this down to 'DomainKey-Signature'. This is not needed. You can show it has been deleted by adding <cut> or <snipped> or <deleted> if you wish.

(b) Now delete from just after 'DomainKey-Signature' to just before the next 'Received'. That's not needed either. Again, you can note that you have deleted it, if you wish.

NOTE: Sometimes, inbetween 'DomainKey-Signature' and 'Received', there is a Message-ID line, looking something like this:

Message-ID: <[email protected]>

If there is, I usually leave that in, and then delete again from 'X-YMail-OSG' to the 'Received'. It ends up looking a bit like this:

Quote:

DKIM-Signature: <snipped>
DomainKey-Signature: <snipped>
Message-ID: <[email protected]>
X-YMail-OSG: <snipped>
Received: from [41.222.192.69] by web59501.mail.ac4.yahoo.com via HTTP;
Thu, 29 Oct 2009 05:57:23 PDT

(Except I always use 'cut' not 'snipped' because it's less typing and I'm lazy.)

If that's too confusing though, just look for the long lines which wrap around in your posting box, and add 'returns' in at the end of them. Click on 'Preview' to check it has all turned out OK.

Posted: Sat Aug 21, 2010 7:27 pm

Thanks Branwen Very Happy

I've noticed with apelord that it can't always distinguish between Pacific Rim countries, so it may be China or Taiwan or the Philippines or Australia. Using it today I've only found one that was ambiguous and so I included China or Taiwan in the title.

Silly question on surplus scams	View next topic View previous topic