Porsche Hangout


By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here. - Internet Anti-Fraud Center - now open!

 Craigslist phishing?

View next topic
View previous topic
Post new topicReply to topic
Author Message
Bart Fargo
Corporate Baiter

Joined: 22 May 2010
Posts: 1605
Location: Free munchies for the cantaloupe masters

PostPosted: Fri Nov 12, 2010 10:07 pm Reply with quoteBack to top

Got this today:

Return-Path: <[email protected]>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
X-Spam-Flag: YES
X-Spam-Level: *********************
X-Spam-Status: Yes, score=21.2 required=5.0 tests=FORGED_MUA_OUTLOOK,
shortcircuit=no autolearn=disabled version=3.3.1
* [ listed in]
* 3.5 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
* 1.6 NSL_RCVD_FROM_USER Received from User
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 1.7 RAZOR2_CHECK Listed in Razor2 (
* 0.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
* above 50%
* [cf: 61]
* 0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
* [cf: 61]
* 0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
* 0.3 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
* 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
* 0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
* 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
* 1.1 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
* 1.4 FROM_MISSP_USER From misspaced, from "User"
* 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
X-Original-To: Received: from localhost (localhost [])
by (Postfix) with ESMTP id 52D9CF4C18
for <>; Fri, 12 Nov 2010 13:32:01 -0500 (EST)
X-Virus-Scanned: by amavisd-new at
Received: from ([])
by localhost ( []) (amavisd-new, port 10024)
with ESMTP id K6dJ89-0Rl7D for <>;
Fri, 12 Nov 2010 13:32:01 -0500 (EST)
Received: from ( [])
by (Postfix) with ESMTP id 14590F3FE4
for <>; Fri, 12 Nov 2010 13:32:01 -0500 (EST)
Received: from (unknown [])
by (Postfix) with SMTP id 0CCB2BF395
for <>; Fri, 12 Nov 2010 13:31:59 -0500 (EST)
Received: from User ([])
(envelope-sender <[email protected]>)
by with ESMTP
for <[email protected]>; Sat, 13 Nov 2010 02:22:35 +0800
From: ""<[email protected]>
Subject: PJM-> Your craigslits account will be blocked.?
Date: Fri, 12 Nov 2010 22:22:26 +0400
MIME-Version: 1.0
Content-Type: text/html;
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20101112183159.0CCB2BF3[email protected]>
To: undisclosed-recipients:;
X-Spam-Prev-Subject: Your craigslits account will be blocked.?

<html><head></head><body>Important Craigslist Information<br><br>


<br>We reserve the right, at our sole discretion, to change, modify or otherwise alter your
<br>account at any time. Therefore your account will be blocked.
<br><br>To avoid deletion of your Craigslist account please Sign In:
<a target="_blank" href="">Click here to confirm your Craigslist account.</a></b>
<br>Craigslist team</body></html>

I do have an acct, but only listed one item once about a year ago.

What the hell happened to all my little icons I earned and my quotes???
Mc Fry <===the hardest icon to earn
View user's profileSend private message
419Eater is my life

Joined: 06 Sep 2009
Posts: 261
Location: Valley of the sun ~ it's a dry heat

PostPosted: Fri Nov 12, 2010 10:14 pm Reply with quoteBack to top

Don't click on the link or sign in. If it is really Craigslist and they close your account, so what. You can open a new account should you ever need or want to post an item.

Just my 2 cents worth.


Closed lad accounts Thanks to Murry and Kate
Closed lad accounts Nigerian lad posing as a Finland shop keeper
xxxx @ is my id and i m looking for sex if you help me in doing sex plz give me <- said to my alter ego Tonya
this will not cost you anything ..going to western union to send me $200 <- said to me by my Nigerian lad posing as a shop keeper in Finland
View user's profileSend private message

Joined: 18 Nov 2008
Posts: 9264
Location: Magnolia, Mississippi

PostPosted: Fri Nov 12, 2010 10:26 pm Reply with quoteBack to top

Typically, you forward those onto the company being phished. However, CL isn't too responsive from past experience.

I would recommend forward it to the host of the domain, which looks to be COMUNE DI ARAGONA [email protected]

They should take care of it.

United StatesCanadaUnited KingdomNigeriaGhanaBeninMalaysiaSouth AfricaSwitzerlandTogoChinaSpainMadagascar FlagBulgeriaUnited Arab EmiratesUkraineUnited NationsItalyLibya FlagCzech Republic
NetherlandsNew ZealandRussiaSaudi ArabiaAustraliaBahamas, TheIvory CoastDenmarkBelgiumHong KongFranceGermanyRomaniaBahamas, TheNew ZealandcameroonBurkina Faso x 2714
Easter Egg 2012 Cellphone Closed lad accounts Mortar pony pony Nurse Nastys Audi TT Nurse Nastys Audi TT Goat Tattoo Mc Fry Elite Ninja Team Member
Safari Vcamera Paga John Safari Vcamera Paga Willie Safari Vcamera Paga Kingsley Safari James

Safari The Dynamic Duo Travels! Vcamera Sand Timer
View user's profileSend private message
Baiting Guru

Joined: 09 Jul 2008
Posts: 3114
Location: somewhere over the rainbow

PostPosted: Fri Nov 12, 2010 10:29 pm Reply with quoteBack to top

Phishing plain and simple.
PJM-> Your craigslits account will be blocked.

Craigslist would make sure they have their name right...

Quote: Check at Check at Unknown Unknown Unknown Check at Check at Emirates Telecommunications Corporation Dubai United Arab Emirates

Given the poor writing and location info, I would guess looking for established accounts to hijack for placing fake ads.

Purple FlowerEaster Egg"I've a feeling we're not in Kansas any more..."
View user's profileSend private message
Baiting Guru

Joined: 16 Apr 2009
Posts: 5867
Location: Paradise

PostPosted: Fri Nov 12, 2010 11:15 pm Reply with quoteBack to top

It's already been reported

Reported Web Forgery!

This web page at has been reported as a web forgery and has been blocked based on your security preferences.

419Eater wastes their time - <a href=""target="_blank">Scamwarners</a> exposes their crimes

"You are a destinated Idiot. a fibol element, a rebel against humanity.

You are a goat. And very stupid. I will deal with you very soon, just wait, I have all your contact address, and I will trace you very soon, for insulting me, all evidence of your insult to me has been filed.

Lawyer M4nu3l told me that you could be one of this terrorist in the usa. and I later find out on my research on you, that you are one of the bastards in wherever you are. not even in usa."

Closed lad accounts

Safari< S4NI S4LISU Ghana to Togo
Safari< St3lla J0nta Cote d'Ivoire to Ghana
Easter Egg Penguin Mortar Purple Flower Purple Flower Killer Baiter
View user's profileSend private message
Display posts from previous:      
Post new topicReply to topic

 Jump to:   

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

** Find out information about your IP address **

All Content © 2003 -
Powered by phpBB © 2001, 2002 phpBB Group :S5: FI Theme :: All times are GMT