Have I Become the Scammer??? Thoughts, Please?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

05/29/15

Just going on about my normal several-times-weekly posting to Surplus Emails thread, and I come to this. It's got a ZIPped jpeg attachment, but I'm a fraidy cat and haven't opened it. The dirtbags that typically inhabit my catcher account certainly aren't worth getting a good case of malware over!

Upon running the header, I find that the email originated in USA. There's a huge, peculiar-looking section of References near the bottom of the email header, too.

While I rather think it may just be a simple phishing attempt, I would appreciate everyone's take on this, please.

Quote:

Header Analysis Quick Report
Originating IP: 98.138.105.215
Originating ISP: Yahoo
City: Sunnyvale
Country of Origin: United States

Quote:

Money gram receipt the ref #.83984452.
From: [email protected]

SIR,
attached the money gram receipt for todays payment of 1500 usd the ref #.83984452,
I tought I had already paid for that ,why then now again ,what is going on in your
orgahisation??? i believe i dont have to pay any more fee after the $2000 usd i will
be send today at night after work??

Quote:

Return-Path: [email protected]
Received: from omp1025.mail.ne1.yahoo.com ([98.138.89.169]) by mx-ha.gmx.net (mxgmxus003)
with ESMTPS (Nemesis) id 0MHGy5-1XlYeW1Ln9-00E8qs for <snipped>; Tue, 18 Nov 2014 21:58:11 +0100
Received: (qmail 995 invoked by uid 1000); 18 Nov 2014 20:58:10 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1416344289;
bh=A7UzfZ4RRLZSG4k6n1Xpgx0yXc4gT+MxbFwCQJ1vlF0=; h=Date:From:Reply-To:To:Message-ID:In-Reply-
To:References:Subject:MIME-Version:Content-Type; b=B46bPnJ
uRUQU3FhttDHHNthMvudMv6w9ovxkLWeBBk+tDLQPGguZbGqvxdV8MOvmXhPXyC9Jt2piNvQj4j8Tut4AkGFjK
i5UIAhyLtLXL9O2Yen5bCYflRovioMUzsaDnbscQd0z6nEkIJTFayszhFwD3TZX+PkOr3Rsb7rNIPGIJVW8i7s3MLKU
rNj1vUfXgKIbuChzD0mPIYZIZbKeRAyI2EYOxSpOgg2/by0HTUTCr5FCEPtnmSQ+Uzh7LsEv2Oo8JRBep8ZSKeR1T
Vo7+gQlAQ3WuxiSzkYRiAzhJrC8ihaakeyr42fVwL53pefztLtlXWDpoyY+7E9IubV3kA==
X-YMail-OSG: 6wFptWsVM1ms6yhS1qUQwE8mF1BaETpa8boMNzEE7cN138w96PGZlU6y7dVwydv i6Ae53z7KuOpBDDCenUEnGdh6Dw69O8OsOvVAoUD_JFYQ4rQJQs8J_tWO1KmjCGNg4AgH8RdECtC 2ADbnFFfRcw7oR2hnW9N2d8OcUOiRZH0WttVNHw9HbolvvFy3IZrYJXOF9Oxj_zt.vBO9yFUPd19 cqWcBUwA50TS3EWo3gd1F5zJcTfdtVqXQDrfJIoLJhYMwgHlcxetMeBm90rOLe1WBpBPfYeE4rPd XzdZHTCaFwrEHVaQu2c2yphlg04bLzMB.q6s223LaDodHjViLi9LAu1JpLIrnGojhl6VuHHxMGY1 Bk4BRLdah7VLZtkrdrNhJQWVSbpmXqcKb9ys9rwT2sEJI8HROZofo7zIWDrEIicXd8W.QOTko9QK qSJTMF1N1Hx2ZKSSxbRJHm436ODLd5scN14TRDBPCsm4lHMG.zkLmrkkd2tSxDY_7IJtUXBezQQQ Lfa8X

Received: by 98.138.105.215; Tue, 18 Nov 2014 20:58:08 +0000
Date: Tue, 18 Nov 2014 20:58:06 +0000 (UTC)
From: <[email protected]>
Reply-To: <[email protected]>
To: "[email protected]" <[email protected]>
Message-ID: <994246158.1450944.1416344287339.JavaMail.yahoo@jws100136.mail.ne1.yahoo.com>
In-Reply-To: <1942375653.1448781.1416344102122.JavaMail.yahoo@jws100114.mail.ne1.yahoo.com>
References: <1556059220.1438759.1416228648639.JavaMail.yahoo@jws106128.mail.bf1.yahoo.com> <1592849192.1792138.1416305431721.JavaMail.yahoo@jws10638.mail.bf1.yahoo.com>
<743654582.1927625.1416306239724.JavaMail.yahoo@jws10667.mail.bf1.yahoo.com> <1190364661.1621701.1416306890931.JavaMail.yahoo@jws10645.mail.bf1.yahoo.com>

<90985621.1845050.1416307184739.JavaMail.yahoo@jws10629.mail.bf1.yahoo.com> <678371717.1942000.1416307521073.JavaMail.yahoo@jws106140.mail.bf1.yahoo.com>

<467620171.1940275.1416307839022.JavaMail.yahoo@jws106119.mail.bf1.yahoo.com> <1032783727.1939361.1416308217732.JavaMail.yahoo@jws10691.mail.bf1.yahoo.com>

<1373763665.1938795.1416308308069.JavaMail.yahoo@jws10652.mail.bf1.yahoo.com> <84955044.1951274.1416308526538.JavaMail.yahoo@jws10618.mail.bf1.yahoo.com>

<46465207.1935631.1416308620793.JavaMail.yahoo@jws10669.mail.bf1.yahoo.com>

<113390592.1939939.1416308813217.JavaMail.yahoo@jws10654.mail.bf1.yahoo.com>

<1018445280.1950513.1416308995241.JavaMail.yahoo@jws10624.mail.bf1.yahoo.com> <405123517.1935747.1416309224011.JavaMail.yahoo@jws10651.mail.bf1.yahoo.com>

<624562242.1946560.1416309317494.JavaMail.yahoo@jws10678.mail.bf1.yahoo.com> <2078998422.1950084.1416309601411.JavaMail.yahoo@jws106131.mail.bf1.yahoo.com>

<1569379555.1946687.1416309771343.JavaMail.yahoo@jws10644.mail.bf1.yahoo.com> <164539764.1951409.1416309954251.JavaMail.yahoo@jws106124.mail.bf1.yahoo.com>

<1733397419.2642307.1416310219488.JavaMail.yahoo@jws106137.mail.bf1.yahoo.com> <823373068.1453567.1416310378292.JavaMail.yahoo@jws10699.mail.bf1.yahoo.com>

<987174171.1950389.1416310483358.JavaMail.yahoo@jws10687.mail.bf1.yahoo.com> <179671983.1948800.1416310587963.JavaMail.yahoo@jws106109.mail.bf1.yahoo.com>

<1412197525.1961285.1416310770649.JavaMail.yahoo@jws10608.mail.bf1.yahoo.com> <1301130756.1949836.1416310807010.JavaMail.yahoo@jws10643.mail.bf1.yahoo.com>

<180637853.1958396.1416310922108.JavaMail.yahoo@jws10623.mail.bf1.yahoo.com> <1776256568.1949380.1416311006762.JavaMail.yahoo@jws106145.mail.bf1.yahoo.com>

<1152221765.1957279.1416311047157.JavaMail.yahoo@jws106131.mail.bf1.yahoo.com> <1518367378.1324061.1416311179337.JavaMail.yahoo@jws10626.mail.bf1.yahoo.com>

<1359166489.1953524.1416311299766.JavaMail.yahoo@jws106139.mail.bf1.yahoo.com> <323186814.2009251.1416319919484.JavaMail.yahoo@jws106104.mail.bf1.yahoo.com>

<418201853.2024183.1416320012107.JavaMail.yahoo@jws10625.mail.bf1.yahoo.com> <595803468.2705571.1416320407044.JavaMail.yahoo@jws106137.mail.bf1.yahoo.com>

<1745353070.2024928.1416320750600.JavaMail.yahoo@jws10633.mail.bf1.yahoo.com> <1410417428.2013022.1416320904992.JavaMail.yahoo@jws10643.mail.bf1.yahoo.com>

<107398474.2091860.1416331519847.JavaMail.yahoo@jws10689.mail.bf1.yahoo.com> <1995623599.2092710.1416331850417.JavaMail.yahoo@jws106149.mail.bf1.yahoo.com>

<358209434.2111487.1416331987879.JavaMail.yahoo@jws10619.mail.bf1.yahoo.com> <1110783802.1998082.1416332155311.JavaMail.yahoo@jws10634.mail.bf1.yahoo.com>

<602228207.2309046.1416332230345.JavaMail.yahoo@jws10603.mail.bf1.yahoo.com> <907308408.2118793.1416332318920.JavaMail.yahoo@jws10628.mail.bf1.yahoo.com>

<57558620.2103880.1416332404518.JavaMail.yahoo@jws106110.mail.bf1.yahoo.com> <1552345473.2312478.1416332574454.JavaMail.yahoo@jws10603.mail.bf1.yahoo.com>

<107103117.2099101.1416332776295.JavaMail.yahoo@jws10666.mail.bf1.yahoo.com> <359853008.2108366.1416332954791.JavaMail.yahoo@jws10657.mail.bf1.yahoo.com>

<976724843.2109305.1416333043462.JavaMail.yahoo@jws10657.mail.bf1.yahoo.com> <634079114.1457418.1416333213510.JavaMail.yahoo@jws10648.mail.bf1.yahoo.com>

<1749993402.2121900.1416333681221.JavaMail.yahoo@jws10695.mail.bf1.yahoo.com> <1808701956.2115484.1416333906453.JavaMail.yahoo@jws106136.mail.bf1.yahoo.com>

<225375077.130897.1416334353053.JavaMail.yahoo@jws10602g.mail.bf1.yahoo.com> <439752787.2135629.1416336149718.JavaMail.yahoo@jws106145.mail.bf1.yahoo.com>

<101649611.2136683.1416336504303.JavaMail.yahoo@jws10671.mail.bf1.yahoo.com> <1244687058.2143906.1416336769273.JavaMail.yahoo@jws10663.mail.bf1.yahoo.com>

<834183361.2143130.1416336934478.JavaMail.yahoo@jws10668.mail.bf1.yahoo.com> <761273685.2156601.1416337770966.JavaMail.yahoo@jws106131.mail.bf1.yahoo.com>

<2136318101.1500083.1416337845611.JavaMail.yahoo@jws10648.mail.bf1.yahoo.com> <253235037.2152237.1416338121978.JavaMail.yahoo@jws10647.mail.bf1.yahoo.com>

<805273219.2152544.1416338284965.JavaMail.yahoo@jws106134.mail.bf1.yahoo.com>

<3955328.2366405.1416338354922.JavaMail.yahoo@jws10603.mail.bf1.yahoo.com>

<759795256.1436279.1416340360645.JavaMail.yahoo@jws100118.mail.ne1.yahoo.com> <432310458.1433207.1416340486719.JavaMail.yahoo@jws100100.mail.ne1.yahoo.com>

<1011701323.1431740.1416340642522.JavaMail.yahoo@jws10035.mail.ne1.yahoo.com> <342072570.1435824.1416340992191.JavaMail.yahoo@jws10052.mail.ne1.yahoo.com>

<519975065.1435960.1416341182015.JavaMail.yahoo@jws100169.mail.ne1.yahoo.com> <1760356299.1432217.1416341229456.JavaMail.yahoo@jws100203.mail.ne1.yahoo.com>

<1760720773.1441559.1416341920516.JavaMail.yahoo@jws100133.mail.ne1.yahoo.com> <1252433082.1440466.1416342188298.JavaMail.yahoo@jws100158.mail.ne1.yahoo.com>

<438601203.928082.1416342458406.JavaMail.yahoo@jws10063.mail.ne1.yahoo.com> <1625336772.1439223.1416343334281.JavaMail.yahoo@jws10053.mail.ne1.yahoo.com>

<792644151.1440732.1416343658109.JavaMail.yahoo@jws10096.mail.ne1.yahoo.com> <877755098.1447466.1416343827676.JavaMail.yahoo@jws10033.mail.ne1.yahoo.com>

<1371691778.1453961.1416343967168.JavaMail.yahoo@jws100170.mail.ne1.yahoo.com> <1942375653.1448781.1416344102122.JavaMail.yahoo@jws100114.mail.ne1.yahoo.com>
Subject: Money gram receipt the ref #.83984452.
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_1450943_949931880.1416344287338"
<snipped>
X-GMX-Antispam: 0 (Mail was not recognized as spam); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: notjunk:1;V01:K0:QQSq/9X7A90=:T1zQrbQZqq0Y80CfEVWZ7KG6Db 3quOQurUyJ
J37dKx85FjocDi59AYzKjHHR0n38kgfwrBQoLcTXUQPqePtLvIlESX9pD2YZmV9 QK5Ui1aV
1sbPPANjyjDKz980hbw5OiEJdLqzOqwdwuW52oe9Nyj+zujr761P7PAgdukY4GFbl iLw1phqhK
pUbBjnUMSJMIm4usa5mRXwstUpqEWMjMj1ifC4nr6R/cxA7iaiUgjYFjZ8kQSR+2 a2xXieGxM
O6fbZoF/Pa8MROTtxkJDxwArWwVhZXnzN+G0wIRYxOnS+LCPESyFfJdkJKxScjBE qYhYpLXQ3
MZT+DkkZxhoqeLOEz4jvkvq1gM1VTBE6mWtkEdsavzGInRO7CQUlgMwgBpdeKiS1 o+/qL9/HRX
K9DFFEYBxCZFkrIKbAkSSVp4tuZJX3qzjIeE9axp2VhyDF6vw2vZk0rLxuEv0Ic 3v70EOTxR
tvk4aD5caYKnSCQNC1Is1Yw5sarEDUazln6CooczktnkUfIRKo0fgrF131CH0EfL ZBYWdv+f0q
4ypj0D4DfUeArIdJ7U36fB8t31j9zRpAjXOuuUJgp9kiB4kZs/25BQ2OuHNTGxs fYxskT4XN
QHXGdIxfmzJR8mrGeeVQT2HeZa9o4KKWq+2EkH/ewQTGOIrqa+b5Vn2eK/WnFMAq 46JnEWaJC3
T0mVdD6m81LIAyo9EHipTEIoRKco6QAygrGCtmkKMh3fkjYJ9lOUNQkc1zFP8QR obap2tJYQw
kHAXcouZhKpu8ze4y6xkm1sCyHsj6nIt6oI3lr5ZhmQCGuK4EdftOCoAkNd35nv Oaku6dwW1
XVtK3b2W55Jx22GuJaZjT6iXcEKieLm+jI+i1Ab5jjIvUhKyoL6uAYT51ADeKjZE pPM0cbKwE
vJ/ukV6KLFUBXztXBW8FbX/9/KYvGwaYz+LCjZdnA5jLI2tLmwUVbisK6yHXt7PD VoLsStEYfL+
5p6FGHF+0oExZ105ZfKKMIKjg2FL3/tOCZezXywdjssxJPvpB3cqbZg7fBOcWg PvwicLovRBL
4UiWwVFzPfVT4pkOAoi8UeyVw9ii+mDcbYcwnLEps5/JJbCp/wW6aoNZlSiD9d JtZHCyS4Rw
fsaoM+Ohx5w8jmScAXYfq2pCACdWxQ06uNzRDlyygBEBDG+7oYpV4GVykiDM84e OxvV2GVdRO
E2iorxbmb7/XaA161ZuSKcQAq55jQrjXJ6ukHVn5Ys8uXYteCTDfKkYGqc3lW8b 4k3Fpy0ps3n9H

Posted: Wed Nov 19, 2014 1:02 am

I don't know what it could be, but to be on the safe side, don't open it!

Contact a moderator and give them the senders info as the sender might be a victim and they can possibly warn them.

05/29/15

^^^ THANK YOU, SBAH !!!

It's good to know that I'm not losing it :banghead:

Posted: Wed Nov 19, 2014 1:23 am

I received the same today KOD. The IP goes to Yahoo's location in Sunnyvale.

Let the Mods look at it... Wink

Thanks for posting it.

Posted: Wed Nov 19, 2014 1:35 am

Email from Sunnydale is most often a proxy stripping address. Did you get this a cc. or bcc?

Posted: Wed Nov 19, 2014 1:38 am

There is no need to zip a jpeg. Jpegs are already compressed. Is it *.jpg.gz, or how do you know it has a jpeg inside?

The writing looks rather African, and there's no way to tell from the headers where it's from, as the last IP address is in Yahoo.

Could be a victim (there are African victims and African baiters as well as African lads), could be a lad sending a misdirected message. I suggest that you or a warner or both (you the ASEM, warner the warning) send him a warning and an ASEM from different addresses and see what happens.

Baiting Guru Joined: 19 Mar 2012 Posts: 5380

Quote:

--- ATTACHED ---
application/x-msdownload: Money Gram Payment Slip JGPE 0102.exe

is what that scammer was sending in 2013
http://funnyspamiget.blogspot.com/2013/01/ladiemnemyahoocom-money-gram.html

05/29/15

Thanks, Everyone !!!

@ JC – You must be one of the “other” recipients Wink

@ Capone – Sorry, but I don't have any idea one way or the other. This came into my catcher account, with is with GMX and I'm not as familiar with it as I am with my regular Yahoo account Sad

But I am showing you all that I received.

@ VX – The attachment notification shows ZIP. When I hovered my mouse over the ZIP, it indicated that the attachment is a jpeg.

I'm afraid that the action you're suggesting is waaaayyyyyyyyyy beyond me!

Capone, HALP – I think I need a Moderator !!!

Posted: Wed Nov 19, 2014 2:16 am

I have found recently, that Yahoo accounts based out of some countries routes to an IP in that country or to Yahoo's Sunnyvale address. IIRC, yahoo.co.uk shows an IP in the UK and sg.yahoo.com shows Singapore, depending on what you use to do the trace.

Posted: Wed Nov 19, 2014 5:23 am

My advice is to just delete the message and move on. There are plenty of other lads that need attention.

The best way to bait one these is to respond that all attachments are deleted by your system admin and to please resend the email. If it just a lad he will resend the information with out an attachment.

05/29/15

^^^^^ Thanks, woody999 –

I had no intention of baiting him myself, he's just among the other emails that I post on Surplus.

But as your suggest, typically when I receive something with an attachment, I given 'em this:

“I cannot open your attachment. Please copy and paste the contents of the attachment into the body of an email and re-send it to me. Thank you.”

Oddly, I get about an 85-percent rate of returns on that!

Thanks again, everyone Smile

Posted: Wed Nov 19, 2014 11:07 am

Looks like a phish to me. Since this seems to be the consensus, I'd just delete it. Lots of other lads out there.

Have I Become the Scammer??? Thoughts, Please?	View next topic View previous topic