New here

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 25 May 2015 Posts: 9

Hi guys just got a friend to forward an email he received from the rtp international games saying he's won 104k usd
email comes from south Africa.
Anyone know about this one, is it worth some time to get their juices flowing?

Posted: Mon May 25, 2015 10:27 am

Welcome to Eater!

See https://www.scamwarners.com/forum/viewforum.php?f=12 . If it sounds like those, it is a scam.

Are you asking if we'd like to bait it, if you'd like to bait it, or if he should avoid answering? Could you post the email, with complete headers?

Baiting Guru Joined: 03 May 2007 Posts: 18312

Welcome!

Yes, it's a scam, and baitable. Any email sent to someone out of the blue, claiming they won a lottery they didn't enter is a scam. The link vonpaso xlura may be helpful for you to understand how the scam works in order to bait it. ScamWarners is our sister site with information for victims and the general public. The forum vonpaso xlura linked to is the lottery scams forum - there are informational topics stickied at the top that explain lottery scams.

To get started baiting - read the topics for new members in the scambaiting help forum here at Eater.

Make sure you're baiting safely - set up a fake account that doesn't connect to your real info, and write to the scammer pretending to be a victim. Remove all reference to your friend's email - the scammer won't notice.

We have a mentor program if you'd like a mentor to help you get started and you can always ask questions in the help forum.

Hello I'm New here! Joined: 25 May 2015 Posts: 9

Thanks for the reply yes I meant should I bait it, I've baited once before even got the lad on a safari. I will see how this one goes

Hello I'm New here! Joined: 25 May 2015 Posts: 9

this is the email addy , i cant find the header as it was forwarded by my friend and its only showing his ip. also i dont know how to include the email here as its just a jpeg letter

[email protected]

Posted: Mon May 25, 2015 6:50 pm

Please copy and paste it. It makes no sense to post a link to your Gmail account.

ETA: you edited your post while I answered it. Type the text into a post. Scammers occasionally send their scripts as graphics or word processor files or PDF files to evade spam filters.

Hello I'm New here! Joined: 25 May 2015 Posts: 9

https://drive.google.com/file/d/0B87lQ2uYM6UvVGZhNDZVeG1EZjMxZWc3Zl94M0kxLVNhUVZB/view?usp=sharing
i think this should work

Posted: Mon May 25, 2015 7:08 pm

Before somebody gone bait this you really need to post the original header and mail.This for obvious reasons.
Welcome to eater!

Baiting Guru Joined: 03 May 2007 Posts: 18312

Hi bigbadbagdad,

Our forum rules require that if you post the contact info, you also post the proof of the scam to go with it.
If the scam letter is a jpg image, you have to host it somewhere first, then add the image into your post using the [img] coding tags.

That said, you are not required to post it here in order to bait it yourself! If it's a lottery email, and a definite scam, feel free to bait away.

Without the jpg or proof - please do edit out the email address.

Hello I'm New here! Joined: 25 May 2015 Posts: 9

trouble is i dont know how to, there isnt a drop down box with show header in it, it was forwarded by a mate, if anyone can tell me how to get the original header i can post it up here

Hello I'm New here! Joined: 25 May 2015 Posts: 9

im confused, my friend forwarded me the email but all it contained was the jpeg, am i missing something? the originators email is there but i havent included it as its different from the one in the letter. i hosted the jpeg on my google drive and put the link in, should i do it as a img?
any help would be useful as im not familiar with this forum.

Posted: Mon May 25, 2015 7:31 pm

If your friend forwarded you the email then they won't be the headers from the original lad email, they'll be a totally new set of headers.

Hello I'm New here! Joined: 25 May 2015 Posts: 9

yes, thats what i mean.

Posted: Mon May 25, 2015 7:40 pm

He can get the headers from the original email then and copy and paste them into a new email for you.

Hello I'm New here! Joined: 25 May 2015 Posts: 9

hes just received another one so i will get the header from him first

Hello I'm New here! Joined: 25 May 2015 Posts: 9

ok this is what i have, the emails are deffo coming from south africa

ipTRACKERonline.com wrote:

Header Analysis Quick Report Originating IP: 129.232.144.164 Originating ISP: Hetzner (pty) Ltd City: n/a Country of Origin: South Africa * For a complete report on this email header goto ipTRACKERonline

Posted: Mon May 25, 2015 11:03 pm

Please post the complete headers, editing out your address.
*Occasionally IP Tracker makes a mistake, finding four numbers that look like an IP address but aren't. That's unlikely, if it says South Africa, but very likely if you feed it a scam email and it says it's from the US military.
*We need to see the Reply-To header as well as the From header.
*When killing an email-only domain, we need to check whether the mailserver it was sent from belongs to the domain and, if submitting outgoing and incoming headers, whether the Message-ID of the outgoing message matches something in the In-Reply-To or References header of the incoming.

If the headers contain long strings with no spaces that are wider than the browser window, edit them.

If the jpeg is an image of text, type it all out, preserving as much as possible the irregular spacing about punctuation marks and irregular capitalization.

Baiting Guru Joined: 03 May 2007 Posts: 18312

@vonpaso xlura: You don't need to see any of that unless you intend to bait the email as well, which I'm not sure bigbadbagdad is asking for. If he does want others to bait, he still doesn't need to post that whole list you requested, just a header and scam email text.
You're over complicating things.

@bigbadbagdad: The result you posted from IPtracker is likely the originating IP and location. Go ahead and bait, and let us know if you need help.
As I said before, you don't have to post it here unless you want others to bait it too.