Email Scam
Thanks to my usual habit of examining email headers, I was not scammed! The
following is an email thread I was involved in. I posted an ad to sell my
Honda van. A guy named Darren Crawford emailed and showed interest. Unsuspected
at first, I emailed back telling him a little more details. He soon told me
how he could pay me without further negotiation. I became cautious and read his
email header. Aha! He's in Africa, most likely Nigeria, according to his
un-faked originating IP, 196.1.176.165 and a whois search at http://afrinic.net.
***********************************************************
* If you're interested in learning how to read email *
* headers and find the sender's ISP, read *
* ../computer/fightspam.html *
***********************************************************
So an email was on the way to abdulmalik@nitelnet.com, a person at this bad
guy's ISP (at the time the contact abuse@nitelnet.com was not on their web page).
Unfortunately, Nigerian Telecommunications didn't reply. Too busy reading similar
scam reports? Or busy arguing with this guy how much each should share?
************* READ FROM BOTTOM UP (last scam mail's header shown) *************
Dear Nigerian Telecommunications Ltd.,
I exchanged one or two emails with auto_crawford@yahoo.com after he saw my car
sales ad in a local (Houston, Texas) newsgroup. I'm forwarding this email to
you because after careful review of his email headers, I suspect his email
originated from Nigeria, specifically from 196.1.176.165. Please help
investigate. Thank you.
Yong Huang
--- darren_crawford crawford <auto_crawford@yahoo.com> wrote:
> From darren_crawford crawford Fri Jul 21 08:24:12 2006
> X-Apparently-To: yong321@yahoo.com via 66.94.235.82; Fri, 21 Jul 2006 08:29:35 -0700
> X-Originating-IP: [209.191.88.234]
> Return-Path: <auto_crawford@yahoo.com>
> Authentication-Results: mta359.mail.scd.yahoo.com from=yahoo.com; domainkeys=pass (ok)
> Received: from 209.191.88.234 (HELO mr201.mail.mud.yahoo.com) (209.191.88.234) by mta359.mail.scd.yahoo.com with SMTP; Fri, 21 Jul 2006 08:29:35 -0700
> Received: (qmail 43540 invoked from network); 21 Jul 2006 15:24:25 -0000
> Received: from web55909.mail.re3.yahoo.com (216.252.110.70) by mr201.mail.mud.yahoo.com with SMTP; 21 Jul 2006 15:24:25 -0000
> Received: (qmail 43228 invoked by uid 60001); 21 Jul 2006 15:24:12 -0000
> DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=mG1+RVhGTMJOXi02K8t48qOiryHJNO4uNslTi0x6YImWZ3K84yOLM3BXhEO+b+D2JgQxL2/ehxcbfkcCSCeY+SStj2T6g/E6v3k9d4xdoivATfCLOM3sG5diRNTLWS6GBh/SmLFRsG3pnaXgnoXykbAmg7clpZmRKBK2qN+Ef8A= ;
> Message-ID: <20060721152412.43226.qmail@web55909.mail.re3.yahoo.com>
> Received: from [196.1.176.165] by web55909.mail.re3.yahoo.com via HTTP; Fri, 21 Jul 2006 08:24:12 PDT
> Date: Fri, 21 Jul 2006 08:24:12 -0700 (PDT)
> From: "darren_crawford crawford" <auto_crawford@yahoo.com>
> Yahoo! DomainKeys has confirmed that this message was sent by yahoo.com.
> Subject: Payment Details
> To: "Yong Huang" <yong321@yahoo.com>
> In-Reply-To: <20060720133548.66980.qmail@web80613.mail.yahoo.com>
> MIME-Version: 1.0
> Content-Type: multipart/alternative; boundary="0-1197386147-1153495452=:40169"
> Content-Transfer-Encoding: 8bit
> Content-Length: 1595
>
> Hello
> Thanks for the mail.I will like to inform you that i am highly
> interested in the (2003 Honda Odyssey) and .So my client will be issuing you
> a (Certified Cheque) for the payment and shipping charges of the (2003
> Honda Odyssey)after you might have sent me this following information below
> for issuing and sending you the cheque.
> Your name in full....
> Your contact home address to send the cheque to not P.O.BOX.....
> Your contact home,office and cell phone number.
> As soon as this is recieved i will immidietly forward it to her inorder for
> her to issue you the check. I promise that as soon as the cheque is sent to
> you i will update you ok. .... I waits your favourable response ok?
> Cheers!!!
>
>
>
> Yong Huang <yong321@yahoo.com> wrote:
>
> Hi, Darren,
>
> The pictures are at
> http://www.nyx.net/~yhuang/odyssey/
> If you really need to know the lowest price, what I have in my mind currently
<snipped>
> Thank you for your interest, Darren. We're in Houston near <snipped> and
> <snipped>, in case you have somebody test driving it for you.
>
> Yong Huang
>
> --- darren_crawford crawford wrote:
>
> > Hello,
> > I saw ur ad placed on the net and a contemporary of mine recommended it to
> > me.I will like to know if the above item is available,the last price and if
> > possible with pics to know the present condition.I would like to solicit your
> > total sincerity and honesty in this transaction.Payment will be made by a US
> > Certified cheque and shippment would be at my cost because i have a private
> > shipper so shipping should not be a problem.
> > Cheers,,,,,,
To my Miscellaneous Page