Information on romance scams and scammers.
by Isis Fri Aug 10, 2012 5:52 am
IP's that wont track

I have come across a few email headers that wont track - how do they that?

the following header wont track - can you tell me wher the person is?

From Desjardins Luis Thu Aug 9 22:23:32 2012
X-Apparently-To: [email protected] via 98.138.211.181; Thu, 09 Aug 2012 22:23:36 -0700
Return-Path: <[email protected]>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
dXJzIHRvby4uIAEwAQEBAQNtdWx0aXBhcnQvYWx0ZXJuYXRpdmUDAzECA3Rl
eHQvcGxhaW4DAzACA3RleHQvaHRtbAMDMQJKYXNvbjEuanBnA2ltYWdlL2pw
ZWcDAzE5NQJkcml2aW5nLmpwZwNpbWFnZS9qcGVnAwMxMjI-
X-YMailISG: fGNf4XMWLDvmNNVtVfaRdYYkVMaIbZ_tA1ih.nLIzDywoV80
F2h36qTVDXXnrt0Up5wOn2JnzcNGVIZm7FiO6YQWAgp8nO_EBShhme.2cK1m
GdUaxkZORUqnT8cfnX.8xK3C5QcyxfVmvP4QzHFJLI7jVZCNfe4v_WofOhxy
Rf3vt4xG6oHQhOLTKiV.X1xMLTPHkneKbRpnYMvrpKqvK4YKEdNUuUM1KSst
fCsjkAKX3skVY0nksXer9duiIjAO8qGDRzz.kiqU1pBwSHejewn.XQPeL4aj
a73ZiZItnP5MYcZI5K.rGFRGFVoWwG4IlTeH030Dz9ApmzjCoNMJg8CRuWgJ
rY.PuBHP.riClXXVciAlM5x5jLxu2zDPLQ_DYVAgAz6WAlrEnSGAqcj80vMp
upL2TXuKhSGN5iDE5h.lVPWqY7yA35W7Qw1ATOit0P9JZ0Q3NMsFKhwrKB.D
cFebE2EFOoxMgfn_CJ9ipZuxtIpZ6b28_ZxXtaRN4wjhlNeHHpr6hKghfkow
PPUM6UZGDtS4RLxnIZ6w7xJGQEW1HANRQT4s1NWa8fr35owGSe2wFj8d.Lo6
rATNQytVmO0Qa3_2L73dCwJ._bzcixgF9pR3F2aGFyPcdMXpOTeKc6ldl49S
ebmNmomJXaHcV1FlJ.4GvW7Lfy3pkaeW1GTUb5F8NAyXfBsh3_kH5UrLhUCa
StBEbPPr3tAbHaTvW4fo6cfqluRhi_kBsudjNysq_p9f4oKyFQDQnaEi4sRX
eqpi9FeWTzpzumc3INfGASZRANeziBoUA14M2FEdKbo1bbNI6sSCOhRmr7EQ
VJCaGSnVyAWA7orQuMBNCWrAn.NP6CRn2G2IQNuYHxAuTK9IoEPpQ0EUE7zM
bTxfbQp.IMfRkY2.QNqaQh0Lavx_Cej6x5en04AbIcekN9ZOkdFVFR8_TSYP
pTghJGijYw3VwnxH8HqTgA0sMcXbPzM.EZIbJLvabXfi9fSgESVPioPdY9DJ
4XFg3KrMCzN7mSMQcT8.P71BFJF9tE.Zx.42FdB6WhLG2CcZFoT0DBaJglFy
.vQhFGUBtyhDoy5JMfEiv1nWYSazJy04CDXYxsVT5_xxfrgPzTXQoUtgND_S
79EzUa_jWQ5Rb0T4J1.iuci416OiUdK4fXHL.pZ.G9bnYiIZ3ouipVpZoAHw
Q2PJ_4Oup5W4WS509sKYLgFzEfdLgv2BhCIEQSvuafw1GHLlvdzlD_CbOcpS
ImncrBfzPwBzfEAkVwibNuUCu4YyR2_nJg--
X-Originating-IP: [98.138.91.244]
Authentication-Results: mta1186.mail.bf1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm22-vm5.bullet.mail.ne1.yahoo.com) (98.138.91.244)
by mta1186.mail.bf1.yahoo.com with SMTP; Thu, 09 Aug 2012 22:23:36 -0700
Received: from [98.138.90.52] by nm22.bullet.mail.ne1.yahoo.com with NNFMP; 10 Aug 2012 05:23:34 -0000
Received: from [98.138.226.165] by tm5.bullet.mail.ne1.yahoo.com with NNFMP; 10 Aug 2012 05:23:33 -0000
Received: from [127.0.0.1] by omp1066.mail.ne1.yahoo.com with NNFMP; 10 Aug 2012 05:23:33 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 53017 invoked by uid 60001); 10 Aug 2012 05:23:33 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1344576213; bh=aa55ZxuUr2UdreUcx0n61zIANqTKgQZx0r0DsSoS13I=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=fYAUo3HrylO2OIO8HaKQpgBXMweelcrPQfDmmJHzjZbiEmOMpn15A8ZNvk0dh8InQbSqpDJMmp37bwQMSrdx8OvfC94kf5SJc0aHDAeSQqwqU7LGUuW1m9rzktzeStu6iNzrDs3DvvvNN9kCXlPtSlxBV84da1e+8WtuaS0V4eg=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=1JBHWS/K9WY+09DUFd0QiNR8YnLiGkjP/vAAr6eI0sH6UOYRCjfUsnuy8d8LHwZmYZY+bQhbI0m27LVIIgNyqlebYsvRhxFOKCpBovfTlbZFizXYNznuk6POj/jBsirI9Tac0tI1MBBNyUmjDU7F3biNSmWlHlO/nHZbuNbk5Ik=;
X-YMail-OSG: zZt7QesVM1lwZzp35mfScjWxvWAwfTruI3U85BdrYvtOuTf
LHEtEma_S.0qhWUDZqxUeImlq8fWKzvFL6vcV16OEqd5Mf6Wsy51OYEe_BrP
TAjEZGTKdjX57OyA8o4N7xy5Qk_ycoSvKuP_8rpcJEPXRYTE98ERB_4XlL1a
ADS5Hu9fziLEGEHK2jbyGXNiB_hOvzDFRZ3mJpdqL35CZh3DRoNrMla2hf5m
aAG4bLmcPL3JaOR6vFJFLCJVPIw_FguTZqq0bHg.2hUbmou44JxyDj7yXqGk
1uTc9gHJz9zoNL7O7jwVvVW9h0WYx8Epn9Ef9.473lZBwEmyjQ2WJjd9InrU
toqPV3JtXgx8DYtFh3VkQtzzScYta0OZraDuMGRmNq0ZqBuCX3E09IHUkR9k
Ywr0zrRk-
Received: from [50.117.0.46] by web122205.mail.ne1.yahoo.com via HTTP; Thu, 09 Aug 2012 22:23:32 PDT
X-Mailer: YahooMailWebService/0.8.120.356233
Message-ID: <[email protected]>
Date: Thu, 9 Aug 2012 22:23:32 -0700 (PDT)
From: Desjardins Luis <[email protected]>
Reply-To: Desjardins Luis <[email protected]>
Subject: Hello
To: "[email protected]" <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="-1522790894-1760490537-1344576212=:42626"
Content-Length: 324801
Advertisement

by Dotti Fri Aug 10, 2012 8:53 am
This is the key line in the headers
Received: from [98.138.90.52] by nm22.bullet.mail.ne1.yahoo.com with NNFMP

NNFMP is a little-understood mailing protocol, frequently associated with scammers and spammers. When it is present, those headers are often forged. Unfortunately, in a case like this one, the originating IP has been stripped or modified, and there is no way to use this header to get a location.

Need to post photos? http://scamwarners.com/forum/viewtopic.php?f=28&t=3219
Are you a victim of a romance scam? Read here for advice and FAQ's.

Who is online

Users browsing this forum: ClaudeBot, Majestic-12 [Bot] and 18 guests