by TerranceBoyce
Sat Feb 23, 2013 7:25 am
As a scambaiter I purposely attract scammers and their scams so that I can either bait them or uncover their latest tricks.
We learn to be very cautious about opening attachments, and the way this mail was phrased gave me extra cause for concern because it asked me to RUN the attachment even though it claimed only to be a photo.
Unless you're sure of who sent a message, never open an attachment. I don't run Windows so this wouldn't affect me (I don't think).
The file was named SWIFT.pif and came from [email protected] - DO NOT OPEN IT.
We learn to be very cautious about opening attachments, and the way this mail was phrased gave me extra cause for concern because it asked me to RUN the attachment even though it claimed only to be a photo.
Unless you're sure of who sent a message, never open an attachment. I don't run Windows so this wouldn't affect me (I don't think).
Short for Program InFormation file, a type of file that holds information about how Windows should run a non-Windows application. For example, a PIF file can contain instructions for executing a DOS application in the Windows environment.
The file was named SWIFT.pif and came from [email protected] - DO NOT OPEN IT.
Dear sir/Madam
Find attached swift copy of the transfer made to your account.
Please Download and RUN the attachment to enable you view the clear picture of the attached transfer copy.
Regards
From saad taha Sat Feb 23 02:30:51 2013
X-Apparently-To: [email protected] via 98.139.219.234; Sat, 23 Feb 2013 02:30:57 -0800
Return-Path: <[email protected]>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
IG9mIHRoZSB0cmFuc2ZlciBtYWRlIHRvIHlvdXIgYWNjb3VudC4gUGxlYXNl
IERvd25sb2FkIGFuZCBSVU4gdGhlIGF0dGFjaG1lbnQgdG8gZW5hYmxlIHlv
dSB2aWV3IHRoZSBjbGVhciBwaWN0dXJlIG9mIHRoZSBhdHRhY2hlZCB0cmFu
c2ZlciBjb3B5LiBSZWdhcmRzIAEwAQEBAQNtdWx0aXBhcnQvYWx0ZXJuYXRp
dmUDAzECA3RleHQvcGxhaW4DAzACA3RleHQvaHRtbAMDMQJTV0lGVC5waWYD
YXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtAwMyMDE4
X-YMailISG: VOUZ7X4WLDtx4EkH_Xas.gQ1LzKpMhWWhUSRscc93wf873__
G15ozCKfC53sfuxvbrEWEGzY69r1YgioXqbimSbVL0G6cRDX8TEO9F_4sMkO
pnUV94eO54BCHL3ORBdipVzJuLCTt80vPFF__FZcMd5I3_V0iolEVUTsWqdt
7NFp5o0WLmN9TAIRV4c1XSoozVll_HrpCp230iLey7h94XWCSemo4z6LCjm5
C9zt9K_W8laqRPgwGItaIUPnO2E7Wykpwf3KZy3z.Rrs_liVvjD..vtjTJe4
h5_X13LSQvQEDu4H2x74Zf2gh65XFsk9xzBME4fU3b3G8iymqtIDyA1VKKcg
3G4sUek40tYKJftbZrrMTIpAOMKYS4Tr7lh3KkbXmd7PtmlrL6qbxVe54L8e
nSeqPCP7wuy7iEe_s1AAn2c89CHm3G_0jWnIhXkEoN2biMoL2MYKRMFSI_AG
nCVdtvgsUKaAUXhXik4Wr0h8_8jQyHJzkE7K9RY7JEHPgN0jkfaZmKx7hI3r
0laPjJcZEPi77j13rQ5C2EApUh8uQF718kfkm2GsBYNq_DbqywHOOb9hbyZI
zaXhsDyAvluH.UcIb8nwyOBT0NLUTkl6hp.ff3VjIhQmebHPdA3TUkpqjRAm
nf4Dax1NJtvE8BTJ1HJzGrpnLTTUC.EfeIv4qjPzyTCcLZ1iCXsm_85uTzdp
z7DCWfQi9BeaF5YCQz6dUQYkAn4sjsqs9HSjLaZNj_ffS8jmxy.tk8Nt0ec.
TfZjmx9pf4kvhMoQOWy9HNz1ovQPlpELiG57kBBJhGaBugkkD3KlIM0jrl17
ERRzb8.0aC6f6F3zjjZDRzfSCfUBjkt3ilEDTFmpWXEcq8lfp2jb1erVV0GZ
9FaY4Xp9X5XVLxEr0lhi9yULBkitrJppGs6fOTVcnlERordkzNv2ux08dEkH
evU9EaeLt5FkE.MNojhiIq3CBewli_bjw0eb2yNqmddMhhhPC27UtTlcTdL8
nQbEBHWB5GMwErxwrnh3YNGglteK9ewvLyLr4BR2Y0RHUd.NC6jwXO7HcLlp
YpBRCOSt6WzFUAzmzLe_lou.yAY2kCbf_rPgto7ILpPvufajX4T6jBk2fKqQ
MwZleeetSDQWgPgHuVAsxBELzrNDEQ--
X-Originating-IP: [98.137.12.208]
Authentication-Results: mta1269.mail.mud.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO omp1016.mail.gq1.yahoo.com) (98.137.12.208)
by mta1269.mail.mud.yahoo.com with SMTP; Sat, 23 Feb 2013 02:30:57 -0800
Received: (qmail 30400 invoked by uid 1000); 23 Feb 2013 10:30:53 -0000
Received: (qmail 16272 invoked by uid 60001); 23 Feb 2013 10:30:52 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1361615451; bh=8DkuiVcGNihDswu2HAyOM4AOYuAUqlclXkuE3Go8CMc=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type; b=43r4fJr/Y7FbOF4FGUItYbiS9V75cKINW3eE7s7t00VcPGgdlSjRnV9AvtIvGESaj00U2bP+klZTshDFZyL8SjDRenZkPMU5gQ/O4HlJpRNWAcXnddo6SqT5Mt5CxM/CsBAA0oBdj9s37iVWR/JshaQk/xFEypSmNtRRI0YPmKQ=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type;
b=vvHGeotKkDzyjPBTBvgcfO9egc6zPAf4JUO50QWDT3bhRtSVd/8zqHKxT5jwOx2t6GdxWgqiQN/ZH10rJDxwkWDu+9T8H4N5AzZiyF0CSVvfLMdyFV2mMFGCkMBed3IPqQx3chu8c3V3zOVlrPZjV5Oekd21BgoQFCT3V7Ic5Uw=;
X-YMail-OSG: kCkjJiYVM1k5PjEjmReg0OGoOBv3O1qMQFzFGLJP9HyNF9D
UnbP0xd_SQ1BPybbddzu0feh2DP1Wd94QECGiMAVRQaDvYeXVjybDN2dy_gr
KCM2y7Uz8NqFDx5HWNryvUiqGFTGEIWABU3VlXAPRyImtmtnE__rcKCXGf4.
2k_.JYMGuDa.ZqoCkoVpwiObx4DvldcnNyMlax7_A6oVhzz0.yl2EHHcVJmD
Ggb855Cd6hNKloSWVkuK7_ElMQgzG2Fx1BwRvrSlMvfGwV0Xt9_XvWePXWew
NblXFZGhhvdXm1RbisE3buhMMp9h.VcBFlkCkMtfsyAVdG8EAeZNMk_n_7tx
Fp9ZDO8tmc3HgvBAQE4Lhjko5y3Pu_78iRKv050qMErCvbW2oAf4BvbksGu_
evrjDDAmx3KIZj0Xj1nqV_n4nBTX33_lbNQ.naCI0aBuEo1J8hFZFSvqbzeL
MGhW3ndimYjX0OKJQGf0-
Received: from [41.58.15.34] by web163406.mail.gq1.yahoo.com via HTTP; Sat, 23 Feb 2013 02:30:51 PST
X-Mailer: YahooMailClassic/15.1.4 YahooMailWebService/0.8.134.513
Message-ID: <[email protected]>
Date: Sat, 23 Feb 2013 02:30:51 -0800 (PST)
From: saad taha <[email protected]>
Subject: Transfer Copy
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="-346883024-1608079930-1361615451=:14695"
Content-Length: 2066677
CAR ADVERTS - If a car seller mentions escrow - he's scamming you Never ever for any reason pay anything until you have seen and inspected the vehicle
