Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
by melis4le Sun Sep 25, 2011 5:20 pm
i m corresponding with a man that hasn't asked me for money but i suspect is a scam. here is one of the emails with headers. please help.


Morning to you,

Lets say that i am so old fashioned and always hope to woo you in that system.How are you doing this early morning?I am happy that you slept well and had nothing much to say about your night.just make sure you always wake on the right side of bed.

I am a petroleum engineer and like i said in my earlier mail to you that i do sub contracts in the middle east(Oman to be precise).But due to the current up rise in the middle east i had to hurry my scary bum back to London to be with my daughter Vanessa,she is another angel am thankful to God for blessing me with.

I will wait to talk with you over the messenger and since you have my number,please do give me a call and invite me to your ER(great fan of Greys Anatomy,House and Private Practice).

Have a splendid day and waiting for a swift response.

Bryan


Return-Path: <[email protected]>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
b2xkIGZhc2hpb25lZCBhbmQgYWx3YXlzIGhvcGUgdG8gd29vIHlvdSBpbiB0
aGF0IHN5c3RlbS5Ib3cgYXJlIHlvdSBkb2luZyB0aGlzIGVhcmx5IG1vcm5p
bmc_SSBhbSBoYXBweSB0aGF0IHlvdSBzbGVwdCB3ZWxsIGFuZCBoYWQgbm90
aGluZyBtdWNoIHRvIHNheSBhYm91dCB5b3VyIG5pZ2h0Lmp1c3QgbWFrZSBz
dXJlIHlvdSBhbHdheXMgd2FrZSBvbiB0aGUgcmlnaHQgc2lkZQEwAQEBAQ--
X-YMailISG: KPQqlzAWLDsZy6puDvew0dzpEi8SMsoxi9Ltpd7LhqA7ziDU
CHsheBRJvCqGq4bzGTtWlU1YpBHaBUiJeWy6Cotx8AmLC72DZaCyABQXRgan
uzcvLsFiGsnwJPvRPx1r0sSc6rgbKYZsotnPGwu6PY8HgCv4y1O5PpskYPON
i7z9qEFCSxIEMpftZ2JaH5P2gG6F6u.P8g.sMFfZMlPNj9Vuv3L2dI8GwprR
P0QaBdOyZqlH1tGZ0x0ucaJudGVq1Nh95JM_442wF3W2i07fh0Q637R39ONe
O5GrQRWWuRWnOA87qqk3KIo9RhRxQo81o3WRzTBL3RH0W2PqCzxKyjnSwMqB
gfLNob1QbR10t3UBPw1udJSfY_FYp16UmXiUqdosB7bimYnn7N3ZpsA.3AHJ
11.I.22Nd_5p7V3Hca51IAas_wWD1LVTyrXgBHaf.AkSWiC5miUfmoRpo19i
QMeMiYSax_aPkYNWnIKR2AQlvEncUMfAaPGXtKRtM2xC0_O.Y2hsPEoqUecA
20IbN5eeG9ask7l0ulmH0oX_qtfAXBaOEc1McCuz0ind2GZKAJ8.tAZdRzkc
Y9jzgcD.KNPi_EfL5OgYDRISpG9CKqEwzZdzC9XecDuMokz2w4hyzMCLNNMm
l1A20LOwySJ01u3sPkUKY0Ly.SLEgQTXOyxHs45HCebMefrChxUU9REQJFcJ
KGpPodWvbDzy7Yw5GIF0HtkL.Swf9NxlYFIuRlZdEPr8ylwF5vHSug_ulIcl
6xFUv27Ou.jkBlLVf0puqDXunu71K.FBSyymnCT.7ivWDkRbzX6aQBKJ_5ER
icEhLYnpNuKe4CKYHtpOOOogpt66m707lDt5RS60_qcZHR5LIN.gD8lbTh6G
aojqRjeoJIOVNPfDLdOdGjcLxBA3mp.Idt8f9raG.4NiCtZpnPv3E03K4CSt
ePG4b4VZoAEPXR0IEaumXKFHDgJZOGY6JJ27DPIil6l2HP2DixKtti.wXZ3E
6nOM9UimhUnptP29G1F_Fzap8.32QoHmbIfJqcTBCKnKRn9pAJsc9Ur2quml
Sd_X.XLEVwXFaOswsCTIkTlIcrpHtEffg736PejU2iCmJbGB_4ePC.TsfZQb
ilA_2Jaq8GsvUVUSkspWwjfSoDAuRBAOEmD.t1gWYgj88xk5hBE6FltYnHVW
ZS.c
X-Originating-IP: [98.138.91.17]
Authentication-Results: mta1075.mail.sp2.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm1-vm2.bullet.mail.ne1.yahoo.com) (98.138.91.17)
by mta1075.mail.sp2.yahoo.com with SMTP; Sun, 25 Sep 2011 05:48:50 -0700
Received: from [98.138.90.53] by nm1.bullet.mail.ne1.yahoo.com with NNFMP; 25 Sep 2011 12:48:48 -0000
Received: from [98.138.89.233] by tm6.bullet.mail.ne1.yahoo.com with NNFMP; 25 Sep 2011 12:48:48 -0000
Received: from [127.0.0.1] by omp1048.mail.ne1.yahoo.com with NNFMP; 25 Sep 2011 12:48:48 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 87493 invoked by uid 60001); 25 Sep 2011 12:48:48 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1316954928; bh=cf+Ps+1QiLR3g694uBqzt6VRrGKA4YT7m4BR0UNTQzc=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=DeQTjr75pyLpvZW9HpO/NUojREaY3MmefLyMjgBUFg2wSx4sJ9aOr8LySomLjT8W1wKsaMZpGuAnIRBqifFXM0M2psnjYPxp03QauVsN0cnAJZVdhTTnJElSEBXmrZp8w+4QlFJGS1N8EskKtwZEPtNG/UWwXKABWYdhsZDJpGI=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=QXBJ6xyHjFKBMQA3oxP8iFllG9cKHIiyiqbcKZwkJfwUMK3daN6Tzz4MBD2etdG91tyWRUvMDXN27pw3EXHiSPI9L/v4pQRo1obrrqF5t6IpMJMm+p9+8kws0mDSYa2+4ZvGZENX+A3nTPvi/1KnVC4XQFSdP85B0MjvUL2+38M=;
X-YMail-OSG: xLpLPPEVM1nDePBgL_77TxvVidkqiZpU8vyECvH0YPjzKbC
UKEne73sIjJ_QmtWh1h5.J9AsGuGoXKUHxWH70rGDpJ4.U4TAcUFBtn0lcEL
eVyVJ_cUW.EKYghFwN6l.pDLE6MBBWZhEtGlpf9WnTiQTJwmjlTjapRBay5e
AfVbVFGul5evFtXAZ8GTbT1l_BSQnZl11XFoB2jt2I1Zv3ZWMtffu7Hxg9Bi
CqWxNVJTPhO4Fs8472QhcUwtLadHVYnU7CZrHR8BUpsx2soJqnySNW_aWpjw
vFgi5xGVHxFIAXjBX9VZTzbD7KCwQrCfKQsruA4veU5Mv61LDbjzNv7atr2k
xEEjfe3vT.gRDvZF7sSvH8sPEYwvAjUct_tNTs9U1NW2IhdhTr3Jy.Xlarbr
nsYco6k9LWBBr
Received: from [69.250.134.34] by web124705.mail.ne1.yahoo.com via HTTP; Sun, 25 Sep 2011 05:48:48 PDT
X-Mailer: YahooMailWebService/0.8.114.317681
References: <[email protected]> <[email protected]> <[email protected]>
Message-ID: <[email protected]>
Date: Sun, 25 Sep 2011 05:48:48 -0700 (PDT)
From: Bryan Campbell <[email protected]>
Reply-To: Bryan Campbell <[email protected]>
Subject: Re: MORNING
Advertisement

by Helen Halper Sun Sep 25, 2011 5:35 pm
Welcome to Scamwarners, melis4le !
Unfortunately it looks like the scammer is using a trick to hide where his emails are coming from. However, the language in the message leaves no doubt that he is a scammer from Africa.
It would be best if you just stopped contact with him immediately. Please don't tell him that you know that he's a scammer and why. That would just help him to know the things that he needs to work on to be more convincing with his next victim.

by jolly_roger Mon Sep 26, 2011 12:47 am
And usually (but not all the time) the NNFMP indicates a suspicious email. It is a protocol seen in yahoo email headers. Unfortunate yahoo does not elaborate on the profile. It only says, Current Status: Offline, Name:-
Gender:Male, Age:- Location:-, Yahoo member since: 22/09/2011 and shows an image of an individual with black hair and wearing a blue shirt.
by anita42 Mon Sep 26, 2011 10:36 pm
I just received an email from him. He did not hide his location. He's in Lagos, Nigeria. I am doing this safely.
The headers are below:

Received: from [email protected] by (64.135.83.91:25) via
nm34.bullet.mail.ne1.yahoo.com (98.138.229.27:47274) with [InBox.Com SMTP
Server] id 1109261001075.WH91 for xxxxxxxxxxxxxxx; Mon, 26 Sep
2011 10:01:04 -0800
Received: from [98.138.90.56] by nm34.bullet.mail.ne1.yahoo.com with NNFMP; 26 Sep 2011 18:01:04 -0000
Received: from [98.138.87.12] by tm9.bullet.mail.ne1.yahoo.com with NNFMP; 26 Sep 2011 18:01:04 -0000
Received: from [127.0.0.1] by omp1012.mail.ne1.yahoo.com with NNFMP; 26 Sep 2011 18:01:04 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 56695 invoked by uid 60001); 26 Sep 2011 18:01:03 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1317060063; bh=Er5LoDi/xPVqBvbq/VN4l6RJ7Ne0bcwGeNhcbgWLsBc=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=KxwKnkO9JH+g0RCyCzmEp5KK0LVh+/HiMFxSHynKGySTbb3xX+/VYduNfFhu2x+wCGKEkc0cAb2cYweCH/I56J7rbClHlgjTnrc2QNMYSYHZ2or6jHBNyj/QoGWA8BLa/dKOAW054TvlgDhL0aM9j7QOjF8+cgEFx6d32QmxC0M=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=xmrcQIiFLAlDDLSZTT1UTOU7IUe6vq5lEpnzxfODvbeUw2nwjxFuWQFx8jWgw/rkha9z4tfCxkjCjSorxvLdJc2B/d/klwHnrbRwaQlo5f9m8UFbOFLgEtL16oUuZrc1tCzyH5xvbjgebCYfcQlz/GRBm4YP8+SNYOmm151O6dU=;
X-YMail-OSG: ZaiHOIwVM1kgdxzHLgnASuFs3w8LEkG_TBqR5eQxrBh63LU
Va.XP9W6OC7e4EKqbNFgNW3f0ek83TM22WE8mpjb8TW9kUAh.fEr.uyW1j2E
0aoVVmadSnC_7YinMOS6FNfB5grn0U2WgEG_tR7np5mPQl2x6doh2mhlTLix
8MzWAX6btUZjqZZ217kmx5_6Y6OJRmN0MWEARh.JZmTex4XQMseIVZJTlxIR
jrW34AdcuBsDZURzMl3nKqnGm8ti6aPvL5z7FFJOuX5278JH7iWoNBZUtWfA
43J7VqrwRLAX.PzNsKgi5420U17kvJ9Mr6ocDEBXSZU7OV_4g48J2SgC6hme
eyrCo8_1iLpTV9o4EoDvWP3kV4jBEHow40y6a8.wHFfHM0Xoi6vn.jHJL0rN
VymJORropX2Diu2vAp.x8LX91oPSWOpP_Qs77SJleeUtLpNCMexHFIVkL6OD
awRzAWi6pSp5GFQt6Gr.58gckvx7MCcXRTUW2R_N.ChzHvQ--
Received: from [41.220.69.11] by web124712.mail.ne1.yahoo.com via HTTP; Mon, 26 Sep 2011 11:01:03 PDT
X-Mailer: YahooMailWebService/0.8.114.317681
References: <9BE1EE11173.0000032C
Message-ID: <[email protected]>
Date: Mon, 26 Sep 2011 11:01:03 -0700 (PDT)
From: Bryan Campbell <[email protected]>
Reply-To: Bryan Campbell <[email protected]>
by jolly_roger Tue Sep 27, 2011 1:39 am
From what is available at this time, your email seems to have originated out of Asaba (just to the east of lagos)

Who is online

Users browsing this forum: Bing [Bot], ClaudeBot and 29 guests