The scammer That MacBook and MacBook Pro posts ads on Craigslist is still at it. This one recently posted an ad on the Craigslist Chambana group. Respond and I got the typical email That "Bold Dreamer" / "Amy" Was now in the UK But Could They use DHL to ship the computer to me. Below Are the headers from the "Bold Dreamer" email.
Delivered-To: [redacted]
Received: by 10.181.14.5 with SMTP id r5cs49514bki;
Wed, October 1, 2008 10:41:39 -0700 (PDT)
Received: by 10.181.25.18 with SMTP id c18mr4654391bkj.8.1222882899217;
Wed, 01 Oct 2008 10:41:39 -0700 (PDT) Return-Path
:
Received: from mail.safedatatech.com (sdt1.safedatatech.com [72.51.41.18]) by mx
. google.com with ESMTPm5si414461gve.3.2008.10.01.10.41.22 id;
Wed, 01 Oct 2008 10:41:30 -0700 (PDT) Received-SPF
: SoftFail (google.com: domain of transitioning not does amy28.1979 @ hotmail.com Designate 72.51.41.18 as permitted sender) client-ip = 72.51.41.18;
Authentication-Results: mx.google.com; spf = SoftFail (google.com: domain of transitioning amy28.1979 @ hotmail.com Does Not Designate 72.51. 41.18 as permitted sender) = amy28.1979 smtp.mail
@ hotmail.com Received: from ttt-fafff0874fc (ACA4095E.ipt.aol.com [172.164.9.94])
(Authenticated sender: SDT01230-2007)
by mail. safedatatech.com (Postfix) with ESMTP id 1FA7F7D7BFB
for [redacted], Wed, October 1, 2008 13:41:11 -0400 (EDT)
"Amy" ASKs me for a name and address for shipping tond I send back
Theodore Kaczynski
PO Box 8500 Florence, CO 81226 This
Apparently Does not deter the scammers, so I get some forged emails purporting to come from DHL Instructing me to send money-through Western Union. Here Are the headers from That:
Delivered-To: [redacted]
Received: by 10.142.87.21 with SMTP id k21cs165631wfb;
Fri, October 3, 2008 13:20:14 -0700 (PDT)
Received: by 10,114 .241.15 o15mr1888453wah.96.1223065213551 with SMTP id;
Fri, 03 Oct 2008 13:20:13 -0700 (PDT) Return-Path
:
Received: from blu0-omc3-s14.blu0.hotmail.com (blu0-omc3- s14.blu0.hotmail.com [65.55.116.89]) by mx.google.com with ESMTP
4si370 id4945yxq.9.2008.10.03.13.20.12;
Fri, 03 Oct 2008 13:20:13 -0700 (PDT)
Received-SPF: pass (google.com: domain of customerservice@webservice-dhl.com designates 65.55.116.89 as permitted sender) client-ip=65.55.116.89;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of customerservice@webservice-dhl.com designates 65.55.116.89 as permitted sender) smtp.mail=customerservice@webservice-dhl.com
Received: from BLU137-W10 ([65.55.116.73]) by blu0-omc3-s14.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
\t Fri, 3 Oct 2008 13:20:06 -0700
Message-ID:
Return-Path: customerservice@webservice-dhl.com
Content-Type: multipart/alternative;
\tboundary=\riginating-IP: [172.162.72.72]
From: DHL Customer Service
Wow, the originating IP (172.162.72.72) on this one is also from AOL, just like the one from \'T come from DHL at all - the domain is "webservice-dhl.com" A check on this That shows it's part of Microsoft's
http://www.officelive.com
site, Which Has Been Used by Some Other sketchy folks too.
I sat back a response to "Amy"
Unfortunately, Mr. Kaczynski is Not at liberty to visit a Western Union terminal right now, But he'd Be willing to mail a package to you directly. Could I get your personal mailing address and I'll pass it Along?
No response yet. I sat a Complaint to the support people at officelive.com and They shut down the "webservice-dhl.com" domain. I Have Little Doubt That they'll soon be back under a similar domain, pero inconvenience this May Have Them for a little while. Unfortun
0 comments:
Post a Comment