I received a scam email via autotrader.com. The email headers are not useful because the message is relayed through autotrader. Unfortunately, the IP address of the "buyer" is not provided by autotrader.
Here is the initial message from the scammer. It fooled me because it did not contain the usual red flags.
I get quite a few of these every week from actual customers, so I sent back the standard "yes" reply. Then I received the following scam script. This message does contain the usual red flags. The IP resolves to New Zealand.
Here is the initial message from the scammer. It fooled me because it did not contain the usual red flags.
is this car for sale
I get quite a few of these every week from actual customers, so I sent back the standard "yes" reply. Then I received the following scam script. This message does contain the usual red flags. The IP resolves to New Zealand.
Received: by 10.220.176.130 with SMTP id be2cs118757vcb;
Tue, 24 May 2011 21:33:48 -0700 (PDT)
Received: by 10.229.225.208 with SMTP id it16mr3245804qcb.182.1306298028044;
Tue, 24 May 2011 21:33:48 -0700 (PDT)
Return-Path: <[email protected]>
Received: from snt0-omc1-s12.snt0.hotmail.com (snt0-omc1-s12.snt0.hotmail.com [65.55.90.23])
by mx.google.com with ESMTP id z1si15715179qcq.41.2011.05.24.21.33.47;
Tue, 24 May 2011 21:33:48 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 65.55.90.23 as permitted sender) client-ip=65.55.90.23;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 65.55.90.23 as permitted sender) [email protected]
Received: from SNT131-W9 ([65.55.90.8]) by snt0-omc1-s12.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 24 May 2011 21:33:25 -0700
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_3606452d-bd16-48c9-953a-53d0b48cafee_"
X-Originating-IP: [202.37.187.253]
From: peter jack <[email protected]>
To: xxxx
Subject: RE: Important Sales Lead from AutoTrader
Date: Wed, 25 May 2011 04:33:25 +0000
Importance: Normal
In-Reply-To: xxxx
References: xxxx
MIME-Version: 1.0
X-OriginalArrivalTime: 25 May 2011 04:33:25.0896 (UTC) FILETIME=[E35DD080:01CC1A94]
Thanks for the swift response...I am willing to know the lowest price of it.and please due to the nature of my job and location...i will not be able to come for inspection,am a very busy type as i work long hours everyday,i have gone through your advertisement and i am satisfied with it.
As for the payment..i will be paying you via the fastest and secure way to pay online(PayPal).
I have a private courier agent that will come for the pick up after the payment have been made ...so no shipping included.
You can now send me your PayPal email so i can pay in right away and also include your address in your reply.If you don't have a paypal account, you can easily set up one...log on to http://www.paypal.com and sign up. its very easy.I await your reply asap.