Another Gumtree scam reply. ISP America VA

Here is an initial reply from a Gumtree SCAM poster.

________________________________________________________
From [email protected] Fri Jan 9 21:29:07 2009
Return-Path: <[email protected]>
Authentication-Results: mta117.mail.re1.yahoo.com from=aol.com; domainkeys=neutral (no sig)
Received: from 205.188.157.38 (EHLO imo-d06.mx.aol.com) (205.188.157.38)
by mta117.mail.re1.yahoo.com with SMTP; Fri, 09 Jan 2009 21:29:10 -0800
Received: from [email protected]
by imo-d06.mx.aol.com (mail_out_v39.1.) id l.ce0.41389b73 (41809)
for <[email protected]>; Sat, 10 Jan 2009 00:29:07 -0500 (EST)
From: [email protected]
Message-ID: <[email protected]>
Date: Sat, 10 Jan 2009 00:29:07 EST
Subject: Re: Reply to your "2005 Mercedes-Benz C200 Kompressor" Ad on Gumtree
To: [email protected]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="part1_ce0.41389b73.36998c23_boundary"
Content-Length: 1939

Hi,

35000 kms. Price is $7000. The car looks and runs great. I am selling the car so cheap because I am in United Kingdom with my job and I am going through a divorce. I am an Gumtree seller so if you're ready for this purchase, I need to know your full name and address, as soon as I have them I will start the official procedure, and Gumtree will notify you about this. Gumtree will send you an Invoice with all the info you will need to complete the transaction. Also a 10 days refund policy will be included so if you will not like the car you will receive your money back.
Regards,
Simina


**************
New year...new news. Be the first to know what is making headlines. (http://www.aol.com/?ncid=emlcntaolcom00000026)
_________________________________________________________________________________

Below is the Fake Gumtree reply to authenticate the fake deal:

From Gumtree Fri Jan 9 23:15:10 2009
Return-Path: <[email protected]>
Authentication-Results: mta671.mail.mud.yahoo.com from=gumtree.com.au; domainkeys=neutral (no sig)
Received: from 216.193.201.224 (EHLO smtp1.globat.com) (216.193.201.224)
by mta671.mail.mud.yahoo.com with SMTP; Fri, 09 Jan 2009 23:15:45 -0800
Received: from localhost (smtp1 [127.0.0.1])
by smtp1.globat.com (Postfix) with ESMTP id 249457503DE
for <[email protected]>; Fri, 9 Jan 2009 23:15:14 -0800 (PST)
Received: from smtp1.globat.com ([127.0.0.1])
by localhost (smtp1.globat.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id X0RGpyZjU00Y for <[email protected]>;
Fri, 9 Jan 2009 23:15:13 -0800 (PST)
Received: from globat.com (ascension.inside.globat.com [10.1.1.48])
by smtp1.globat.com (Postfix) with SMTP id 85CAA7503DA
for <[email protected]>; Fri, 9 Jan 2009 23:15:10 -0800 (PST)
Received: (qmail 46914 invoked by uid 13473); 10 Jan 2009 07:15:10 -0000
Date: 10 Jan 2009 07:15:10 -0000
Message-ID: <[email protected]>
To: [email protected]
Subject: Your Invoice for Gumtree Purchases - Item : 2005 Mercedes-Benz C200 Kompressor
From: Gumtree <[email protected]>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Content-Length: 11746

Your Invoice for Gumtree Purchases - Item : 2005 Mercedes-Benz C200 Kompressor
Gumtree <[email protected]> AddSaturday, 10 January, 2009 6:15:10 PM
To:[email protected]

You've bought an item! Hi Carmen Maria Faruk,

Congratulations you have bought the following item!
2005 Mercedes-Benz C200 Kompressor
Item 2005 Mercedes-Benz C200 Kompressor
Ad type Classfied
Sale price AU $7000.00
Purchase date 10/01/09


Next Step? Complete payment !
The seller require the payment for this item ( 2005 Mercedes-Benz C200 Kompressor ) to be done through Western Union money transfer because it is his only way to receive the money in United Kingdom. Click here to locate the agents in your area. You must go to a Western Union office with cash and make a Money Transfer to the name and address of the seller for the amount ( AU $7,000.00 ) you and the seller agreed for the item. You must complete a form there. You must write there the seller's name, location, amount. You must declare it a personal transfer ( you will tell to the agent from Western Union that you are sending money to a friend of yours ) at the We stern Union office, otherwise you will not be able to send the money. Because the fee to send a Western Union Money Transfer is high, compared to other methods of payment, we have arranged with the seller and he will pay the fee (i.e., if it costs you $100 to send the payment, take $100 from the amount and send the balance). Once the payment was sent, email to the seller at [email protected] the following information :

1. 10 digit MTCN (Money Transfer Control Number)
2. Exact sender's name on file with Western Union
3. Your street address on file with Western Union
4. City and country where you sent the money from
5. Amount sent
Payment details: Delivery details:
Simina Mira Carmen Maria Faruk
10 Osborn Street 12 Merrylands Rd
London, E1 6TD &nbs p; Merrylands, NSW, 2160
United Kingdom Australia


Safe Trading Tip
Currently, the seller has a AU $10,000,00 deposit in an Gumtree purchase protection account. After you have made the payment you will receive the item in 3 days. After the item is received, you have ten days to inspect it. If it is complete and as described, you should accept the item. If not, you have 10 days from the reception date to request a refund. Refund requests are processed within 24 hours. The insured amount of the transaction will be taken from the seller's purchase protection account and refunded to you. The refund is sent to your bank account, or by check or money order. The way yo u are refunded is at your discretion. Also we confirm that the item that you are buying is on the name of the seller, there are no money owing on it and it comes with a clear title. You are buying from a VerifiedSeller so if something goes wrong or you are not satisfied with the item you will receive your money back in maxx 24 hours.


Gumtree® Team
http://www.gumtree.com.au
If you have any queries regarding this message, contact our Gumtree Live HelpTeam.

Live Chat by Gumtree


Copyright © 2005-2009 Kijiji International Limited





______________________________________________
Below is the email header from the attachments sent with the fake picture of themselves. My PC was infected and freezing after opening the mail.. and still freezes when I open it again...


From [email protected] Sun Jan 11 15:30:46 2009
Return-Path: <[email protected]>
Authentication-Results: mta218.mail.re3.yahoo.com from=aol.com; domainkeys=neutral (no sig)
Received: from 64.12.137.11 (EHLO imo-m19.mx.aol.com) (64.12.137.11)
by mta218.mail.re3.yahoo.com with SMTP; Sun, 11 Jan 2009 15:30:09 -0800
Received: from [email protected]
by imo-m19.mx.aol.com (mail_out_v39.1.) id l.c93.3c74eaf6 (48552)
for <[email protected]>; Sun, 11 Jan 2009 18:30:02 -0500 (EST)
From: [email protected]
Message-ID: <[email protected]>
Date: Sun, 11 Jan 2009 18:30:46 EST
Subject: Re: Reply to your "2005 Mercedes-Benz C200 Kompressor" Ad on Gumtree
To: [email protected]
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="part1_c93.3c74eaf6.369bdb26_boundary"
Content-Length: 135891
_______________________________________________________
To any Gumtree newbies get on the net and find out about getting scammed. These guys are sooo good, they'll con you into believing they are real and their situation is legit and this is why you must wire money before you can see the item or rental.

Don't become another SCAM statistic...

That is a textbook scam. One thing any user of Gumtree, Craigslist, or any other online ad site should do is take a look at the site's information on fraud. This information is directly from the Gumtree site.

* Never send or wire money to sellers or buyers. This includes never mailing a cheque or using payment services like Bidpay, Western Union or Money Gram to pay for items found on Gumtree. It is our belief that these forms of funds transfer are favoured by fraudsters.

Gumtree doesn’t offer any sort of buyer protection/ payment programs. Any emails you receive that talk about such systems are scams, even if they may have the Gumtree logo. If you receive any emails promoting these services, please report it to us.

Any buyer or seller who has read this should realize that the email is fake. Sadly, many people just jump in without paying attention, though, or become so blinded by the "deal" that they don't think things through. That is why getting the word out is so important, and when you post information here, you improve the odds that another potential victim will see it.

Below is the email header from the attachments sent with the fake picture of themselves. My PC was infected and freezing after opening the mail.. and still freezes when I open it again..

Did the pictures display? Scammers are after your money, and have nothing to gain from passing on viruses. They could do so unknowingly of course.
I take it you have a virus scanner. Although if your PC only freezes with that particular email, I'm not sure you have a virus. Rocketmail/Yahoo have good virus scanners.

Thanks for the replies.

I send emails from yahoo and gmail, and a scanner came up and said it was clean. It is weird. The pictures open but I cannot click them off. The task manager can't get rid of them either.I'm glad to hear it's likely not a virus.

Yes Gumtree do have warnings as do Craigslist. So many people don't want to snoop around a site and read stuff. Some may be directed straight to the posts. The little RED "Safety Tips" is easily mistaken for banter about meeting people in person, which doesn't happen much anymore. I like the Craigslist Australia warnings that default to the top of ever page and send a definite and strong message. If you're new to internet sales and aren't prepared or are too IT illiterate to do your homework, You are scambait!! Get someone's advice. Scamwarners is a good place to start.

Your initial ip resolves to a sat company in Californis, this is the bit that points to a possible West African or South African source

from globat.com (ascension.inside.globat.com

It's the Global TelSat over Ascension Island in the South Atlantic off the coast of Africa

OMG right when I thought I tracked it for myself it appears I'm not so clever after all. When I searched I got America VA. Oh well!

John, I can't see how you got the Nigerian Sat phone. Can you explain or point me to where I can get more edufication? I'm onto a good thing with my baits but I really need to know where the scammer is. I think with sat phones this may be impossible....

Thanks so much for setting me straight in a kind way...

Cheers

Your header, abbreviated a bit, but the relevant bits are still in

Received: from 216.193.201.224 (EHLO smtp1.globat.com) (216.193.201.224)
by mta671.mail.mud.yahoo.com with SMTP; Fri, 09 Jan 2009 23:15:45 -0800
Received: from localhost (smtp1 [127.0.0.1])
by smtp1.globat.com (Postfix) with ESMTP id 249457503DE
for <[email protected]>; Fri, 9 Jan 2009 23:15:14 -0800 (PST)
Received: from smtp1.globat.com ([127.0.0.1])
by localhost (smtp1.globat.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id X0RGpyZjU00Y for <[email protected]>;
Fri, 9 Jan 2009 23:15:13 -0800 (PST)
Received: from globat.com (ascension.inside.globat.com [10.1.1.48])

Apelord whois gives me

Mzima Networks, Inc. NETBLK-MZIMA-02 (NET-216-193-192-0-1)
216.193.192.0 - 216.193.255.255
GLOBAT MZIMA02-CUST-GLOBAT0 (NET-216-193-201-0-1)
216.193.201.0 - 216.193.201.255

iptracker whois shows this

IP address [?]: 216.193.201.224 [Copy][Whois]
IP address country: United States
IP address state: California
IP address city: Long Beach
IP postcode: 90815
IP address latitude: 33.793400
IP address longitude: -118.121201
ISP of this IP [?]: Mzima Networks
Organization: GLOBAT
Host of this IP: [?]: smtp1.globat.com [Whois]
Local Time of this IP country: 2009-01-13 19:36

Buried in your header is this line

Received: from globat.com (ascension.inside.globat.com [10.1.1.48])

Ascension Island is in the Southern Atlantic, it's a Sat Uplink and transfer station for communications between Africa, South America and and Northern Hemisphere countries.

I'm picking your lad is in either South Africa or possibly Nigeria or Ghana, although the last two countries are more usually on the Gilat Sat link

I have just found [email protected] and he is palming off a Toyota Hilux 4litre 4x4 on http://www.lacanto.co.za.

Be warned people.

Multejucari is now advertising on Junkmail -Durban
1997 Honda GL1500 Goldwing


Hello,

The price is R37,500. The bike looks and runs great. I am selling the bike so cheap because I am in United Kingdom with my job and I am going through a divorce. I am a VerifiedTrader so the transaction will be done through eBay. If you're ready for this purchase, I need to know your full name and address, as soon as I have them I will start the official procedure, and eBay will notify you about this. eBay will send you an Invoice with all the info you will need to complete the transaction. Also a 10 days refund policy will be included so if you will not like the bike you will receive your money back. Thanks