Scams operating under the guise of a charity.
#6013 by laverdadx100 Sun Nov 30, 2008 8:10 pm
Is yahoo now stripping the headers and replacing it with their own? Or are the scammers using an E-mail masking program?

From Tasha Norris Thu Nov 27 15:12:02 2008
Return-Path: <[email protected]>
Authentication-Results:; domainkeys=pass (ok)
Received: from (HELO (
by with SMTP; Thu, 27 Nov 2008 15:12:03 -0800
Received: from [] by with NNFMP; 27 Nov 2008 23:12:02 -0000
Received: from [] by with NNFMP; 27 Nov 2008 23:12:02 -0000
Received: from [] by with NNFMP; 27 Nov 2008 23:12:02 -0000
Received: (qmail 9515 invoked by uid 60001); 27 Nov 2008 23:12:02 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
Received: from [] by via HTTP; Thu, 27 Nov 2008 15:12:02 PST
Date: Thu, 27 Nov 2008 15:12:02 -0800 (PST)
From: Tasha Norris <[email protected]>
Reply-To: [email protected]
Subject: hi mrs janet

MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1644346354-1227827522=:9043"
Message-ID: <[email protected]>
Content-Length: 5308

#6040 by Charles Fox Tue Dec 02, 2008 11:22 am
Usually it the lowest Ip in the header.

IP address [?]: [Whois]
IP address country: Italy
IP address state: Lombardia
IP address city: Mozzate
IP address latitude: 45.683300
IP address longitude: 8.950000
ISP of this IP [?]: Reti Telematiche Italiane S.p.A.
Organization: Milano Teleport Italia Srl

Wow! I need you and thank you for the information.


So I can close this chapter with no more fretting, right? Thanks so much for your help.
#6045 by Jillian Tue Dec 02, 2008 2:53 pm
Hi laverdadx100, you have posted a duplicate of this here: viewtopic.php?f=4&t=1733

I'll lock this one so that we can keep the discussion in one place.

Have you sent a payment to a scammer with Western Union and now realize it's a scam? If the payment has not been picked up, you can cancel it immediately! 1-800-448-1492

Follow ScamWarners on Twitter:

Who is online

Users browsing this forum: No registered users and 3 guests