I can't tell if this is real or not...

[LightFufu]

I received this reply to my craiglist post offering my services as an English tutor. The language is a little funny and there are two different email address, one from this "globomail" which I found out through this site is rather suspicious. Any replies and thoughts would be greatly appreciated!

Mr J. Richard [email protected] via craigslist.org to serv-kjpvb-274.
show details 5:15 PM (19 hours ago)
** CRAIGSLIST ADVISORY --- AVOID SCAMS BY DEALING LOCALLY
** Avoid: wiring money, cross-border deals, work-at-home
** Beware: cashier checks, money orders, escrow, shipping
** More Info: http://www.craigslist.org/about/scams

--
Hello,
Happy Xmas in advance and How is the Weather also?. I just want to
know if the tutor lesson still available for my son, He is 14 years
old, I want you to calculate the cost of 2 hours per day for two days
in a week for the whole a Month which is 16 hours per month and email
me back the total cost..waiting

Best Regard

Joseph...


------------------------------------------------------------------
This message was remailed to you via: [email protected]
If this email is a scam or spam please flag it now:
http://www.craigslist.org/flag/?flagCod ... 93AmStfpbw
------------------------------------------------------------------

[AlanJones]

It's a scam I'm afraid.

A search on some of the sentences in the email (such as "I just want to know if the tutor lesson still available for my son,") brings up links to scam warning sites with different email addresses using the exact same format.

The scam is likely to take the form of an overpayment by fake cheque. The scammer will send you your fees, but will include something else in the payment (such as nanny fees) and ask you to forward the balance on by Western Union.

Alan

[Helen Halper]

Welcome to Scamwarners, Lightfufu!
Yes, definitely a scam. As you noticed the English is mangled and if you googled the message you'll find that it's been used many times before.
Would you please post the headers of the email?

[LightFufu]

Thanks so much for your responses, I thought it was too good to be true

What do you mean by "headers of the email"? I would like to comply but I don't know what you mean! Sorry

[AlanJones]

Take a look at the link in Helen's signature, that will tell you how to find the email headers, then you can remove your personal details and post them, so we can track where the scammer came from.

[LightFufu]

All right, I think I got it.


Delivered-To: Removed - Michelle
Received: by 10.143.41.14 with SMTP id t14cs84436wfj;
Mon, 12 Dec 2011 14:15:20 -0800 (PST)
Received: by 10.68.122.231 with SMTP id lv7mr16858496pbb.45.1323728118888;
Mon, 12 Dec 2011 14:15:18 -0800 (PST)
Return-Path: <bounce-anon-infectedbyemo=[email protected]>
Received: from mxo4f.craigslist.org (mxo4f.craigslist.org. [208.82.238.99])
by mx.google.com with ESMTP id g7si25087598pbv.61.2011.12.12.14.15.17;
Mon, 12 Dec 2011 14:15:18 -0800 (PST)
Received-SPF: pass (google.com: domain of bounce-anon-infectedbyemo=[email protected] designates 208.82.238.99 as permitted sender) client-ip=208.82.238.99;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce-anon-infectedbyemo=[email protected] designates 208.82.238.99 as permitted sender) smtp.mail=bounce-anon-infectedbyemo=[email protected]; dkim=neutral (body hash did not verify) [email protected]
Received: from mail-lpp01m010-f67.google.com (mail-lpp01m010-f67.google.com [209.85.215.67])
by mxi6f.craigslist.org (Postfix) with ESMTP id E4A001FB9B
for <[email protected]>; Mon, 12 Dec 2011 14:15:11 -0800 (PST)
Received: by lagu2 with SMTP id u2so98396lag.10
for <[email protected]>; Mon, 12 Dec 2011 14:15:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=mime-version:reply-tomessage-id:subject:from:to:content-type;
bh=oNkzlwp3/FrKV5v2bZDAN617OmwFZ203ceoM5G8b9Ww=;
b=OOIzLSdD6o0VgzNSFNw46SM2swz03yoqN458MGtFPt49C+k3NEnykyVGwpIvLTBYpw
jb3tTfCxg5dasq8UjqomUqdSOKp4cm+pGF6nky0Q56BGslwnz/jfI0812lBiOXzhPM98
MZNzUqyWE7uF+OJcHucPPUz2gRTHw6oKV7J1M=
MIME-Version: 1.0
Received: by 10.152.132.39 with SMTP id or7mr13064416lab.14.1323728110903;
Mon, 12 Dec 2011 14:15:10 -0800 (PST)
Received: by 10.152.5.103 with HTTP; Mon, 12 Dec 2011 14:15:10 -0800 (PST)
Reply-To: [email protected]
Date: Mon, 12 Dec 2011 14:15:10 -0800
Message-ID: <CAORNXpo4N=E9CODQsh=[email protected]>
Subject: English Tutor (Waterford )
From: "Mr J. Richard" <[email protected]>
To: Removed - Michelle
Content-Type: text/plain; charset=ISO-8859-1

** CRAIGSLIST ADVISORY --- AVOID SCAMS BY DEALING LOCALLY
** Avoid: wiring money, cross-border deals, work-at-home
** Beware: cashier checks, money orders, escrow, shipping
** More Info: http://www.craigslist.org/about/scams

--
Hello,
Happy Xmas in advance and How is the Weather also?. I just want to
know if the tutor lesson still available for my son, He is 14 years
old, I want you to calculate the cost of 2 hours per day for two days
in a week for the whole a Month which is 16 hours per month and email
me back the total cost..waiting

Best Regard

Joseph...


------------------------------------------------------------------
This message was remailed to you via: Removed - Michelle
If this email is a scam or spam please flag it now:
http://www.craigslist.org/flag/?flagCod ... 93AmStfpbw

[Helen Halper]

Hi LightFufu!
The scammer is using gmail, which strips the IP address, so unfortunately we can't tell where the email was sent from.
Now that you know how to get email headers, unless they're using an email provider that strips the IP, or a trick that scammers sometimes use to hide it, you can trace any other suspicious mail that you receive.
Please edit your address out of the post to keep it from being harvested by bots.