cwg Posted June 7, 2011 Share Posted June 7, 2011 I really would like to know what it is, I get several of these a month. (Full headers are included so you can see it's coming from different email address than the one in which the scammer is requesting to be replied to.) Return-path: <allispossible06[at]gmail.com> Envelope-to: me[at]mydomainfm.com Delivery-date: Tue, 07 Jun 2011 12:54:36 +0000 Received: from mail-wy0-f196.google.com ([74.125.82.196]) by rs3.abstractdns.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.69) (envelope-from <allispossible06[at]gmail.com>) id 1QTvno-004Gxy-3C for me[at]mydomainfm.com; Tue, 07 Jun 2011 12:54:36 +0000 Received: by wyf28 with SMTP id 28so1393455wyf.3 for <me[at]mydomainfm.com>; Tue, 07 Jun 2011 05:54:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:reply-to:date:message-id:subject :from:to:content-type; bh=hguZeVexvPDoc2BnMYDdL+tg2EZ+CVzLd5Iis6NcHwU=; b=deseBKXxQDGriqcewEjjB42zuvb822olNhz9d8mT5ZEXvqNjuBM/y3ZbAOCCqgnXZP 9dWIn6YhqqgDOMomKUI0zmHCQzRXIAC3JqmiaP0rA5WiEAp0bMM7wcABmHi79OvfQlIe QzDj13mI16Vi4TaM2Ax+Oyl7K9rcaLxQiqirM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=bcc:mime-version:reply-to:date:message-id:subject:from:to :content-type; b=wZqKzgpewh7NzkxhrT7m2QFw8LRS0OKA8u0TWs4F+q1tk+VsYPqePs2M4wz1Q29DH6 qtvdMsTCEVIQmFC0yxZHElpVSbq3VZfgEDA7qfNSlmyNpoHMFWVN3yPoovJwtt3A6eya jzy7gt+FifhtVzQX+2k6UQ4XF03fmmEbC4ugo= Bcc: me[at]mydomainfm.com MIME-Version: 1.0 Received: by 10.217.6.197 with SMTP id y47mr3682274wes.55.1307451277376; Tue, 07 Jun 2011 05:54:37 -0700 (PDT) Received: by 10.216.167.133 with HTTP; Tue, 7 Jun 2011 05:54:37 -0700 (PDT) Reply-To: jonswell11[at]live.com Date: Tue, 7 Jun 2011 13:54:37 +0100 Message-ID: <BANLkTimb5_EXechGFrsNbW+UDYZt=u=o+w[at]mail.gmail.com> Subject: CLASSIFIED From: Jon Roswell <allispossible06[at]gmail.com> To: undisclosed-recipients:; Content-Type: text/plain; charset=ISO-8859-1 Hello, I'd like to place a classified advertisment in your newspaper and ill want the ad placed onprint and online, go through my ad text below HONDA 1988 GL1500 MOTORBIKE FOR FREE.. IF INTERESTED CONTACT; jonswell11[at]live.com Ill want the ad to run for 2weeks, what will it cost to run the ad? if it wont be a free ad, and let me know if i'll be able to pay with my credit card. Thanks. Note that I don't even come close to working for a newspaper. Link to comment Share on other sites More sharing options...
rconner Posted June 7, 2011 Share Posted June 7, 2011 I really would like to know what it is, I get several of these a month. (Full headers are included so you can see it's coming from different email address than the one in which the scammer is requesting to be replied to.)Note that I don't even come close to working for a newspaper. I think the most common credit card scam involves using randomly-guessed card number that have been "verified" as working -- the perps then contact some unwitting online dealer to buy some fungible stuff (jewelry, etc.) using the cards. When the card's owner finds out, the card will be shut down and the transaction charged back and the vendor will be out both the money and the merchandise. These fit the general money-mule pattern of persuading the target to exchange his money/goods/etc. for some seemingly solid promise of reward that later goes bust. Sometimes these guys will give you a huge check on some odd pretext (e.g., "transaction processing"), then ask you to cash it thru your own account and kick most of the money back to them. It's a race to the bank as the perp hopes that he will get that "rebate" before the target discovers that the check is NFG. Hard to figure what is going on here, however. since the scammer is asking for something of relatively little intrinsic value. Perhaps there's someone here more expert at human mendacity than I. -- rick Link to comment Share on other sites More sharing options...
Farelf Posted June 8, 2011 Share Posted June 8, 2011 Scam-like features include repetition ("several a month" doesn't fit the cover story), BCC: header (supposed to be suppressed) and unbelievable deal (cunningly deflected to maybe make it more believable). The "drop box" address at live.com is real. Puzzling thing is it doesn't seem to be running wide-spread "in the wild". Otherwise it would most probably be just a "come on" for the greedy and gullible, like a "419" - or maybe someone who doesn't like the owner of that live.com address (wants to see the address flooded). Perhaps it is simply targeted at known Goldwing enthusiasts? (As a come on). I confess it a new one on me. But, like all spam, quite pointless unless it happens to push your buttons, eliciting response (there certainly would be some who would find that one irresistible, like "You're giving it away? I want it, I want it, how many acres of broken glass do you want me to crawl over?"). Link to comment Share on other sites More sharing options...
SpamCop 98 Posted June 8, 2011 Share Posted June 8, 2011 Of course, it's not about the ad. It's about the free motorbike. Which of course will need to be shipped. So who ends up giving whom their payment? Police say ‘free’ Honda ad a scam, originating in Nigeria Aspen Daily News Staff Report Saturday, May 14, 2011 A classified ad in a recent edition of the Aspen Daily News for a free Honda motorbike caught the eyes of a few people before catching the attention of police. The ad, which last ran in Wednesday’s paper, said, “Honda 1988 HL1500 Motorbike for free. If interested contact richardlawson2004[at]gmail.co.†One person who responded to the ad was told that the motorbike was being shipped from California to Ohio after a long-winded email about the death of a grandson and that $600 should be sent via Western Union, said Bruce Benjamin, an investigator with the Pitkin County Sheriff’s Office. The money was supposedly to pay for shipping fees and arrangements in Colorado to drop off the vehicle. After the questionable response — including the line that “seeing the bike always brings back it memory [sic] and it makes me cry†— a valley resident contacted the newspaper, as did police. The ad was pulled immediately. At least three people responded, though no one sent money, Benjamin said. One person played along and told authorities that he was instructed to send money using Western Union to an address that turned out to be in Nigeria. An accountant was supposed to pick up the money but had been injured in a car accident, the story went. But another accountant who happened to be traveling in Africa could pick it up in Nigeria. “This is a typical Nigerian scam,†Benjamin said, urging people to follow the “if it sounds too good to be true, it usually is†advice. “Never Western Union money to an unknown entity.†Anyone who has been victimized by the scam should contact the sheriff’s office or Aspen police. Link to comment Share on other sites More sharing options...
cwg Posted June 8, 2011 Author Share Posted June 8, 2011 Still need a name for it, here's one, probably under the same circumstances, different product: Hello, My name is Jarrett Moore ,I will be very happy if you can quote me for the below ad for 3 weeks on your newspaper both online and on print AD Text : 2 Lovely English Bulldog are seeking for a Lovely and wonderful Mum or dad who will take a very good care of them both Akc Registered ,shot up to date, well vaccinated , love to be Carried around and good with other pet if interested kindly email me at rs8862[at]yahoo.com I Await the ad quote for 3 weeks in both print and online asap. Thanks.. Jarrett Link to comment Share on other sites More sharing options...
Farelf Posted June 8, 2011 Share Posted June 8, 2011 Not sure why you need a name but I reckon you got names in SpamCop 98's post - an imaginative variant of the advance fee/Nigerian/419 scams. The variation is the "misdirection" of the message. Oops, this is meant for a newspaper advertising bureau and it ended up with me - how lucky am I? I shall contact him immediately. If so, it's just like the "lucky misdirection" hook used with the "attached is your e-ticket" things (except the "payload" of those is a nice little trojan downloader in the attachment). Link to comment Share on other sites More sharing options...
rconner Posted June 8, 2011 Share Posted June 8, 2011 Not sure why you need a name but I reckon you got names in SpamCop 98's post - an imaginative variant of the advance fee/Nigerian/419 scams. Aha, there it is, I neglected to notice the free motorbike angle. A lot of these Nigerian scams derive some of their appeal from convincing the target that he himself is doing something a bit shady or crooked. --rick Link to comment Share on other sites More sharing options...
SpamCop 98 Posted June 8, 2011 Share Posted June 8, 2011 It is a variant of the Nigerian advance-fee fraud, probably very closely related to how it has been exploited on craigslist. There is nothing new under the sun. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.