ss

"sweet sawdust"

21/05/2009 12:37 PM

Scam Or Real??

Just go the following e-mail. anybody want to bet on whether its a scam or
not?

Good day,

We browsed through your web page and we are interested in ordering some of
your products,we are located in Thailand,we will like to know if you have
the items in stocks,so kindly get back to me with the right contact person
email,phone # and confirmation of website so that we can place my order
quickly, and i want to know if you have your own personal shipper or can the
order be picked up at your store,please advise so that we can proceed by
going
ahead to place the order.

Regards
Mark


This topic has 33 replies

LM

"Lee Michaels"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

23/05/2009 4:33 AM


"CW" <[email protected]> wrote in message
news:[email protected]...
>
> "mm" <[email protected]> wrote in message
> news:[email protected]...
>>
>>> Whenever telemarketers call me, I string them along as long as is
>>> possible.
>> If we make telemarketing less productive/profitable maybe some of them
>> would stop. Then again, maybe it doesn't make a damn bit of difference in
>> the long run.....
>
>
> http://www.youtube.com/watch?v=J5z4Vs26-TI
>
Now that is funny.

Much more effort than I would put into it. But very funny.


DB

Dave Balderstone

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

23/05/2009 9:55 AM

In article <[email protected]>, CW
<[email protected]> wrote:

> "mm" <[email protected]> wrote in message
> news:[email protected]...
> >
> >> Whenever telemarketers call me, I string them along as long as is
> >> possible.
> > If we make telemarketing less productive/profitable maybe some of them
> > would stop. Then again, maybe it doesn't make a damn bit of difference in
> > the long run.....
>
>
> http://www.youtube.com/watch?v=J5z4Vs26-TI

http://www.tommabe.com/

--
Kiva - Loans that change lives.
http://www.kiva.org/lender/david87375440

DN

David Nebenzahl

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 11:06 AM

On 5/21/2009 10:37 AM sweet sawdust spake thus:

> Just go the following e-mail. anybody want to bet on whether its a scam or
> not?
>
> Good day,
>
> We browsed through your web page and we are interested in ordering some of
> your products,we are located in Thailand,we will like to know if you have
> the items in stocks,so kindly get back to me with the right contact person
> email,phone # and confirmation of website so that we can place my order
> quickly, and i want to know if you have your own personal shipper or can the
> order be picked up at your store,please advise so that we can proceed by
> going
> ahead to place the order.
>
> Regards
> Mark

I wouldn't rush to fulfill this order.

No offense to the good people of Thailand, but if it looks like a scam,
smells like a scam ...


--
Found--the gene that causes belief in genetic determinism

MD

Morris Dovey

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 1:22 PM

sweet sawdust wrote:

> You think I should spray it with fabreeze before going forward??

If you have a copy of "whois", do a lookup on every IP address in the
headers. If you don't have it, post the headers here - it might be an
interesting (and educational) exercise...

--
Morris Dovey
DeSoto Solar
DeSoto, Iowa USA
http://www.iedu.com/DeSoto/

DN

David Nebenzahl

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 12:08 PM

On 5/21/2009 11:55 AM sweet sawdust spake thus:

> "Morris Dovey" <[email protected]> wrote in message
> news:[email protected]...
>
>> sweet sawdust wrote:
>>
>>> You think I should spray it with fabreeze before going forward??
>>
>> If you have a copy of "whois", do a lookup on every IP address in the
>> headers. If you don't have it, post the headers here - it might be an
>> interesting (and educational) exercise...
>
> OK since I am not sure how to do what you ask here are headers etc. They
> look a little wierd to me, but I don't know enough about them to know.

[...]

> X-Originating-IP: [66.7.205.91]

Bingo; that's the IP address you want to do a WHOIS on.


--
Found--the gene that causes belief in genetic determinism

DN

David Nebenzahl

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 12:09 PM

On 5/21/2009 11:54 AM Colin B. spake thus:

> sweet sawdust <[email protected]> wrote:
>
>> Just go the following e-mail. anybody want to bet on whether its a scam or
>> not?
>>
>> Good day,
>>
>> We browsed through your web page and we are interested in ordering some of
>> your products,we are located in Thailand,we will like to know if you have
>> the items in stocks,so kindly get back to me with the right contact person
>> email,phone # and confirmation of website so that we can place my order
>> quickly, and i want to know if you have your own personal shipper or can the
>> order be picked up at your store,please advise so that we can proceed by
>> going ahead to place the order.
>
> As much as it smells like a scam, I would probably be tempted to follow
> up on it. Ask 'em what they want, and how they intend to pay. If they
> want to pick it up in person, well...

That's true. No harm in asking.


--
Found--the gene that causes belief in genetic determinism

MD

Morris Dovey

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 2:57 PM

sweet sawdust wrote:
> "Morris Dovey" <[email protected]> wrote in message
> news:[email protected]...
>> sweet sawdust wrote:
>>
>>> You think I should spray it with fabreeze before going forward??
>> If you have a copy of "whois", do a lookup on every IP address in the
>> headers. If you don't have it, post the headers here - it might be an
>> interesting (and educational) exercise...
>>
>> --
>> Morris Dovey
>> DeSoto Solar
>> DeSoto, Iowa USA
>> http://www.iedu.com/DeSoto/
>
> OK since I am not sure how to do what you ask here are headers etc. They
> look a little wierd to me, but I don't know enough about them to know.
>
> Received: from horizon.host-care.com ([66.7.205.91])
> by isp.att.net (frfwmxc08) with ESMTP
> id <20090521160710M0800bqnide>; Thu, 21 May 2009 16:07:10 +0000
> X-Originating-IP: [66.7.205.91]
> Received: from nobody by horizon.host-care.com with local (Exim 4.69)
> (envelope-from <[email protected]>)
> id 1M7AnX-0004nV-Ag
> for [email protected]; Thu, 21 May 2009 12:07:11 -0400

With Thunderbird I choose "View" then "Message Source" and get a window
displaying all the text of a received e-mail. The headers are all the
lines before the message itself. For example:

X-Account-Key: account2
X-UIDL: 6205
X-Mozilla-Status: 0003
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:

Received-SPF: none (No spf1 record for (yahoo.com) )
client-ip=98.136.44.51; envelope-from=<[email protected]>;
x-ip-name=n75.bullet.mail.sp1.yahoo_com;
X-Default-Received-SPF: pass (Last token {ptr:%{d2}} (res=PASS))
client-ip=98.136.44.51; envelope-from=<[email protected]>;
x-ip-name=n75.bullet.mail.sp1.yahoo_com;
Received: from n75.bullet.mail.sp1.yahoo.com (unverified [98.136.44.51])
by surge.jtmweb.com (SurgeMail 3.9e) with ESMTP id 36445513-1776515
for <[email protected]>; Thu, 02 Apr 2009 11:20:08 -0500
Return-Path: <[email protected]>
X-Verify-SMTP: Host 98.136.44.51 sending to us was not listening
Received: from [216.252.122.219] by n75.bullet.mail.sp1.yahoo.com with
NNFMP; 02 Apr 2009 16:20:01 -0000
Received: from [67.195.9.82] by t4.bullet.sp1.yahoo.com with NNFMP; 02
Apr 2009 16:20:01 -0000
Received: from [67.195.9.99] by t2.bullet.mail.gq1.yahoo.com with NNFMP;
02 Apr 2009 16:20:01 -0000
Received: from [127.0.0.1] by omp103.mail.gq1.yahoo.com with NNFMP; 02
Apr 2009 16:17:12 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 44567 invoked by uid 60001); 2 Apr 2009 16:20:00 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com;
s=s1024; t=1238689200; bh=M1iRI58S+srp7hpu7FAMws51QxqQbVu690T5W796I+0=;
h=Message-ID:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
b=waky9yi3V90lAJTHMjnF+zExYOfoI34+y4O6DeVV52DWMNi+hPiaiDaXqG5ijk6O0J1ozsjAbucNJYQYaSlKg3Pd9Lcgr2IY7DF2ePmM48pGZXanI7dkDi/QCqyfK6jbpLC8uEl7et8lLpU/4XG1hxLTJFJODQeHjI0pRiICyxs=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;

h=Message-ID:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;

b=FexPofG48Cj2ESAdN8EtVPAG8KkGkHlqnhk1u2LphyO0vCnIxYlp46o0DbXs36ykl4Jj1acdPN8D/RRd6Zbz1QKX8dK+svoSWM6g8k8zBgJM/wQ9Qmu4djERFMmYY6vJ2PfhunMn0/m2dxHXcyIcLTGWeE3IldzisRqj19N5sng=;
Message-ID: <[email protected]>

*Looky here!* :)

Received: from [41.210.5.68] by web110012.mail.gq1.yahoo.com via HTTP;
Thu, 02 Apr 2009 09:20:00 PDT

X-Mailer: YahooMailClassic/5.2.15 YahooMailWebService/0.7.289.1
Date: Thu, 2 Apr 2009 09:20:00 -0700 (PDT)
From: Joseph Brown <[email protected]>
Subject: Urgent
To: undisclosed recipients: ;
MIME-Version: 1.0
X-Originating-IP: 98.136.44.51
X-Rcpt-To: <[email protected]>

That's all probably going to turn ugly in everybody's news clients, but
a quick lookup of 41.210.5.68 (the server from whom Yahoo! got the
e-mail) turns out to be a server in Accra-North, Ghana - an unlikely
entry point for a message from a "customer" who claimed to be in Australia!

The "X-Originating-IP" may not actually be what you're after.

It takes a little getting used to, but the mystery fades quickly with
use. Since you're running Windows (I looked in /your/ headers to see
that), you can do a quick Google search on "win32whois" and find a place
from which you can download the lookup utility.

--
Morris Dovey
DeSoto Solar
DeSoto, Iowa USA
http://www.iedu.com/DeSoto/

MD

Morris Dovey

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 7:40 AM

Ed Pawlowski wrote:
> "HeyBub" <[email protected]> wrote in message
>> Easy to find out. Tell him up front that any purchase he makes will
>> require pre-payment via wire transfer to your bank.
>
> Yeah, they'd love to have your account number. Just ask for a small cash
> deposit to hold the good. They won't do that.

Not sure about your bank, but mine won't transfer funds to another
account without a signed request from me.

In spite of that, my SOP calls for the customer's bank to e-mail me
directly for the transfer-to account information. If the bank is using a
gmail return address...

--
Morris Dovey
DeSoto Solar
DeSoto, Iowa USA
http://www.iedu.com/DeSoto/

MD

Morris Dovey

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 9:10 AM

Casper wrote:

> You don't need to install anything on your computer. You can do a look
> up of various things from that website. Check it out for yourself.

Yuppers - there are a number of sites offering look-up via an http
(browser) interface. Generally, they've been a PIA for me because of
waits for ad servers, lousy response during high traffic, limited number
of queries allowed, ad-tracking cookies, etc.

I've come to prefer a direct access to a single-purpose server because I
do a lot of lookups, hate waiting, and hate even more needing to clean
out ad tracker cookies.

--
Morris Dovey
DeSoto Solar
DeSoto, Iowa USA
http://www.iedu.com/DeSoto/

GA

"Gary A in KC"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 4:55 PM

DEFINITELY a scam. If you want some really entertaining reading on these
email scams try this website: www.419eater.com.
I know someone who participates in these "scam baits" and it's truly
hysterical the lengths the scammers will go to in order to get at your
money. For the most part, they're not the sharpest tools in your shed.

Gary in KC


"sweet sawdust" <[email protected]> wrote in message
news:[email protected]...
> Just go the following e-mail. anybody want to bet on whether its a scam or
> not?
>
> Good day,
>
> We browsed through your web page and we are interested in ordering some of
> your products,we are located in Thailand,we will like to know if you have
> the items in stocks,so kindly get back to me with the right contact person
> email,phone # and confirmation of website so that we can place my order
> quickly, and i want to know if you have your own personal shipper or can
the
> order be picked up at your store,please advise so that we can proceed by
> going
> ahead to place the order.
>
> Regards
> Mark
>
>

ss

"sweet sawdust"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 3:50 PM


"Leon" <[email protected]> wrote in message
news:[email protected]...
>
> "sweet sawdust" <[email protected]> wrote in message
> news:[email protected]...
>> Just go the following e-mail. anybody want to bet on whether its a scam
>> or not?
>>
>> Good day,
>>
>> We browsed through your web page and we are interested in ordering some
>> of your products,we are located in Thailand,we will like to know if you
>> have the items in stocks,so kindly get back to me with the right contact
>> person email,phone # and confirmation of website so that we can place my
>> order quickly, and i want to know if you have your own personal shipper
>> or can the order be picked up at your store,please advise so that we can
>> proceed by going
>> ahead to place the order.
>>
>> Regards
>> Mark
>>
>>
>
> So far you have nothing to go on, they have requested nothing other than
> information.

Your right nothing at all, what I am doing is sorta profileing these people
from thier letter. I may be wrong and they may turn out to be the best
customers I have or ever will have. However If it looks like a snake I treat
it like a posinious variety until I know for sure.
>
>

ss

"sweet sawdust"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 1:11 PM


"David Nebenzahl" <[email protected]> wrote in message
news:[email protected]...
> On 5/21/2009 10:37 AM sweet sawdust spake thus:
>
>> Just go the following e-mail. anybody want to bet on whether its a scam
>> or not?
>>
>> Good day,
>>
>> We browsed through your web page and we are interested in ordering some
>> of your products,we are located in Thailand,we will like to know if you
>> have the items in stocks,so kindly get back to me with the right contact
>> person email,phone # and confirmation of website so that we can place my
>> order quickly, and i want to know if you have your own personal shipper
>> or can the order be picked up at your store,please advise so that we can
>> proceed by going
>> ahead to place the order.
>>
>> Regards
>> Mark
>
> I wouldn't rush to fulfill this order.
>
> No offense to the good people of Thailand, but if it looks like a scam,
> smells like a scam ...

You think I should spray it with fabreeze before going forward??
>
>
> --
> Found--the gene that causes belief in genetic determinism

LH

"Lew Hodgett"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 4:57 PM

"Ed Pawlowski" wrote:

> Yeah, they'd love to have your account number. Just ask for a small
> cash deposit to hold the good. They won't do that.

Easy solutions.

Open an account specifically for wire transfers with a "zip" balance
which gets closed out in 30 days.

Use PayPal.

Lew

Cc

"CW"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 11:10 PM


"mm" <[email protected]> wrote in message
news:[email protected]...
>
>> Whenever telemarketers call me, I string them along as long as is
>> possible.
> If we make telemarketing less productive/profitable maybe some of them
> would stop. Then again, maybe it doesn't make a damn bit of difference in
> the long run.....


http://www.youtube.com/watch?v=J5z4Vs26-TI

KN

Keith Nuttle

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 6:26 PM

Morris Dovey wrote:
> sweet sawdust wrote:
>
>> You think I should spray it with fabreeze before going forward??
>
> If you have a copy of "whois", do a lookup on every IP address in the
> headers. If you don't have it, post the headers here - it might be an
> interesting (and educational) exercise...
>
You can also trace the URL's in McAfee.

ss

"sweet sawdust"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 1:55 PM


"Morris Dovey" <[email protected]> wrote in message
news:[email protected]...
> sweet sawdust wrote:
>
>> You think I should spray it with fabreeze before going forward??
>
> If you have a copy of "whois", do a lookup on every IP address in the
> headers. If you don't have it, post the headers here - it might be an
> interesting (and educational) exercise...
>
> --
> Morris Dovey
> DeSoto Solar
> DeSoto, Iowa USA
> http://www.iedu.com/DeSoto/

OK since I am not sure how to do what you ask here are headers etc. They
look a little wierd to me, but I don't know enough about them to know.

Received: from horizon.host-care.com ([66.7.205.91])
by isp.att.net (frfwmxc08) with ESMTP
id <20090521160710M0800bqnide>; Thu, 21 May 2009 16:07:10 +0000
X-Originating-IP: [66.7.205.91]
Received: from nobody by horizon.host-care.com with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1M7AnX-0004nV-Ag
for [email protected]; Thu, 21 May 2009 12:07:11 -0400

ss

"sweet sawdust"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 2:19 PM


>>
>> As much as it smells like a scam, I would probably be tempted to follow
>> up on it. Ask 'em what they want, and how they intend to pay. If they
>> want to pick it up in person, well...
>
> That's true. No harm in asking.
>
>
> --
> Found--the gene that causes belief in genetic determinism

I treat each and everyone of these like the real thing. I don't send
anything until the money has cleared the local bank and the issuing bank.
However much you send over the amount of the invoice I keep as a tip, that
is done upfront. I don't add laptops to the orders either.

EP

"Ed Pawlowski"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 9:15 AM


"sweet sawdust" <[email protected]> wrote in message
news:[email protected]...
>
> "Ed Pawlowski" <[email protected]> wrote in message
> news:[email protected]...
>>
>> "HeyBub" <[email protected]> wrote in message
>>>
>>> Easy to find out. Tell him up front that any purchase he makes will
>>> require pre-payment via wire transfer to your bank.
>>>
>>
>> Yeah, they'd love to have your account number. Just ask for a small cash
>> deposit to hold the good. They won't do that.
>
> I did ask for payment in advance of shipping and all shipping to be paid
> by the buyer. Will let you know how it turns out, if anything happens.

Chances are they are going to send you a counterfeit or stolen check or
money order that will bounce. You can be sure it is a SCAM.

Hh

"HeyBub"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 7:02 AM

sweet sawdust wrote:
> Just go the following e-mail. anybody want to bet on whether its a
> scam or not?
>
> Good day,
>
> We browsed through your web page and we are interested in ordering
> some of your products,we are located in Thailand,we will like to know
> if you have the items in stocks,so kindly get back to me with the
> right contact person email,phone # and confirmation of website so
> that we can place my order quickly, and i want to know if you have
> your own personal shipper or can the order be picked up at your
> store,please advise so that we can proceed by going
> ahead to place the order.
>

Easy to find out. Tell him up front that any purchase he makes will require
pre-payment via wire transfer to your bank.

TV

Tom Veatch

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 2:34 PM

On Fri, 22 May 2009 08:09:14 -0400, "Ed Pawlowski" <[email protected]>
wrote:

>Yeah, they'd love to have your account number. Just ask for a small cash
>deposit to hold the good. They won't do that.

Several years ago, I was a new customer to a mill in KY. They required
a wire transfer as payment prior to shipping my first purchase of a
load of Appalacian hardwoods. That is my only experience with wire
transfers but I do not recall their account number being revealed to
me as part of the transaction. If memory serves, the transfer was from
my bank to some bank in Kentucky "For Benefit Of" the recipient. The
final destination account number was and is unknown to me.

A bank to bank wire transfer should be perfectly safe and secure for
both parties involved. If anyone has contradictory information, please
post it.

Tom Veatch
Wichita, KS
USA

LH

"Lew Hodgett"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

23/05/2009 7:36 AM

"CW" wrote:

> http://www.youtube.com/watch?v=J5z4Vs26-TI


Got to love it.

Lew

CS

Charlie Self

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 2:43 AM

On May 21, 2:12=A0pm, "sweet sawdust" <[email protected]>
wrote:
> "SonomaProducts.com" <[email protected]> wrote in message
>
> news:[email protected]...
> I would be that next thing is they will want to send a check, it will
> be for more than the amount but they will ask you to send them back
> the difference. Your bank will gladly take the check and a week or two
> later tell you it is no good.
>
> Aw no one would fall for that old chestnut, would they?
>
> On May 21, 10:37 am, "sweet sawdust" <[email protected]>
> wrote:
>
> > Just go the following e-mail. anybody want to bet on whether its a scam=
or
> > not?
>
> > Good day,
>
> > We browsed through your web page and we are interested in ordering some=
of
> > your products,we are located in Thailand,we will like to know if you ha=
ve
> > the items in stocks,so kindly get back to me with the right contact per=
son
> > email,phone # and confirmation of website so that we can place my order
> > quickly, and i want to know if you have your own personal shipper or ca=
n
> > the
> > order be picked up at your store,please advise so that we can proceed b=
y
> > going
> > ahead to place the order.
>
> > Regards
> > Mark

Somebody may. It's still popular. I got one on Craigslist about a tool
I was selling, local pick up only. This woman, who spelled her name
differently in two emails, wanted to buy te tool "right away," please
answer with photos and reason for selling. The ad had two photos in
it, and my reason for selling comes under the heading of MYOFB. I let
her know it was still for sale. Next, two days later--remember "right
away"--I get an email wanting to send a check, have her shipper, etc.
SOSDD. Sunday morning, I was at a friend's house to check on his
pregnant bulldog and her progress, and we looked at this email from an
ebay listing. Guess who showed up, same name first time, exact same
wording, same second reply, same name misspelling.

ss

"sweet sawdust"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 1:12 PM


"SonomaProducts.com" <[email protected]> wrote in message
news:[email protected]...
I would be that next thing is they will want to send a check, it will
be for more than the amount but they will ask you to send them back
the difference. Your bank will gladly take the check and a week or two
later tell you it is no good.

Aw no one would fall for that old chestnut, would they?

On May 21, 10:37 am, "sweet sawdust" <[email protected]>
wrote:
> Just go the following e-mail. anybody want to bet on whether its a scam or
> not?
>
> Good day,
>
> We browsed through your web page and we are interested in ordering some of
> your products,we are located in Thailand,we will like to know if you have
> the items in stocks,so kindly get back to me with the right contact person
> email,phone # and confirmation of website so that we can place my order
> quickly, and i want to know if you have your own personal shipper or can
> the
> order be picked up at your store,please advise so that we can proceed by
> going
> ahead to place the order.
>
> Regards
> Mark

Cc

Casper

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 9:02 AM

Morris Dovey <[email protected]> was heard to mutter:

>sweet sawdust wrote:
>> "Morris Dovey" <[email protected]> wrote in message
>> news:[email protected]...
>>> sweet sawdust wrote:
>>>
>>>> You think I should spray it with fabreeze before going forward??
>>> If you have a copy of "whois", do a lookup on every IP address in the
>>> headers. If you don't have it, post the headers here - it might be an
>>> interesting (and educational) exercise...
>>>
>>> --
>>> Morris Dovey
>>> DeSoto Solar
>>> DeSoto, Iowa USA
>>> http://www.iedu.com/DeSoto/
>>
>> OK since I am not sure how to do what you ask here are headers etc. They
>> look a little wierd to me, but I don't know enough about them to know.
>>
>> Received: from horizon.host-care.com ([66.7.205.91])
>> by isp.att.net (frfwmxc08) with ESMTP
>> id <20090521160710M0800bqnide>; Thu, 21 May 2009 16:07:10 +0000
>> X-Originating-IP: [66.7.205.91]
>> Received: from nobody by horizon.host-care.com with local (Exim 4.69)
>> (envelope-from <[email protected]>)
>> id 1M7AnX-0004nV-Ag
>> for [email protected]; Thu, 21 May 2009 12:07:11 -0400
>
>With Thunderbird I choose "View" then "Message Source" and get a window
>displaying all the text of a received e-mail. The headers are all the
>lines before the message itself. For example:
>
>X-Account-Key: account2
>X-UIDL: 6205
>X-Mozilla-Status: 0003
>X-Mozilla-Status2: 00000000
>X-Mozilla-Keys:
>
>Received-SPF: none (No spf1 record for (yahoo.com) )
>client-ip=98.136.44.51; envelope-from=<[email protected]>;
>x-ip-name=n75.bullet.mail.sp1.yahoo_com;
>X-Default-Received-SPF: pass (Last token {ptr:%{d2}} (res=PASS))
>client-ip=98.136.44.51; envelope-from=<[email protected]>;
>x-ip-name=n75.bullet.mail.sp1.yahoo_com;
>Received: from n75.bullet.mail.sp1.yahoo.com (unverified [98.136.44.51])
> by surge.jtmweb.com (SurgeMail 3.9e) with ESMTP id 36445513-1776515
> for <[email protected]>; Thu, 02 Apr 2009 11:20:08 -0500
>Return-Path: <[email protected]>
>X-Verify-SMTP: Host 98.136.44.51 sending to us was not listening
>Received: from [216.252.122.219] by n75.bullet.mail.sp1.yahoo.com with
>NNFMP; 02 Apr 2009 16:20:01 -0000
>Received: from [67.195.9.82] by t4.bullet.sp1.yahoo.com with NNFMP; 02
>Apr 2009 16:20:01 -0000
>Received: from [67.195.9.99] by t2.bullet.mail.gq1.yahoo.com with NNFMP;
>02 Apr 2009 16:20:01 -0000
>Received: from [127.0.0.1] by omp103.mail.gq1.yahoo.com with NNFMP; 02
>Apr 2009 16:17:12 -0000
>X-Yahoo-Newman-Property: ymail-3
>X-Yahoo-Newman-Id: [email protected]
>Received: (qmail 44567 invoked by uid 60001); 2 Apr 2009 16:20:00 -0000
>DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com;
>s=s1024; t=1238689200; bh=M1iRI58S+srp7hpu7FAMws51QxqQbVu690T5W796I+0=;
>h=Message-ID:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
>b=waky9yi3V90lAJTHMjnF+zExYOfoI34+y4O6DeVV52DWMNi+hPiaiDaXqG5ijk6O0J1ozsjAbucNJYQYaSlKg3Pd9Lcgr2IY7DF2ePmM48pGZXanI7dkDi/QCqyfK6jbpLC8uEl7et8lLpU/4XG1hxLTJFJODQeHjI0pRiICyxs=
>DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
> s=s1024; d=yahoo.com;
>
>h=Message-ID:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
>
>b=FexPofG48Cj2ESAdN8EtVPAG8KkGkHlqnhk1u2LphyO0vCnIxYlp46o0DbXs36ykl4Jj1acdPN8D/RRd6Zbz1QKX8dK+svoSWM6g8k8zBgJM/wQ9Qmu4djERFMmYY6vJ2PfhunMn0/m2dxHXcyIcLTGWeE3IldzisRqj19N5sng=;
>Message-ID: <[email protected]>
>
>*Looky here!* :)
>
>Received: from [41.210.5.68] by web110012.mail.gq1.yahoo.com via HTTP;
>Thu, 02 Apr 2009 09:20:00 PDT
>
>X-Mailer: YahooMailClassic/5.2.15 YahooMailWebService/0.7.289.1
>Date: Thu, 2 Apr 2009 09:20:00 -0700 (PDT)
>From: Joseph Brown <[email protected]>
>Subject: Urgent
>To: undisclosed recipients: ;
>MIME-Version: 1.0
>X-Originating-IP: 98.136.44.51
>X-Rcpt-To: <[email protected]>
>
>That's all probably going to turn ugly in everybody's news clients, but
>a quick lookup of 41.210.5.68 (the server from whom Yahoo! got the
>e-mail) turns out to be a server in Accra-North, Ghana - an unlikely
>entry point for a message from a "customer" who claimed to be in Australia!
>
>The "X-Originating-IP" may not actually be what you're after.
>
>It takes a little getting used to, but the mystery fades quickly with
>use. Since you're running Windows (I looked in /your/ headers to see
>that), you can do a quick Google search on "win32whois" and find a place
>from which you can download the lookup utility.


From the above message, try going to
http://whatismyip.com/tools/ip-whois-lookup.asp
and typing in the IP address you want to look up. In this case I would
lookup 98.136.4.51 which is the first IP in the sequence.

You don't need to install anything on your computer. You can do a look
up of various things from that website. Check it out for yourself.
`Casper

Sb

"SonomaProducts.com"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 11:07 AM

I would be that next thing is they will want to send a check, it will
be for more than the amount but they will ask you to send them back
the difference. Your bank will gladly take the check and a week or two
later tell you it is no good.

On May 21, 10:37=A0am, "sweet sawdust" <[email protected]>
wrote:
> Just go the following e-mail. anybody want to bet on whether its a scam o=
r
> not?
>
> Good day,
>
> We browsed through your web page and we are interested in ordering some o=
f
> your products,we are located in Thailand,we will like to know if you have
> the items in stocks,so kindly get back to me with the right contact perso=
n
> email,phone # and confirmation of website so that we can place my order
> quickly, and i want to know if you have your own personal shipper or can =
the
> order be picked up at your store,please advise so that we can proceed by
> going
> ahead to place the order.
>
> Regards
> Mark

CB

"Colin B."

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 6:54 PM

sweet sawdust <[email protected]> wrote:
> Just go the following e-mail. anybody want to bet on whether its a scam or
> not?
>
> Good day,
>
> We browsed through your web page and we are interested in ordering some of
> your products,we are located in Thailand,we will like to know if you have
> the items in stocks,so kindly get back to me with the right contact person
> email,phone # and confirmation of website so that we can place my order
> quickly, and i want to know if you have your own personal shipper or can the
> order be picked up at your store,please advise so that we can proceed by
> going
> ahead to place the order.

As much as it smells like a scam, I would probably be tempted to follow
up on it. Ask 'em what they want, and how they intend to pay. If they
want to pick it up in person, well...

Colin

mm

"mm"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 6:27 PM


"sweet sawdust" <[email protected]> wrote in message
news:[email protected]...
> Just go the following e-mail. anybody want to bet on whether its a scam or
> not?
>
> Good day,
>
> We browsed through your web page and we are interested in ordering some of
> your products,we are located in Thailand,we will like to know if you have
> the items in stocks,so kindly get back to me with the right contact person
> email,phone # and confirmation of website so that we can place my order
> quickly, and i want to know if you have your own personal shipper or can
> the order be picked up at your store,please advise so that we can proceed
> by going
> ahead to place the order.
>
> Regards
> Mark
>
>
Scam or not, I just wonder if we wasted as much spammers time as is possible
by stringing them along with long replies, would it make a difference?
Whenever telemarketers call me, I string them along as long as is possible.
If we make telemarketing less productive/profitable maybe some of them would
stop. Then again, maybe it doesn't make a damn bit of difference in the long
run.....

Lr

"Leon"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

21/05/2009 3:13 PM


"sweet sawdust" <[email protected]> wrote in message
news:[email protected]...
> Just go the following e-mail. anybody want to bet on whether its a scam or
> not?
>
> Good day,
>
> We browsed through your web page and we are interested in ordering some of
> your products,we are located in Thailand,we will like to know if you have
> the items in stocks,so kindly get back to me with the right contact person
> email,phone # and confirmation of website so that we can place my order
> quickly, and i want to know if you have your own personal shipper or can
> the order be picked up at your store,please advise so that we can proceed
> by going
> ahead to place the order.
>
> Regards
> Mark
>
>

So far you have nothing to go on, they have requested nothing other than
information.

Cc

Casper

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 8:51 AM

>If you have a copy of "whois", do a lookup on every IP address in the
>headers. If you don't have it, post the headers here - it might be an
>interesting (and educational) exercise...
>Morris Dovey

Don't need to have a copy.
You can do that right off the web.
http://whatismyip.com/
`Casper

EP

"Ed Pawlowski"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 8:09 AM


"HeyBub" <[email protected]> wrote in message
>
> Easy to find out. Tell him up front that any purchase he makes will
> require pre-payment via wire transfer to your bank.
>

Yeah, they'd love to have your account number. Just ask for a small cash
deposit to hold the good. They won't do that.

ss

"sweet sawdust"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 7:44 AM


"Ed Pawlowski" <[email protected]> wrote in message
news:[email protected]...
>
> "HeyBub" <[email protected]> wrote in message
>>
>> Easy to find out. Tell him up front that any purchase he makes will
>> require pre-payment via wire transfer to your bank.
>>
>
> Yeah, they'd love to have your account number. Just ask for a small cash
> deposit to hold the good. They won't do that.

I did ask for payment in advance of shipping and all shipping to be paid by
the buyer. Will let you know how it turns out, if anything happens.
>
>

Cc

Casper

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

23/05/2009 8:00 AM

>Yuppers - there are a number of sites offering look-up via an http
>(browser) interface. Generally, they've been a PIA for me because of
>waits for ad servers, lousy response during high traffic, limited number
>of queries allowed, ad-tracking cookies, etc.

Sorry to hear. I've never had to wait for anything on whatismyip.com.

>I've come to prefer a direct access to a single-purpose server because I
>do a lot of lookups, hate waiting, and hate even more needing to clean
>out ad tracker cookies.
>Morris Dovey

I understand. I deal everyday with people who get "click" happy and
have no idea what they just allowed to their computer. Better to air
on the side of caution than to inadvertently allow things access.

I spend most of my time assessing internal and external networking
holes, threats, viruses and other security risks. Sometimes it is not
possible, or even prudent, to install anything on a client's computer.
On these occasions, trusted web tools are very valuable.

I merely wanted to point out for sweet sawdust, that for use a couple
of times, it's better to not install unused or rarely used software
and add potential for other system problems. Less is best theorem.

`Casper

Welcome to USEnet. Please adjust your reality.

ss

"sweet sawdust"

in reply to "sweet sawdust" on 21/05/2009 12:37 PM

22/05/2009 9:53 AM


"Ed Pawlowski" <[email protected]> wrote in message
news:[email protected]...
>
> "sweet sawdust" <[email protected]> wrote in message
> news:[email protected]...
>>
>> "Ed Pawlowski" <[email protected]> wrote in message
>> news:[email protected]...
>>>
>>> "HeyBub" <[email protected]> wrote in message
>>>>
>>>> Easy to find out. Tell him up front that any purchase he makes will
>>>> require pre-payment via wire transfer to your bank.
>>>>
>>>
>>> Yeah, they'd love to have your account number. Just ask for a small cash
>>> deposit to hold the good. They won't do that.
>>
>> I did ask for payment in advance of shipping and all shipping to be paid
>> by the buyer. Will let you know how it turns out, if anything happens.
>
> Chances are they are going to send you a counterfeit or stolen check or
> money order that will bounce. You can be sure it is a SCAM.
>

I am sure it is a scam, but!! I have gotten several bogus checks and a
couple of stolen credit cards in the past. My favorite was one for an item
for sale on Craig's list.
Two bogus checks with appropriate e-mails to go with them and one check for
3900 dollars with no information on what to do with it or why it was sent to
me, all overnighted and of course all sent on stolen credit cards


You’ve reached the end of replies