fishy email A list of recent Pet Care specific online scams received through email by PUPS members.
Moderators: Forum Member, Forum Member, Forum Member, Forum Member, Forum Member

2 posts   •   Page 1 of 1
Forum Member
Enlightened Master
Enlightened Master
Posts: 1976
Joined: Wed May 23, 2007 9:58 pm
Location: Camarillo ,California

fishy email

by Forum Member » Mon Feb 28, 2011 5:59 pm

I got this email does not look right> does anybody know how to tell wher it came from?

User avatar
Forum Member
Site Admin
Site Admin
Posts: 5163
Joined: Wed Dec 31, 1969 7:00 pm
Location: Dousman, WI

by Forum Member » Tue Mar 01, 2011 2:14 pm

It's not the easiest process to learn. First you have to look at the message headers for the IP address. I think you want to use the very last one listed in the headers. Then take that to an ip lookup site. This site will let you do a couple of queries: http://www.ip2location.com/free.asp

Example: Here are some headers. This message comes from Senegal.

Return-Path: ----
Received: (qmail 31097 invoked by uid 502); 27 Feb 2011 17:30:59 -0000
Received: from nm11-vm1.bullet.mail.ne1.yahoo.com (98.138.91.40)
by 216.35.207.188 with SMTP; 27 Feb 2011 17:30:59 -0000
Received: from [98.138.90.50] by nm11.bullet.mail.ne1.yahoo.com with NNFMP; 27 Feb 2011 17:30:58 -0000
Received: from [98.138.87.6] by tm3.bullet.mail.ne1.yahoo.com with NNFMP; 27 Feb 2011 17:30:58 -0000
Received: from [127.0.0.1] by omp1006.mail.ne1.yahoo.com with NNFMP; 27 Feb 2011 17:30:58 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 704687.14917.bm@omp1006.mail.ne1.yahoo.com
Received: (qmail 72891 invoked by uid 60001); 27 Feb 2011 17:30:58 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1298827858; bh=255Gura9Z0M89o5CWysoh5KskC1gPpha6JHSWEC0E4g=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=G6w2B2eV3y4W89khY5x+SkHRRYYXRqB1ABJGbndRsrcvlBxOibpsCCTYfH3Rs3RYpyUs9PImBfdu6AAmq27mR5ddVnp/+6iuGhOoFVKvM/RID38Avz++ezJP5vNDE1po8at1cGjJu3S2BQ+qn1Mn1WYbMVtqkYhLUaNbqj473i8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=xT/+T2VTTZtBTpcKQq3oyni7tfdlMF8cU+RaqxQVBr6p1shNhzCpcFdsUY4KiQFKXSx+zyarwnqFcAKndGBLKlMfyUVq4dduJ47bXafO3uqOjtjKRtBuje6fJ9K8U5pgOV4+7/QPqS6KdBPdy4VTcE1KERjy+nfC5pSsrE5lbTA=;
Message-ID: <405664>
X-YMail-OSG: tYKr5ckVM1m5LGTsDocUp_yliCpNeucRbmzxzWfooQYGTlE
Hgj139T7f2yl2MNXU.O9jAgaaGzNOUz9DmGqQBMyPfKfZKfOsTQsUNtzJ5c0
vkJtbV30mSi4VrYPxZl.WU1MVMfAnTUwRZNbC5lkL8YjHYWESrFksPSwKqF7
L2TBuhHb0zHc8OBY2Od1YvEL_tDBwjQ8FG91Cd8nh.M9kzxmYvwDS4egcSt7
PXXSNFw.18aYqANr9Q7rHwh4mqXMth9G2vUDfIQxwgFsgrVtjWIYhhRYCVPY
mPRWs8wNT_6fIdymGUfYO6FYNZ5TNTeiB3e7Kf7TyiKuVCcT7aEq4c3g.woW
LkvJuF5CtnHDjPBNNOtx9QQJ1kxw78TCKuUWwYdJyurNeWNIAAf7WbAoz5Jj
.zVzQJtCtGJROcgZ4WFHkpCTRogQqQiLfmww9FnvEP0WiF2gy6VnzODBEqXr
WPb4vXUVE75S1iyZGZBRQtGQYZg34jeIb5L_zw5ghcXVi8mckYpObj1RKmlB
_43002uK7N7mC1pou9PrtSvBqN0OYZ5TR5dROdA84LZh.94sx9xq0n9K0tXZ
VaVUz1bXMWl.t1J7Ma2ADSM_yiNYC7KhGD7Ax8OTqdLGvjE3l5W7b0p8kYKV
501EM4dgQ5XPcYPxq2TqmJWVJSYck9Z98iIy_N.8monUbNgfDvn7250uXWhs
nI6ssbx4Nk2nYI4nsH7sC3CSs6TIQsfQv9e7_fyEvs7GAKwtIim1Mk27SzEj
K4wnsWyJPv0gZG_LZ5_R3g_AKXH4NRWtuETeSr_MBN7hd7FNr3y1UQ1khITs
UGmxEEna0QdLnn72sXME5YYJa9yiXtyRfWpNktRIujTBExneY5x0qsWJGm2D
Tc3Vm_rWETAAZnl2EOAi28490Cz0nTDzyHHml67OxRi_GAq205JWi5zi3Oy_
bm8gvIwdYbpjgSlJTCpXEWYjXalsBUDhz6jRvl_uUPD76LR1hds.PxQpxMM7
AcJez6.J7x9rjA0YWrlRFsRoTyLoIwFrswmSRuLURnpq5Gcqzcq3OoACtL9r
1ZvhP0fsSmUD.dzhpbMdMl0InFJY1YlhcHfelvX8NRxc9N._DfqHCijYZKqD
KmVUCbIv4kHOxDLkK_YEa3i4DH41Ba3v5ySkVQmTrXo2CrdNmfKBhkc_R_49
Lgs5x.JNexR3HV7sswNxdkg9nnaOMsDm1OkcFi8cRfZPO9q8yvvbni43vQOP
CZUdoOC1cDQ19U6y25FEkoVp.rO5YIh1KheL3eTmRjuS57gD5X0pfIUBLvf3
.NOOkVfHg4G6UJnQp8O5phzOhh8WlgPUcM6DnKqxJ.u6.fwUe6F4qMo5IDp2
1u1o7ZD3RtnGhFH9ezD0DNRbDNGqypRHPeLXdsTZQqP9Eqfupc7JSLoYNeTj
aBpbWRz6hNUocNyzD2KSFVRUUMrL5NL.LBug.8iE_oUguoepEywLQq.vQuzb
XsuzCcvgaFl07qOzHRx3AZymI6JZRKtdg49o3EaLlf06BjPEa.wAA2ZXQIUr
cBQ.GM4VDohC1ZvDF__oSHT.vVXq.eNuNden_1_c7dntD1wPxayb2yu5rykT
2kBPAY3PRFTNjOzmioI9kWcgUxbqftSgNnSSUAatchekeWheDku48wa99zf4
KiwjFKq2j_AIjD93CjIlX79NCoVCGXSSVvES3jn_9QIUV_9RfL3BK5at7ZtM
ZTI.nFlLgjPd85sJawDqZsMnt_Ju.KljzOjO6DeD2Gs4PzKjTA6.KDuqW1Qk
O31aDse7na0PQvIt3_aUiETg4ZraHrySPR4OAGkKhHqPj4pKjYY30G3WXXZa
ZsToT310e7Q2AOFAJEwLSTw2I_yqdB0xelQ8.JABFxLqT4_Plg2pFR5mXtJq
8QTkjlQ2QmTjJb29kKi4Ed4Fmh9d0Gl2x_NJdyDImtrX3_WuhIR_E6E0h90H
YTlVSszoO1gCE6aGN76E2hhJJBn3HiaXaTZRL5uHax.0pJHJPmWr_7tQHM_C
m9H6ne9XbJ2HIogR63sXrt_l4OKfPyy.7br9PB89E3Kz2wQ--
Received: from [41.214.32.158] by web181212.mail.ne1.yahoo.com via HTTP; Sun, 27 Feb 2011 09:30:58 PST
X-Mailer: YahooMailClassic/11.4.20 YahooMailWebService/0.8.109.292656
Date: Sun, 27 Feb 2011 09:30:58 -0800 (PST)
From: jane mark <ppppjane>
Reply-To: jane_mark1@yahoo.in
Subject: Hello Dear Friend,
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="0-1340348575-1298827858=:64403"
X-Antivirus: AVG for E-mail 10.0.1204 [1435/3475]
X-AVG-ID: IDC63DEE2-7B2FC42B



Lookup shows this message originated in
KAOLACK DAKAR SONATEL SOCIETE NATIONALE DES TELECOMMUNICATIONS DU SENEGAL

2 posts   •   Page 1 of 1

Who is online

Users browsing this forum: Forum Member and 15 guests

It is currently Thu Oct 18, 2018 9:28 pm