fyi another scammer
Posted: Fri May 14, 2010 1:13 am
Here is a reply I received from an ad on QTH .
The person responding , stole the identity of a ham in the UK,
I sent an Email to the ham in the UK and his response is at the bottom
Be Careful TRADING!
Rob N8RT
Scammers EMAILto me:
Hello,
I'm Cris Ellison from UK I was searching for who want's to buy the
item above so I came across your post on sites that you want to
buying. I have it and it is still in perfect condition. I accept
Western union, Paypal and bank transfer if you are still interested on
the item, I will need your urgent reply.
I hope to hear from you soon.
Regards,
Ellison G8RBW
(Note if you look a the Full Headers of this Email you can see the Scammers original email address )
X-Apparently-To: mcyman@yahoo.com via 209.191.85.75; Wed, 12 May 2010 09:03:04 -0700
Return-Path: <crisg8rbw>
X-YahooFilteredBulk: 209.85.221.194
X-YMailISG: XZIoeBIWLDuHNpaiagenWbgQjZCZ2D0WRp.kkJ2yHjVkT79RQPP6ZlWG.qUZxHPha_mHgF.wq2d8aRTRn8i6XMLVueitHQFvPuXle1dFReGYTp9xmUgXlnDqeORSO4FiMnQ0lopLlHMujKe5nIS2nerB_zVIhoXlBgf2RXwGY9EtD_bEMXYoxzbkiI.mR6DtPpNKFODSKwY2bCHW.G3MxqtyjLkAMV7udFP4jHJJYrfRWHKW1yZaJzw7Bkewwe4XtmVXCAnqocHUpPruNbTpKWkr67TlmzASk0D6fMn7VdWBHaF.BIsxphWZcWUQDOGHFZmlqWNrlD4zsIr7ojIw55M6b_rsxHGrD4MpvvYztukteCwDU0slwhzHBa2ltRBUU.wGjQREa3_PgtoDItO17ix4yuzustBnuJd.noZY6.fuxrtS1hE-
X-Originating-IP: [209.85.221.194]
Authentication-Results: mta1066.mail.mud.yahoo.com from=gmail.com; domainkeys=pass (ok); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-qy0-f194.google.com) (209.85.221.194) by mta1066.mail.mud.yahoo.com with SMTP; Wed, 12 May 2010 09:03:04 -0700
Received: by mail-qy0-f194.google.com with SMTP id 32so84484qyk.0 for <mcyman>; Wed, 12 May 2010 09:03:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:receivedmessage-id :subject:from:content-type; bh=fZY5VzsfFRfszb6uJ088zcDjlBGVKsG0Au6tnPvWsek=; b=KESg9QlMGaxC3MrEKWdAJLa8VENUxpCl3iViWKFNUyTKaL1qncuF46a2ikkA29usZD 2RoqFtoeD8R/qZCDJCQw3vLXF0QjhaE3zRc+b+wEUZSkMC+noH8/3e9JZZcEui3FKfje SOiogxjObd9l7P8uyA8IyBsttDUU1gj2v0MoY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-versionmessage-id:subject:from:content-type; b=L+PKiYL1jy1LhQgCDX2mb3Aplwo2p32CoCmX+oSX5KM9VSSqnGVxEcp84ibJySjg/g NFUKiL/WqXYIlqeR1TyhelyvASgVi4Mqh9BLiQ9cReGLAXTzrxFGiHQsK2iyfvg0BNMX NEcMUgFfZegEFgppUBl6nEXmjGsRN+bBTw6E0=
MIME-Version: 1.0
Received: by 10.224.71.130 with SMTP id h2mr5219970qaj.90.1273680183179; Wed, 12 May 2010 09:03:03 -0700 (PDT)
Received: by 10.229.183.144 with HTTP; Wed, 12 May 2010 09:03:02 -0700 (PDT)
Date: Wed, 12 May 2010 09:03:02 -0700
Message-ID: <AANLkTimT421HwaQ2Lde5aGa2R6A4N6AxoxqOl1GZHtCE>
Subject: Want to Buy 40 Meter ARC 5 Rcvr/transmit
From: This sender is DomainKeys verified
CRIS ELLISON <crisg8rbw>
Add sender to Contacts
Content-Type: text/plain; charset=ISO-8859-1
Content-Length: 373
END EMAIL Header
Here is the response form the Real G8RBW Ellison
Flag this message
Re: Want to Buy 40 Meter ARC 5 Rcvr/transmit
Wednesday, May 12, 2010 2:37 PM
From:
This sender is DomainKeys verified
"Chris Ellison" <halchemy>
Add sender to Contacts
To:
"Rob @ Peg Pohorence" <mcyman>
Hello Rob
It's a fraud.
Looks like it is by someone who does not speak english as their first language.
It would be unusual to use Western Union in the UK.
I would guess African, maybe Nigerian, but I really don't know
Regards
Chris G8RBW (note the 'h' in Chris)
chris@halchemy.com
http://www.halchemy.com
29 Ashton Road
Clay Cross
Derbyshire S45 9FA
Phone:01246 250 647
Mobile: 07967 584 409
Chris Ellison Tour Leader <chris>
On behalf of
CTC Cycling Holidays & Tours Ltd
Registered in England and Wales no. 4106179
Registered office: Parklands, Railton Road, Guildford, Surrey GU2 9JX
ATOL 5613 ABTOT 5102
The person responding , stole the identity of a ham in the UK,
I sent an Email to the ham in the UK and his response is at the bottom
Be Careful TRADING!
Rob N8RT
Scammers EMAILto me:
Hello,
I'm Cris Ellison from UK I was searching for who want's to buy the
item above so I came across your post on sites that you want to
buying. I have it and it is still in perfect condition. I accept
Western union, Paypal and bank transfer if you are still interested on
the item, I will need your urgent reply.
I hope to hear from you soon.
Regards,
Ellison G8RBW
(Note if you look a the Full Headers of this Email you can see the Scammers original email address )
X-Apparently-To: mcyman@yahoo.com via 209.191.85.75; Wed, 12 May 2010 09:03:04 -0700
Return-Path: <crisg8rbw>
X-YahooFilteredBulk: 209.85.221.194
X-YMailISG: XZIoeBIWLDuHNpaiagenWbgQjZCZ2D0WRp.kkJ2yHjVkT79RQPP6ZlWG.qUZxHPha_mHgF.wq2d8aRTRn8i6XMLVueitHQFvPuXle1dFReGYTp9xmUgXlnDqeORSO4FiMnQ0lopLlHMujKe5nIS2nerB_zVIhoXlBgf2RXwGY9EtD_bEMXYoxzbkiI.mR6DtPpNKFODSKwY2bCHW.G3MxqtyjLkAMV7udFP4jHJJYrfRWHKW1yZaJzw7Bkewwe4XtmVXCAnqocHUpPruNbTpKWkr67TlmzASk0D6fMn7VdWBHaF.BIsxphWZcWUQDOGHFZmlqWNrlD4zsIr7ojIw55M6b_rsxHGrD4MpvvYztukteCwDU0slwhzHBa2ltRBUU.wGjQREa3_PgtoDItO17ix4yuzustBnuJd.noZY6.fuxrtS1hE-
X-Originating-IP: [209.85.221.194]
Authentication-Results: mta1066.mail.mud.yahoo.com from=gmail.com; domainkeys=pass (ok); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-qy0-f194.google.com) (209.85.221.194) by mta1066.mail.mud.yahoo.com with SMTP; Wed, 12 May 2010 09:03:04 -0700
Received: by mail-qy0-f194.google.com with SMTP id 32so84484qyk.0 for <mcyman>; Wed, 12 May 2010 09:03:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:receivedmessage-id :subject:from:content-type; bh=fZY5VzsfFRfszb6uJ088zcDjlBGVKsG0Au6tnPvWsek=; b=KESg9QlMGaxC3MrEKWdAJLa8VENUxpCl3iViWKFNUyTKaL1qncuF46a2ikkA29usZD 2RoqFtoeD8R/qZCDJCQw3vLXF0QjhaE3zRc+b+wEUZSkMC+noH8/3e9JZZcEui3FKfje SOiogxjObd9l7P8uyA8IyBsttDUU1gj2v0MoY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-versionmessage-id:subject:from:content-type; b=L+PKiYL1jy1LhQgCDX2mb3Aplwo2p32CoCmX+oSX5KM9VSSqnGVxEcp84ibJySjg/g NFUKiL/WqXYIlqeR1TyhelyvASgVi4Mqh9BLiQ9cReGLAXTzrxFGiHQsK2iyfvg0BNMX NEcMUgFfZegEFgppUBl6nEXmjGsRN+bBTw6E0=
MIME-Version: 1.0
Received: by 10.224.71.130 with SMTP id h2mr5219970qaj.90.1273680183179; Wed, 12 May 2010 09:03:03 -0700 (PDT)
Received: by 10.229.183.144 with HTTP; Wed, 12 May 2010 09:03:02 -0700 (PDT)
Date: Wed, 12 May 2010 09:03:02 -0700
Message-ID: <AANLkTimT421HwaQ2Lde5aGa2R6A4N6AxoxqOl1GZHtCE>
Subject: Want to Buy 40 Meter ARC 5 Rcvr/transmit
From: This sender is DomainKeys verified
CRIS ELLISON <crisg8rbw>
Add sender to Contacts
Content-Type: text/plain; charset=ISO-8859-1
Content-Length: 373
END EMAIL Header
Here is the response form the Real G8RBW Ellison
Flag this message
Re: Want to Buy 40 Meter ARC 5 Rcvr/transmit
Wednesday, May 12, 2010 2:37 PM
From:
This sender is DomainKeys verified
"Chris Ellison" <halchemy>
Add sender to Contacts
To:
"Rob @ Peg Pohorence" <mcyman>
Hello Rob
It's a fraud.
Looks like it is by someone who does not speak english as their first language.
It would be unusual to use Western Union in the UK.
I would guess African, maybe Nigerian, but I really don't know
Regards
Chris G8RBW (note the 'h' in Chris)
chris@halchemy.com
http://www.halchemy.com
29 Ashton Road
Clay Cross
Derbyshire S45 9FA
Phone:01246 250 647
Mobile: 07967 584 409
Chris Ellison Tour Leader <chris>
On behalf of
CTC Cycling Holidays & Tours Ltd
Registered in England and Wales no. 4106179
Registered office: Parklands, Railton Road, Guildford, Surrey GU2 9JX
ATOL 5613 ABTOT 5102