419 Scammers / Craigslist Scammers

if you’ve received an email from porkyexposed@yahoo.com – which is MY email – the email is believed to have been forged. If you look at the full header information of the email you will most likely see a different reply to and/or return-path, which is the spammers email-address. Unfortunately there is nothing I can do except send out this warning.

Below email addresses are email addresses of scammers, or victims who’s email has been compromised by said scammer who is also sending spam to Craigslist users.

Minnie Wilton <minniewilton@hotmail.com>
hellen4luv <hellen4luv@hotmail.com>
nicholassai50 <nicholassai50@yahoo.com>
bar chyke <bar.chyke@gmail.com>
Irina Sankara <irinasankara@yahoo.com>
Stacy Mohamed stacymohamed@hotmail.com
georg1a georg1a@cox.net
dorcaslove4ever dorcaslove4ever@yahoo.com
nefendt10 nefendt10@gmail.com
tiffi does voodoo <tiffidoesvoodoo@yahoo.com>
tinamark9922 <tinamark9922@hotmail.com>
mrs anickg <mrs.anickg@gmail.com>,
stacy mohamed <stacymohamed@hotmail.com>,
johnson smith 054 johnson.smith054@gmail.com
mayra3281 <mayra3281@gmail.com>

gv4z4 3189488499 <gv4z4-3189488499@comm.craigslist.org>
ssgwj 3136808648 <ssgwj-3136808648@comm.craigslist.org>
mayra3281 <mayra3281@gmail.com>
3dddc 3146814683 <3dddc-3146814683@comm.craigslist.org>
pw2c4 3188999951 <pw2c4-3188999951@comm.craigslist.org>

Received: from [178.254.203.20] by web161005.mail.bf1.yahoo.com via HTTP; Wed, 19 Jun 2013 04:58:43 PDT
X-Rocket-MIMEInfo: 002.001,SG93IGFyZSB5b3U_CgoKCgpQb3JreSBQaWcKATABAQEB

 

“Roger S. Elliott”

CRAIGSLIST SCAM / CHILDCARE SCAM

Subject: NANNY REQUIED URGENTLY
From Roger S. Elliott
Return-Path: <arougly3@gmail.com>
Received-SPF: pass (domain of gmail.com designates 74.125.82.67 as permitted sender)
X-Originating-IP: [74.125.82.67]
Authentication-Results: mta1047.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-wg0-f67.google.com) (74.125.82.67) by mta1047.mail.bf1.yahoo.com
Received: by wgbdt10 with SMTP id dt10so188354wgb.10
Received: by 10.216.238.79 with SMTP id z57mr1550703weq.184.1346946264925;
Received: by 10.216.218.151 with HTTP; Thu, 6 Sep 2012 08:44:24 -0700 (PDT)
Reply-To: xjxinc@gmail.com
Subject: NANNY REQUIED URGENTLY
From: “Roger S. Elliott” <arougly3@gmail.com>

My name is Mr. Roger S. Elliott, my wife died six months ago of breast
cancer. I don’t wanna talk about this but i think it is important
since you would be working as Cynthia’s nanny. Cynthia is 4 years old.
I am out of the city based on my business that is really booming here
in London and my girl will be arriving shortly back to the state
precisely on Sep 15th, Cynthia is here with me right now for holiday..

After a serious discussion with my father-in-law concerning a proper
care for my girl, we finally decided to search for a good and
responsible Nanny. If You are a student you can go for your classes
and report to Cynthia as soon as you are done with classes. The
monthly pay is $2600.00 for live out and $2400.00 for live in. We will
be responsible for your transportation which in exclusive of your
weekly salary regardless of the distance. You will be working with my
sister and also a housekeeper for a while before i fully arrive back
to the state..

We are strongly searching for someone of well mannered attitudes,
neatness and good sense of relationship. We are a Christian family and
we love our religion so basically everything we do is according to our
doctrines, I don’t mind your religion, but just letting you know so we
don’t offend you. If you are interested in this offer, please answer
all the questions below so i can have a brief idea of you..

1) What academic qualifications do you possess?
2) Do you have any relevant certificate to back up your
babysitting/Nanny career?
3) How old are you?
4) Are you married?
5) Do you have a valid Bank Account?
6) Tell us more about your temperament ..
7) Can you handle money if you are given an assignment to carry out?
8) Is your husband/Girlfriend/parent in support of you doing this job?
9) Which city are you located in?
10) How would you spend a time with my daughter though out a day?
“9:00am ~ 7:30pm”
11) What kind of activities would you plan for her?

Let me know if you will be available for the work offer and if you
have any questions as regards this offer, feel free to get in touch
with me..
I await a response at your earliest convenience. If the hours are not
okay by you let me know

Sincerely,
Roger

 

“Luz Reyes” “Donella Weingartner”

WARNING – RENTAL SCAM / ONLINE SCAMMER

Subject Line: Fwd: $625 / 2br – 1075ft&sup2; – Outstanding 2 bedroom 1 bathroom Rental (Loris)

From: luz.reyes24304@yahoo.com <luz.reyes24304@yahoo.com>
Date: Tue, Mar 26, 2013 at 1:03 PM
Subject: $625 / 2br – 1075ft&sup2; – Outstanding 2 bedroom 1 bathroom
Rental (Loris)
To: <emailuser@gmail.com>

Hey Daisy,
Did you get my last email?
The property is a bedroom bath with garage and washer/dryer. Pets are
allowed with a $100 cleaning charge.
The requirements to lease our property are as follows:
1. Photo ID
2. First months rent and optional fee for pets
3. Lease Agreement, I’ll bring it to the viewing
(It is month to month, 6 month or a 1 year lease)
4. Background check for each applicant
The service we use is Tenant Verified, here is a link.
This is an affordable way for me to screen applicants based on prior
tenant history and employment information. If you have a felony or bad
tenant history, I am flexible and I’ll work with you.
Let me know when you have your background check. It’s in a .pdf, you
can print it and bring to the viewing or email it to me. I am looking
for real tenants not window shoppers or tire kickers, right now I have
3 rental properties and a full time job.
What is the best contact number for you? Are you available tomorrow?
Enjoy your Tuesday!
Luz Reyes

_________________

From: donellaweingartner@yahoo.com <donellaweingartner@yahoo.com>
Date: Mon, Mar 25, 2013 at 11:08 AM
Subject: $625 / 2br – 1075ft&sup2; – Outstanding 2 bedroom 1 bathroom
Rental (Loris)
To: “emailuser@gmail.com”

Hey Daisy,
The property is a bedroom bath with garage and full size washer and
dryer. Dogs and cats are allowed with a $100 cleaning fee.
Requirements to rent our property are as follows:
1. PhotoID
2. 1st months rent and optional fee for pets
3. Rental Agreement, I’ll bring it to the viewing
(Options are month-to-month, 6 month or a 1 year lease)
4. Background check for each applicant
The provider we use is Tenant Verified: link.
This is an affordable way for me to screen applicants based on
previous rental history and employment information. If you have a
criminal record or bad tenant history, I am flexible and I’ll work
with you.
Let me know when you’ve completed your background check. It’s in a
.pdf, you can print it and bring to the viewing or email it to me. I
am looking for real tenants not window shoppers or tire kickers, right
now I have 3 rental properties and a full time job.
What is the best contact number for you? Are you available tomorrow?
Enjoy your Monday!
Donella Weingartner

 

Donella Weingartner also uses the name Donella Pomponi and Barrister Bernard OBI

 

“BONVALET Christelle”

WARNING – 419 SCAM / FRAUD

Bonjour très cher en christ Je me nomme Bonvalet Christelle . Chaque jour qui passe, je me sens très mal et j’ai de plus en plus assez de peur en moi à cause de mon cancer qui est très évolué. J’ai un fond au somme de (Deux Millions Vingt cinq milles euros) qui n’est rien d’autre que le reste de mes biens et je voudrais en faire don, dans les soucis de prendre par vous pour aider des personnes en besoin. Je vous prie d’accepter cette somme car elle pourrait bien vous êtes très utile. Je ne vous demande rien en retour. Que Dieu te bénisse‏

Return-Path: <parisini@tin.it>
X-YahooFilteredBulk: 212.216.176.237
Received-SPF: none (domain of tin.it does not designate permitted sender hosts)
X-Originating-IP: [212.216.176.237]
Authentication-Results: mta1293.mail.sk1.yahoo.com
Received: from 127.0.0.1 (EHLO smtp3web.tin.it) (212.216.176.237) by mta1293.mail.sk1.yahoo.com
Received: from feu24 (10.192.64.34) by smtp3web.tin.it (8.6.023.02) id 50FD6B1B008CE804; Mon, 25 Feb 2013 12:36:46 +0100
Received: from (186.202.16.129) by webmailvtin.alice.it; Mon, 25 Feb 2013 12:36:46 +0100
Message-ID: <13d112405e3.parisini@tin.it>
From: BONVALET Christelle parisini@tin.it
Reply-To: bonvalet_christelle10@yahoo.com
Subject: =?UTF-8?Q?Bonjour_tr=C3=A8s_cher_en_christ_Je_me_?= =?UTF-8?Q?nomme_Bonvalet_Christelle_._Chaque?= =?UTF-8?Q?_jour_qui_passe,_je_me_sens_tr=C3=A8s_m?= =?UTF-8?Q?al_et_j’ai_de_plus_en_plus_assez_d?= =?UTF-8?Q?e_peur_en_moi_=C3=A0_cause_de_mon_cance?= =?UTF-8?Q?r_qui_est_tr=C3=A8s_=C3=A9volu=C3=A9._J’ai_un_fon?= =?UTF-8?Q?d_au_somme_de_(Deux_Millions_Vingt?= =?UTF-8?Q?_cinq_milles_euros)_qui_n’est_rien?= =?UTF-8?Q?_d’autre_que_le_reste_de_mes_biens?= =?UTF-8?Q?_et_je_voudrais_en_faire_don,_dans?= =?UTF-8?Q?_les_soucis_de_prendre_par_vous_po?= =?UTF-8?Q?ur_aider_des_personnes_en_besoin._?= =?UTF-8?Q?Je_vous_prie_d’accepter_cette_somm?= =?UTF-8?Q?e_car_elle_pourrait_bien_vous_=C3=AAtes?= =?UTF-8?Q?_tr=C3=A8s_utile._Je_ne_vous_demande_ri?= =?UTF-8?Q?en_en_retour._Que_Dieu_te_b=C3=A9nisse=E2=80=8F?=
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary=”—-=_Part_19293_24799240.1361792206310″
X-Originating-IP: 186.202.16.129

BONVALET Christelle parisini@tin.it

Most likely switched her name around. Christelle Bonvalet was probably the original name.

 

“Marvin Thomas”

WARNING – NIGERIAN SCAM

Note: I am not selling anything on Craigslist nor do not have an ad up on any websites. Also, notice he is saying ‘item’ without actually naming the item he wants to purchase. That’s because he doesn’t care what the item it. He just wants your money and the item to possibly sell.

Subject Line: re:am interested in your posted ad
From: marvin thomas marvinthomas3 on AudrinaPatridge.com marvin.thomas03@gmail.com

Hi, thomas is my name.is your ad still for sale.I would love to buy this item asap,do withdraw the advert.I want you to know that i will be sending you a money order for payment.if you are ok with that,i will need your full name and mailing info to send the payment and i will arrange for the pick up.if you are willing to sell the item to me do email me at marvin.thomas03@gmail.com

Return-Path: <apache@iceman.sidestudios.com>
Received: from iceman.sidestudios.com (466180-web4.sidestudios.com [166.78.83.107])
by mtain-mi01.r1000.mx.aol.com (Internet Inbound) with ESMTP id 599E2380000C6
Received: by iceman.sidestudios.com (Postfix, from userid 48)
id 590A3462328; Tue, 12 Mar 2013 11:42:58 -0500 (CDT)
Subject: re:am interested in your posted ad
X-PHP-Originating-Script: 502:class.phpmailer.php
From: marvin thomas marvinthomas3 on AudrinaPatridge.com” <marvin.thomas03@gmail.com>
Reply-To: “marvinthomas3 on AudrinaPatridge.com” <marvin.thomas03@gmail.com>, “marvinthomas3 on AudrinaPatridge.com” <marvin.thomas03@gmail.com>, “marvinthomas3 on AudrinaPatridge.com” <marvin.thomas03@gmail.com>, “marvinthomas3 on AudrinaPatridge.com” <marvin.thomas03@gmail.com>
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
x-aol-sid: 3039ac1d7b89514011016a3d
X-AOL-IP: 166.78.83.107
X-AOL-SPF: domain : iceman.sidestudios.com SPF : none

queen jobe queenjobe12@yahoo.com thomasmarvind@yahoo.com apache@iceman.sidestudios.com

 

“Kelly Clark”

WARNING – CRAIGSLIST SCAM / WORK AT HOME JOB SCAM & eBay Scam (by the same scammer)

Subject Line: Craigslist Poster Needed – If you need a part time job $1.50 per post
Hi,
I need a poster for my ads on craigslist. This is a part time job. I will pay $1.50 per post.
You will make around $500 per week. If you are a hard working person, this is the job for you.
Stay home and make money. I am a ticket dealer and you will have to post my tickets on craigslist.
For more details you can reply me at : kelly777clark@gmail.com

Return-Path: <SRS0=pRWY=HR=gmail.com=kelly777clark@srs.kundenserver.de>
X-YahooFilteredBulk: 212.227.126.171
Received-SPF: pass (domain of srs.kundenserver.de designates 212.227.126.171 as permitted sender)
X-Originating-IP: [212.227.126.171]
Authentication-Results: mta1017.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO moutng.kundenserver.de) (212.227.126.171) by mta1017.mail.bf1.yahoo.com with SMTP; Tue, 18 Sep 2012 12:00:25 -0700
Received: from icpu915.kundenserver.de (infong275.kundenserver.de [212.227.127.173]) by mrelayeu.kundenserver.de (node=mreu2) with ESMTP (Nemesis) id 0Lapqe-1TtkZs30um-00kZGI; Tue, 18 Sep 2012 21:00:24 +0200
Received: from 172.129.57.149 (IP may be forged by CGI script) by icpu915.kundenserver.de with HTTP id 4Ap1SB-1TMsjg2aNE-008rGa; Tue, 18 Sep 2012 21:00:24 +0200
X-Sender-Info: <196478416@icpu915.kundenserver.de>
Subject: Craigslist Poster Needed – If you need a part time job $1.50 per post
From: Kelly Clark <kelly777clark@gmail.com>
X-Provags-ID: V02:K0:WsRioMRAUeEUNvQ4ZPtQ2D6mlz22M54vRuN/irE7MX2 ffUm0HEPE6p0PKyzPfaOJCIBdptsBJxgvPSljElCtlC9LwfaTb 8PxTcDSihpB0xKSDwLrnfxZkz9HvnEKHc4zRMrmc71D1cV893m rzzS+lAw+WdJswQZ+uaeMCdt+xu1O4rss0HEa2ymKID2qafWyl 0gOEPD1O3VIcpGAJG+98TfuoTFwQQQZe5e6tHjDeGIKQWmdjrq JGiaBpiEXWT1r31kjjXnogl8SGiQ67RxwxiqH5LfVd+lCJalxV ydHF9C0y5K2T1nTO6j+jToyljjo1FJNdK95rGRdWI4CFaFcWeg q6TWhOuRThvRJzAQas1y7b463jE0W9Ht2KrBj9QWySFlNJe1rG idNe4YRXxbuKIjm7Xdspy5QKArZ4wf6T7RkA33lEMz+fhcSYAY UKlK8

Kelly Clark kelly777clark@gmail.com

Subject Line: eBay Lister Needed – $300 per week- Part time job
Hello,

I need someone who can post my cars online on eBay. Will pay $50 for each add you will post online.
I will send you the money every 3-4 days via PayPal or Money Order. You can make around $300-400 per week

Let me know asap if you are interested

Thanks

Kelly A. Clark kelly777clark@gmail.com
Return-Path: <SRS0=HVV3=IJ=gmail.com=kelly777clark@srs.kundenserver.de>
X-YahooFilteredBulk: 212.227.126.186
Received-SPF: pass (domain of srs.kundenserver.de designates 212.227.126.186 as permitted sender)
X-Originating-IP: [212.227.126.186]
Authentication-Results: mta1331.mail.bf1.yahoo.com from=; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO moutng.kundenserver.de) (212.227.126.186) by mta1331.mail.bf1.yahoo.com 
Received: from icpu915.kundenserver.de (infong275.kundenserver.de [212.227.127.173]) by mrelayeu.kundenserver.de (node=mreu4) with ESMTP (Nemesis) id 0MPNP2-1TI4dV0wTY-004Pde;
Received: from 195.93.60.8 (IP may be forged by CGI script) by icpu915.kundenserver.de with HTTP id 4AMXHL-1T2b5V0gFE-00OF7J; Fri, 12 Oct 2012 03:56:33 +0200
X-Sender-Info: <196478416@icpu915.kundenserver.de>
Message-Id: <4AMXHL-1T2b5V0gFE-00OF7J@icpu915.kundenserver.de>
Subject: eBay Lister Needed – $300 per week- Part time job
From: Kelly A. Clark <kelly777clark@gmail.com>
Reply-To: kelly777clark@gmail.com

 

“Matthew Snapp” aka “Anthony Gray”

WARNING – JOB SCAM / NIGERIAN SCAMMER

Subject Line: babysitter/nanny

Hello,

We are in need of a good babysitter/nanny for my girl Lacey which is 4yrs old, i am from Singapore, i will be in state for an assignment from 25th of September through 30th 0f October and am looking for someone who can care for my girl during this period from Monday through Friday or anytime you are convenient and comfortable with, and i saw your Resume on craiglist.com as a very good babysitter/nanny, i will be coming to state with 8 delegate to assist some of our branches in the state, i will appreciate it if the girl is being taking care of in a free smoking environment by a good Christian, I hereby anticipate your reply indicating your availability throughout these times and the total cost of caring for response for more details. Please kindly send your response to my private e-mail for quick reply ( matthew_snapp@yahoo.com )

Return-Path: <anthony.gray24@yahoo.com>
X-YahooFilteredBulk: 98.138.91.208
X-Originating-IP: [98.138.91.208]
Authentication-Results: mta1184.mail.gq1.yahoo.com
Received: from 127.0.0.1 (HELO nm20-vm2.bullet.mail.ne1.yahoo.com) (98.138.91.208) by mta1184.mail.gq1.yahoo.com with SMTP; Tue, 18 Sep 2012 15:19:01 -0700
Received: from [98.138.90.55] by nm20.bullet.mail.ne1.yahoo.com with NNFMP; 18 Sep 2012 22:18:58 -0000
Received: from [98.138.226.162] by tm8.bullet.mail.ne1.yahoo.com with NNFMP; 18 Sep 2012 22:18:58 -0000
Received: from [127.0.0.1] by omp1063.mail.ne1.yahoo.com with NNFMP; 18 Sep 2012 22:18:58 -0000
X-Yahoo-Newman-Id: 259306.82278.bm@omp1063.mail.ne1.yahoo.com
Received: (qmail 27031 invoked by uid 60001); 18 Sep 2012 22:18:58 -0000
Received: from [41.211.229.21] by web120303.mail.ne1.yahoo.com via HTTP; Tue, 18 Sep 2012 15:18:57
Message-ID: <1348006737.90749.YahooMailClassic@web120303.mail.ne1.yahoo.com>
From: Matthew Snapp <anthony.gray24@yahoo.com>
Reply-To: matthew_snapp@yahoo.com
Subject: babysitter/nanny

Matthew Snapp anthony.gray24@yahoo.com matthewsnapp@yahoo.com

 

Craigslist Phishing Attack

WARNING: CRAIGSLIST PHISHING ATTACK – ACCOUNT THEFT

SUBJECT LINE: Account restricted – Identity Confirmation!
From: “Craigslist” <ccipmt@craigllist.com>

The email consist of a spoofed link goo.gl/nq3cm which will be a fake Craiglists page where the hacker will want you to type in your personal information so they can steal it!

Return-Path: <ccipmt@craigllist.com>
X-YahooFilteredBulk: 209.86.89.70
X-Originating-IP: [209.86.89.70]
Authentication-Results: mta1105.mail.gq1.yahoo.com from=craigllist.com; domainkeys=neutral (no sig); from=craigllist.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO elasmtp-banded.atl.sa.earthlink.net) (209.86.89.70) by mta1105.mail.gq1.yahoo.com with SMTP; Tue, 26 Feb 2013 10:01:56 -0800
Received: from [76.26.58.50] (helo=User) by elasmtp-banded.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <ccipmt@craigllist.com>) id 1UAOqD-0002d8-GJ; Tue, 26 Feb 2013 13:01:26 -0500
Reply-To: ccipmt@craigllist.com
From: Craigslist<ccipmt@craigllist.com>
Subject: Account restricted – Identity Confirmation!
Message-ID: <E1UAOqD-0002d8-GJ@elasmtp-banded.atl.sa.earthlink.net>
X-Originating-IP: 76.26.58.50

 

“Cristine R”

CRAIGSLIST PHISHING ATTACK – SPOOFED ACCOUNT

Hi….about your ad on craigslist…:

My emails don’t go threw .
I’ve sent a few emails regarding your offer on craigslist but I’m guessing you didn’t received them, is this your add because I was looking at a few listings and I don’t know who is who. Please take a quick look and tell me if this is yours : ht ps://accounts.craigslist.org/ THIS IS A SPOOFED LINK, THE ACTUAL URL IS NOT A SECURE-LOGIN BUT A FAKE PAGE.
Waiting for urgent reply!

Return-Path: <lwworaynera@comcast.net>
X-YahooFilteredBulk: 87.193.178.170
Received-SPF: neutral (87.193.178.170 is neither permitted nor denied by domain of comcast.net)
X-YMailISG: RDPqseIWLDsvO6t8HVwRmh.ZykZL3cpvj_CGP.d2xtefu_SR Hr4mi4YHqHtClafi13.ES2QNHny8SnN5eW.tEKrAMrTfGwRPHtjS1L52CQf8 IW2Mu9EE9mFp5TCDPR9yJj_OxGlpdoQTRchCKbUlLmZmwsgUgfFKWINqgifx av0MP17r1rg24VkczxqRS321ObUKz9j4n3QW_FqNxzASn6Kg2Jze5tcYAG5Z hINH0CqLMeIPzOgJn2dxIABdp5wB7pp5pBMxaXHgqhnCgFctGFmVx4AsAOz0 azkqY2ZUdAq4rZ_FUihmbFfDj8OgNnomiNWUTkiBGQ8J329RBp7ywet5eHms 4_WBHCgTZSRGAh7HKfnljnVa0Fb8PCetATgmc2QsxDtrsB3pGdT3_gCmkfS6 U6so9B4uh7WpUZM1Sbkd1LxLiqaCYuMA2K1Pd8h2m8r1nI2CRLMUx_4m9vi. tym2zUpSrdXzj_bEAAlwAs4QgkdORvxUJBUEvW3uMUzqn4sFNwaj4IXtMnp5 P50hhQ8R5t7Mu.kTf.sRN.7g8arQJQotYltYuW3IXN73zaWdH_RXQX3frg9v KhtrtOS8l00ddVbzLLyVLGNGRcpw_Bjt7uqxmbaGpvMmwKTOWNMnril.CU48 p_UTMFCEU8Rx6I3y0hFqbzsh.LgYsMCues3mD80RHVEqjFpPzeP0b9.bOdFW D6i0az0X_.1Rr6YHaz2cw4IFMDCKaAYH5Zgpvrd3IhI4QoiDqfFQik5m0DhH WJZq.vkIDZ.5ZSDg2SH_skf.zvDw8CTKlqInS4Gg_W3r20sJuZdZA3BvFzUF _oi8mX_brksDeS80QznJQHle9x_UuS1IA0lUqj0hXwnZj88ahQ9T0AyZhm4r 4XGc2J83F9T5R4DkSiEt.t5hS8MD7N82OHxYOiVIOT60Mq7d3FadtyaI4VkK nLYmipHk9CTTrHKK.GA9yrDZ3sUc2dGQF1J9mDB5V10kyyj_AMwADDTqEE0O RcotWSYiVVZK2TvsTx9O_VhaRACKhJUD8WXK4JOGoa7eA_Zf9AbnoJhAHln5 uq.Rr585W8F5QX9UaBanRXx3jXqQ41p_l9JzZRTmGRM1hhxW.gBTM_ih0KLP e0.31Hh.diAp39ckyQMi6eR5FkkoNARGMqanZJqZ1d9.D6VPPe_XeQp0P6bM atfNPnwilTqe7RuasiqclhPRj7UOtGtnPZ4pBK3i.iYlUtC070bfcqLOMqKD wRg7hlaANFdrSF7ZtysbpLDzgc7i0FcT3A56X58lRW9k3dGAVDd514m01j5T zfWIsr2DIkRbvOZKlxw_s7zm28A3KuVJeZl1Spu1gq3DSY.cFSs7tWfXFY42 qeiroc7RbecNfqnLnnaq80W6necy9qt9qUgRP7IxPfNRqycsDKea_jil.C3w RJZHu2nBOFBUIRCqKVlyHbWv3p9IBqprIAMDX0bPJczxVTtCvlzigKlQRfFM xASUwUdYrjRorWJgcEJSD9GABqUwfvlK142t2Upuxn5GnML1kYLS0f1wSFs4 hoccgBJzQDQ2d0lHlsttKF6zJ1oej6sX3ezxIFQZDSJRPMrHAdFmHbfxTM97 g_rIvRKk787mrNuoIdvl3.5TNMsBw5e6Q681mWjE6A7N0gnfL1kyzRFswCnP Tl9twb8EqkMUA6Ll
X-Originating-IP: [87.193.178.170]
Authentication-Results: mta1126.mail.bf1.yahoo.com from=comcast.net; domainkeys=neutral (no sig); from=comcast.net; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mail.in.kommdirekt.info) (87.193.178.170) by mta1126.mail.bf1.yahoo.com with SMTP; Sun, 03 Feb 2013 20:40:58 -0800
Received: from localhost ([127.0.0.1]) by mail.in.kommdirekt.info (Kerio Connect 7.4.3); Mon, 4 Feb 2013 05:40:52 +0100
Reply-To: lwworaynera@comcast.net
From: “Cristine R”<lwworaynera@comcast.net>
Subject: Hi….about your ad on craigslist…

Cristine R

 

“Loryane R”

CRAIGSLIST PHISHING ATTACK – SPOOFED SITE – ACCOUNT THEFT

SUBJECT LINE: about your ad on craigslist…

My emails don’t go threw .
I’ve sent a few emails regarding your offer on craigslist but I’m guessing you didn’t received them, is this your add because I was looking at a few listings and I don’t know who is who. Please take a quick look and tell me if this is yours : ht ps://accounts.craigslist.org/
Waiting for urgent reply!

HEADER DETAILS:

Return-Path: <nobody@server.moorweb.com>
X-YahooFilteredBulk: 216.14.122.148
Received-SPF: none (domain of server.moorweb.com does not designate permitted sender hosts)
X-YMailISG: agJsInIWLDsd_Pb.a00i951CellTOABJRKiGL1Av0H05V9xi uNWBJSlFQQhHQQP8wcWbdvHe70mSCmnYiMHehE1y8YtJWvpGgteCYzsjHeng XFYfbbi_G9SErdR1hb9sKPThAhTjMp76mHM9K9pnLl3Ir._bICK2EpdXN3KN 3Rnecr6wLzUfeAIHLZWrZpD0_8QHKs12EY0fGvjexoiRmyyIpfz0uk2uDFLg EqjfUHWw.lvy7GK9Cl31BswFIwbsLJdHJDWpWmfVBfVHHspmgG5fkHd9GCng LA5YHtAE63N0JvrdskaHXy7BwvelCQciMI.5WMNsjQ_Lwz3lzuTO9m95K.nT Bno30vkOa1INPQueRZayXC6fJuwqVs4pt1aLjJ6zx5f37qrndCQyjairPUn5 wrPdiAtyeUiE6IM5bvj6ouOqsOAIJIO4ck3DiVqcYtw9CrDjiOQa6_k2I3Bj OMNNQWnQumfL80rguml_TIWTFn1oyPOEOJUsmlHngnll73mDEvH.yQLA0vkc E52Wv_vx4tlnvpkdHHmhYuPHazb41_DlG08qg2kcTQQifmtm9M3GergiX1Zl c_Tz_0rouNIZOL_I0Tvnf5NBfMB5Vm1OHQ.VivDTZZSyB3uIyoxl.ZYh4AiN gsK9MFbutc4.3pVgnsp4L0_6LZqWqKwCWZl03eDLS.UuNn2wvpPnjFFy6D7J BchjYnI.FguTbzPE7WN_BFQ.4FimzywwgnaY0AaRDtHz77G0tEhm8.8dhD8i CElJorCQHQ4Qak4aSZ3gSkkoKZnVucbr1TFGTonIN3vZtV4qE8Y4.ohNq0IJ nVwinkvJE93IlDxsaKWKJ9Tow.cXzdwxb9qoG_soPZQNU.d9SvfwpG_TC.yU yA_PoAK2VVdZP_6jru0MStqWW5a_d1fEM7i.fufnDtmeHZBZlfQcEbXfAEaa ST0RpoL_nDBwiiEHFeWtGym2j35Tq9Fe0dTLvy8SiUWB26DJk_5qgraF92Rc 13.X8CvcxLgH5HWGwP6VQ80gfJnSfYMm2EpX4lE1u._yBqkf0jIbP1D4Hfyg z2uyRHV.kARd9KD07Z_f3Afi24BT2G7F.3NyFJMn_xewLxQ5d_GDxoI2Fs4J wNfe9tMPt1nMS9I3fvgFgPf.NQF2hdIVwL8M51lv1OLZsuCLVXSQRjolEoq5 eWm5ZMo4x8nMIyxoowll8MuDaJ4WTRE.O_LLqq.S1T0gVsVbs8wFas_wtBYl 1odGh3s18SQbCOxkdo3qKRS8SFZStnU9jgOIFaNQojP9K4HLMKZcghAgarzL KISoXGMWR0Eqgq8FMxPVPBbM3SaawNm1IeltqqmsVQ36FNhlQ3vw
X-Originating-IP: [216.14.122.148]
Authentication-Results: mta1053.mail.ne1.yahoo.com from=verizon.net; domainkeys=neutral (no sig); from=verizon.net; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO server.moorweb.com) (216.14.122.148) by mta1053.mail.ne1.yahoo.com with SMTP; Mon, 21 Jan 2013 16:36:18 +0000
Received: from nobody by server.moorweb.com with local (Exim 4.80) (envelope-from <nobody@server.moorweb.com>) id 1TxKLr-0008Pf-C8 for deleted@yahoo.com; Mon, 21 Jan 2013 10:36:03 -0600
Subject: about your ad on craigslist…
From: Loryane R <arreayne@verizon.net>
Reply-To: arreayne@verizon.net
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – server.moorweb.com
X-AntiAbuse: Original Domain – yahoo.com
X-AntiAbuse: Originator/Caller UID/GID – [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain – server.moorweb.com
X-Get-Message-Sender-Via: server.moorweb.com: uid via acl_c_vhost_owner from authenticated_id: nobody from /only user confirmed/virtual account not confirmed

Loryane R arreayne@verizon.net <> nobody@server.moorweb.com IP_USED: 216.14.122.148