Scammer's Sythe profile link: http://www.sythe.org/members/323100-isellst00f.html
Prove that the user is the same: http://www.sythe.org/10211444-post1.html
Proof of offsite scam/blackhat:
Message with SMTP headers -
On one hand, this message was sent through bol.com.br, so I'm not sure we can verify its authenticity (maybe the authenticated sender [email protected] will give some information), on the other hand, it's clear this message was manually sent because it addresses me by name and the X-Mailer field is iPhone Mail.
Because it's deliberate, I expect that either he's been hacked or he's gone blackhat. Even so it could be someone else is spoofing his email address. Whatever happened I think this should be on file.
Prove that the user is the same: http://www.sythe.org/10211444-post1.html
Proof of offsite scam/blackhat:
Message with SMTP headers -
Code:
Delivered-To: [email protected]
Received: by 10.182.36.70 with SMTP id o6csp93048obj;
Tue, 3 Feb 2015 14:18:55 -0800 (PST)
X-Received: by 10.140.82.234 with SMTP id h97mr50938100qgd.75.1423001934627;
Tue, 03 Feb 2015 14:18:54 -0800 (PST)
Return-Path: <[email protected]>
Received: from smtps.bol.com.br (a4-smart2.bol.com.br. [200.147.96.169])
by mx.google.com with ESMTP id w103si30497470qgd.53.2015.02.03.14.18.54
for <[email protected]>;
Tue, 03 Feb 2015 14:18:54 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 200.147.96.169 as permitted sender) client-ip=200.147.96.169;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 200.147.96.169 as permitted sender) [email protected]
Received: from localhost (localhost.localdomain [127.0.0.1])
by a4-smart2.bol.com.br (Postfix) with ESMTP id 18D32E00009B
for <[email protected]>; Tue, 3 Feb 2015 20:18:53 -0200 (BRST)
X-UOL-SMTP: SMTPS587
Received: from bol.com.br (unknown [194.135.152.110])
(Authenticated sender: [email protected])
by a4-smart2.bol.com.br (Postfix) with ESMTPA id F07B9E00008D
for <[email protected]>; Tue, 3 Feb 2015 20:18:50 -0200 (BRST)
From: "Alex Holbrook" <[email protected]>
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (1.0)
Subject: From: Alex Holbrook
Message-Id: <[email protected]>
Date: Tue, 3 Feb 2015 23:01:27 +0100
To: <[email protected]>
X-Mailer: iPhone Mail (5B108)
X-SIG5: fefec11e69879487d1fb62557017dc63
Hi Noam
http://vvsjes.dk/century.php?blood=3Dteg6nycz3m5e1 [this is a phishing link, and google will warn you if you click it in a chrome browser]
[email protected]
Sent from my iPhoneOn one hand, this message was sent through bol.com.br, so I'm not sure we can verify its authenticity (maybe the authenticated sender [email protected] will give some information), on the other hand, it's clear this message was manually sent because it addresses me by name and the X-Mailer field is iPhone Mail.
Because it's deliberate, I expect that either he's been hacked or he's gone blackhat. Even so it could be someone else is spoofing his email address. Whatever happened I think this should be on file.
