Nigerian Subal

UW photography must be quite popular in Nigeria. I was quite amused with this one, believe many of you had similar experiences.

Couple months back, I posted an ad to subal.com that I am looking for Subal C20 housing for Canon 20D. A week ago I received an email from Anthony Wood from Madrid, Spain who is willing to sell his C20 which he bought on the Internet few months ago.

He gave his Spanish mobile number, +34 494 77 88 994 and his address, Carretera de Aravaca a Humera, km 2, Madrid, Spain.

Mail was sent from theanthonywood@rediffmail.com, by inspecting headers it was clear that sender is from Nigeria. EXIF data showed supposed pictures of his housing were shot in 2005 and Google Images found they were downloaded from www.seaoptics.com.au

Too bad, the price was good, 350 euros, and I managed to bring it down to 325

Is there a way to make this phone number canceled at least?

Nice catch. I'm not sure too many would actually check the complete header and the origin of the photo...

Crikey that is scary.

I for one may not have smelt a rat.

Paul C

I have a question!

What were the give-aways in the header?? I'm curious about how to spot this!

Cheers,

Simon

He gave his Spanish mobile number, +34 494 77 88 994 and his address, Carretera de Aravaca a Humera, km 2, Madrid, Spain.

 

Is there a way to make this phone number canceled at least?

That´s not a real phone number from Spain (is three numbers too long )....

What is worrying with new phone numbers is the ones that skype offer...

I can be in the Philippines and have someone call a uk number and it will divert to my skype phone. Great if you are a legitimate business, but could be a bugger if someone takes advantage in a bad way.

I have a question!

 

What were the give-aways in the header?? I'm curious about how to spot this!

I guess this was a lucky one, since web mail clients (such as gmail) usually do nor put originator IP in the SMTP header, but rediff.com does, here it is:

Received: from unknown (82.128.5.198) by rediffmail.com via HTTP; 08 feb 2007 21:55:06 -0000

This is in Nigeria.

To see message headers you would go to show original, show raw or something similar in your mail client.

I guess this was a lucky one, since web mail clients (such as gmail) usually do nor put originator IP in the SMTP header...

Gmail actually does allow you to view all of the header information - when viewing an email, click the dropdown arrow near the top-right of the message window (next to the 'Reply' button), and select 'Show original'.

I know that, since the scam artist sent the mail to my gmail account. However, if the suspicious mail originates from gmail there is no way to tell the origin of it without contacting google (and they will never give you this information). At least it was so last time I was checking.