[amsat-bb] Nigerian scam span purporting to be from W0SL
karn at ka9q.net
Wed Jun 26 15:05:20 PDT 2013
Today I got a scam email purporting to be from Roy Welch, W0SL, asking
for an emergency loan. If I got it, I suspect many others on amsat-bb
got it too.
The originating IP address is in Nigeria. Where else?
I've seen this exact scam before. In those cases someone had stolen the
password of the person they were pretending to be.
I don't think that happened here. The "From" address was his correct
email account 'rdwelch at swbell.net' but the Reply-To: address was
'rdwelclh at yahoo.com'. Note the extra 'l'.
I think the scammers created this second account on Yahoo and used it to
send the scam email, forging Roy's address in the from field. Any reply
would, of course, go to the scammer's address on Yahoo and many people
might not notice the subtle change.
swbell.net has no SPF (Sender Policy Framework) records in the Domain
Name System to indicate to the rest of the Internet which IP addresses
may legitimately originate email from that domain, so recipient systems
cannot easily detect forgeries.
More information about the AMSAT-BB