Sender: msmith11@mail.com Emails are from IP address:

Emails are weekly. all text, no links, no images. Some Depict sexual fantasies in high detail directed to a female - which I am. Most recent email stated: wear red tomorrow. I didn't wear red that day. Next email stated: that wasn't very red, try harder tomorrow.

Trying to determine if it's some sort of ploy to get me to reply at which my email becomes compromised in some way? Or if I should be watching over my shoulder a little more and looking out for a creeper? The IP address seems to be on the spam list when I google it. Email address seems generic or fake or spoofed.

Is there other source data in the email to help dig?

Any tips or guidance is appreciated.

Here's an email with all source info. Its an older one..when I attempted to paste in one that had a lot more graphic content this site told me I was spamming and it wouldn't let me.

Authentication-Results: hotmail.com; spf=pass (sender IP is smtp.mailfrom=MSMITH11@mail.com; dkim=none header.d=mail.com; x-hmca=pass header.id=MSMITH11@mail.com
X-SID-PRA: MSMITH11@mail.com
X-SID-Result: PASS
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0z
X-Message-Info: NhFq/7gR1vQ3/ySCLm+UU3K0MkFlT5F3PoTvE/eJ3d7NYFbWcBAaRj1WgObFwMdCskxBwQWS3ii2isDEH8z0x7nIDiTrEJsDLyyBEZPT1LTeiBmEfiUUmCM9dXzCj/LnbctD6hE+NJ1G3XvP13BvxkixB3OfQ7a3mC/MDqwfw4dGeFTbDYgRkCd4+vo3rC8XjECIkBKxd45+U4+dEiaSWSwc1QT8OUQW4jP9JexruBYekeCkh4htrA==
Received: from mout.gmx.com ([]) by COL004-MC6F36.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
     Mon, 19 Oct 2015 14:01:19 -0700
Received: from [] by 3capp-mailcom-lxa15.server.lan (via HTTP);
 Mon, 19 Oct 2015 23:01:18 +0200
MIME-Version: 1.0
Message-ID: <trinity-585081ab-4898-4a00-9379-fe56224dfd77-1445288478735@3capp-mailcom-lxa15>
From: "ML Smith" <MSMITH11@mail.com>
To: myemailhere

Subject: Thinking of you. Part 3
Content-Type: text/html; charset=UTF-8
Date: Mon, 19 Oct 2015 23:01:18 +0200
Importance: normal
Sensitivity: Normal
X-Priority: 3
X-Provags-ID: V03:K0:GIcR2OMy3szCgVf9sqGX9G+qJ0IxUP8EHjgUXDwHq1+
X-UI-Out-Filterresults: notjunk:1;V01:K0:sF4+/cOPXrk=:hqKaETrfzG3ZMBDL6lp5es
Return-Path: MSMITH11@mail.com
X-OriginalArrivalTime: 19 Oct 2015 21:01:19.0667 (UTC) FILETIME=[4D878030:01D10AB1]

<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>one day i&#39;ll walk up behind you and start massaging your shoulders and youll know it&#39;s me. ill finish and start walking slowly away. wait a few seconds, then follow. the hotel will already have been booked and it&#39;s only a block away. we can be back before anyone notices.</div>


<div>its going to happen soon kitty kat</div></div></body></html>
  • Is it okay to post the content of the email? – Jimmy Lin Nov 20 '15 at 2:02
  • 9
    If you're worried about a stalker, please go to the police. – Mark Buffalo Nov 20 '15 at 2:49
  • If I were doing this to a group of people, I'd bet on most of them not wearing red. However, I would also bet on their starting to test me afterwards to see if I really was targeting them personally or a group. The easiest way to test this besides asking me would be to randomly either comply or ignore my requests and see if I responded accordingly. If that happened, I'd lose (on average) 1/2 of my targets per request. So, if I were targeting a group of people, I would make as few requests as possible after the first one. Just a thought. – KnightOfNi Nov 20 '15 at 3:03

This appears to be coming from one or more scammers. By analyzing the mail headers it reveals the IP address:

Mail header analysis

In addition to that, it seems some internal information is disclosed from the sender: 3capp-mailcom-lxa15.server.lan

Mail analysis reveals internal information


By searching for this internal information disclosure, it revealed that this QWest customer is sending the emails (although it could be a compromised machine) and are found on scammer sites:

Google Search the internal information disclosure

Performing a WHOIS lookup on the IP address an abuse email address with instructions on how to send an abuse complaint is found:

WHOIS query on the sender's IP address

I suggest to fill out all the details that they want, including the mail headers (yes, multiple headers) and send a complaint to abuse@centurylinkservices.net

In addition, you could send them the link to this topic so they can see this analysis.

Hope this helps and good luck!

  • I live in the surrounding area of Minneapolis, so if these emails are coming from the location found above than I would call that too close to home to ignore. Qwest is a major service provider that is now Centurylink that is in this area so it makes sense. – Seeking Answers Nov 20 '15 at 13:30
  • So what's your next step? Did you report it to Qwest / Centurylink? I wouldn't mind knowing the outcome of this. – Jeroen Nov 21 '15 at 8:20
  • The emails got more obvious that it was someone around me. I have taken steps to protect myself and involved professionals to address it. Thanks for your help all! – Seeking Answers Nov 27 '15 at 13:24
  • It could also just be a proxy, which would explain the spam results. – forest Apr 9 '18 at 6:43

First, mail.com is a legitimate webmail site.

Second, is a PA, USA IP.

If you live in PA, I would escalate this to the police immediately. If you do not live in PA, I would still consider contacting your local police.

There isn't much more to dig out, from what I can see. From other types of spam like this, the intent is to start a dialogue, and then the spammer gets you to reveal more and more data.

But frankly, given the threatening nature of the emails, I'd talk to your local police. Besides, they have more tools to work with.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.