I sell merchandise online. Due to suspicious activity (in my very amateur opinion), I have reason to believe that, what seems like two separate orders, are actually a single scam being perpetrated by one individual. I can disclose full details if necessary as to why I believe this might be a scam.

I've tried tracing the headers myself using various online tools, but have yet to satisfy my paranoia. Any help in tracing the following headers, and confirming that there is anything suspicious going on, or that they are in fact from two separate innocent parties, or one malicious scammer would be greatly appreciated.

Both headers are copied and pasted exactly as they appeared with the following changes "MYDOMAIN" is my original domain. "FIRSTNAMECHANGED" is the name of the first individual. "SECONDNAMECHANGED" is the name of the second individual. Also subject has been changed to "EMAIL SUBJECT CHANGED". Please advise if there is any further information needed.

first header:

Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Thu, 16 Oct 2014 07:21:58 -0600
Received: from [] (port=54339 helo=nm16-vm4.bullet.mail.ne1.yahoo.com)
    by host131.hostmonster.com with esmtps (TLSv1:AES128-SHA:128)
    (Exim 4.82)
    (envelope-from <[email protected]>)
    id 1Xel0A-0008Eo-Cr
    for [email protected]; Thu, 16 Oct 2014 07:21:58 -0600
Received: from [] by nm16.bullet.mail.ne1.yahoo.com with NNFMP; 16 Oct 2014 13:21:55 -0000
Received: from [] by tm101.bullet.mail.ne1.yahoo.com with NNFMP; 16 Oct 2014 13:21:55 -0000
Received: from [] by omp1052.mail.ne1.yahoo.com with NNFMP; 16 Oct 2014 13:21:55 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 10467 invoked by uid 60001); 16 Oct 2014 13:21:55 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1413465715; bh=/5VbEsn6EXdx05CAqKkl56aXKGPLrRGWQ1eTh4cUs7Q=; h=References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=YKAQFD77rBttye/RBpZOx1bqIPOXVnWA6sMgXd3IWK5zrEMO+EELPyY6qqu19b7d5i8HFFPyJUK0NPAYFeJH7zPCovUa2k6lYDNDdFojLWkym3FOLsvktiwf3AI8asfAjefjYMpFHwgpGY8SIcPeDTJcJTJldywqz82Rgk3ypuU=
X-YMail-OSG: tgh4foYVM1l01uiodi54bz.RJERAY7rzslryNzd4MrkV0ti
Received: from [] by web122603.mail.ne1.yahoo.com via HTTP; Thu, 16 Oct 2014 06:21:55 PDT
X-Rocket-MIMEInfo: 002.001,SSBsaWtlIGNyb3AgMgprZXZpbiAKCgpPbiBXZWRuZXNkYXksIE9jdG9iZXIgMTUsIDIwMTQgNzozOCBQTSwgUHJpbnQgR3Vyb28gU3VwcG9ydCBUZWFtIDxzdXBwb3J0QHByaW50Z3Vyb28uY29tPiB3cm90ZToKICAKCgpIZWxsbyBLZXZpbiwKClRoYW5rIHlvdSBmb3IgeW91ciByZWNlbnQgb3JkZXIgZm9yIG9uZSAyMCB4IDUwIHBhbm9yYW1pYyBwcmVtaXVtIHBob3RvIApwcmludCEKClRvIGVuc3VyZSB0aGF0IHdlIGRlbGl2ZXIgYSBwcmludCB0aGF0IHdpbGwgbWVldCB5b3VyIGhpZ2hlc3QgCmV4cGVjdGEBMAEBAQE-
X-Mailer: YahooMailWebService/
References: <[email protected]>
Message-ID: <[email protected]>
Date: Thu, 16 Oct 2014 06:21:55 -0700
From: FIRST NAME CHANGED <[email protected]>
Reply-To:FIRST NAME CHANGED <[email protected]>
To: "[email protected]" <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="1706509047-974124801-1413465715=:36463"
X-Identified-User: {0000:host131.hostmonster.com:local:local} {sentby:Delivered locally}

second header:

Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Thu, 16 Oct 2014 07:23:42 -0600
Received: from [] (port=64623 helo=mail-lb0-f182.google.com)
    by host131.hostmonster.com with esmtps (TLSv1:AES128-SHA:128)
    (Exim 4.82)
    (envelope-from <[email protected]>)
    id 1Xel1q-0000ql-Et
    for [email protected]; Thu, 16 Oct 2014 07:23:42 -0600
Received: by mail-lb0-f182.google.com with SMTP id z11so2805932lbi.27
    for <[email protected]>; Thu, 16 Oct 2014 06:23:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=gmail.com; s=20120113;
MIME-Version: 1.0
X-Received: by with SMTP id be6mr1665551lab.72.1413465817608;
    Thu, 16 Oct 2014 06:23:37 -0700 (PDT)
Received: by with HTTP; Thu, 16 Oct 2014 06:23:37 -0700 (PDT)
Received: by with HTTP; Thu, 16 Oct 2014 06:23:37 -0700 (PDT)
In-Reply-To: <[email protected]>
References: <[email protected]>
Date: Thu, 16 Oct 2014 09:23:37 -0400
Message-ID: <CAEFd=w8A=6wKk9hYczF2acsDJ_0CbL9C=mTf8PzmFyoBPLGuCw@mail.gmail.com>
From: SECOND NAME CHANGED <[email protected]>
To: [email protected]
Content-Type: multipart/alternative; boundary=001a11c26176f5f80405058a2711
X-Identified-User: {0000:host131.hostmonster.com:local:local} {sentby:Delivered locally}

Once again replying to answers here due to restricted access:

Mark, thank you so much your help has been invaluable.

Clockwork-Muse, I think you can make good use of that TOUR link located at the bottom of your screen. Particularly the "Ask questions, get answers, no distractions" section. Just because you can't wrap your head around why this question was asked does not make it any less valid. I am taking proactive SECURITY precautions to ensure neither I or an unsuspecting victim of possible account fraud get burned by a scammer.

Although I am incredibly new to the forum does not mean I am new to Stack Exchange. I have successfully been using and learning from this amazing resource for years without ever having to ask a question. So please instead of drawing these scenarios for which there is an infinite number. "What if it's a cat and a dog that placed the order? What if they came from another planet? What if it's because it is close to Halloween? What if it is the same person?" Stick to the forum rules. Or if it really does concern you that much, you can ask what my situation is and I will tell you, then maybe my question wouldn't bother you so much. I apologize for the tone but it is irritating to expect an answer and get opinion. Thanks for your response none the less.

  • 1
    Even if they do come from the same person, why does it matter? Granted, buying something from two different accounts is unusual, but not unreasonable - what about a business versus personal purchase, from two differently purposed accounts? Or for two different lines of business or something? What is it you plan on doing if it is the same person? Your customer may have a right to complain if you deny him just because he's using two different accounts... Commented Oct 17, 2014 at 10:16

2 Answers 2


The headers on the first email are consistent with it being sent using Yahoo's webmail interface from a person using an IP address from Cablevision's internet service. The headers on the second are consistent with it being sent via Gmail's webmail interface; Google does not provide any information about the sender's IP or location.

Are they the same person or different people? There's no way to tell from the available information.

  • Posting the reply on behalf of @czar: Mark, you mention that Yahoo does provide IP information. Can you indicate to me which IP address is the one you are referring to? I see about three different ones in the Yahoo related header, and I am still a bit confused on how to decipher. I would like to trace that IP and see if it at least comes up in the same state that the order was placed. I realize this may prove to be fruitless given the reach ISP's provide, but I'd like to take the extra step for piece of mind, before I make my final decision on how to handle this situation I'm in. Commented Oct 17, 2014 at 5:42
  • The bottommost "received" line: Received: from [] by web122603.mail.ne1.yahoo.com via HTTP; Thu, 16 Oct 2014 06:21:55 PDT.
    – Mark
    Commented Oct 17, 2014 at 8:15

There is no way to tell with certitude if this came from the same user without more information from both Yahoo and Google, which would not be forthcoming. The received from IP (at least with Gmail for sure) is changed to Google's so you can't see the original IP address. This may also be the case with Yahoo.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .