0

I sell merchandise online. Due to suspicious activity (in my very amateur opinion), I have reason to believe that, what seems like two separate orders, are actually a single scam being perpetrated by one individual. I can disclose full details if necessary as to why I believe this might be a scam.

I've tried tracing the headers myself using various online tools, but have yet to satisfy my paranoia. Any help in tracing the following headers, and confirming that there is anything suspicious going on, or that they are in fact from two separate innocent parties, or one malicious scammer would be greatly appreciated.

Both headers are copied and pasted exactly as they appeared with the following changes "MYDOMAIN" is my original domain. "FIRSTNAMECHANGED" is the name of the first individual. "SECONDNAMECHANGED" is the name of the second individual. Also subject has been changed to "EMAIL SUBJECT CHANGED". Please advise if there is any further information needed.

first header:

Return-path: <FIRSTNAMECHANGED@yahoo.com>
Envelope-to: support@MYDOMAIN.com
Delivery-date: Thu, 16 Oct 2014 07:21:58 -0600
Received: from [98.138.91.176] (port=54339 helo=nm16-vm4.bullet.mail.ne1.yahoo.com)
    by host131.hostmonster.com with esmtps (TLSv1:AES128-SHA:128)
    (Exim 4.82)
    (envelope-from <FIRSTNAMECHANGED@yahoo.com>)
    id 1Xel0A-0008Eo-Cr
    for support@MYDOMAIN.com; Thu, 16 Oct 2014 07:21:58 -0600
Received: from [98.138.100.102] by nm16.bullet.mail.ne1.yahoo.com with NNFMP; 16 Oct 2014 13:21:55 -0000
Received: from [98.138.89.194] by tm101.bullet.mail.ne1.yahoo.com with NNFMP; 16 Oct 2014 13:21:55 -0000
Received: from [127.0.0.1] by omp1052.mail.ne1.yahoo.com with NNFMP; 16 Oct 2014 13:21:55 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 513741.54857.bm@omp1052.mail.ne1.yahoo.com
Received: (qmail 10467 invoked by uid 60001); 16 Oct 2014 13:21:55 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1413465715; bh=/5VbEsn6EXdx05CAqKkl56aXKGPLrRGWQ1eTh4cUs7Q=; h=References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=YKAQFD77rBttye/RBpZOx1bqIPOXVnWA6sMgXd3IWK5zrEMO+EELPyY6qqu19b7d5i8HFFPyJUK0NPAYFeJH7zPCovUa2k6lYDNDdFojLWkym3FOLsvktiwf3AI8asfAjefjYMpFHwgpGY8SIcPeDTJcJTJldywqz82Rgk3ypuU=
X-YMail-OSG: tgh4foYVM1l01uiodi54bz.RJERAY7rzslryNzd4MrkV0ti
    XXrRO_FCXZGieAdx55xK0v_4bsTiuP0G7k9lAraLQ9KYYiAiXFGBjrEtadC9
    k_lMRXXHCZ2iWiHPRKrvxUQKV6DYGIOb.qen5NbpY8esAJtGlXzpsZvcrBPJ
    05vqnMh6QpcohPr35z_I59bK4VPP4ye7.UUEc3mwK4YPLz5i475_PZcJ9RBo
    _8uWa64peMrha2AjbxgmoXTRvHJuD2XX2OR_d0KzAACpo_nxe_jfDJuxRMRy
    jDVto5WA4h0Vkqe6rLf1bAytLTc70wyHbK5.igY4JeF2OAiJsknpj4n_aV.Q
    PwNYQGyu68WYfqYR.1e.3tYP.qhyGx4qLh9crWQfY_84TA3vdaS2C7OgtoS2
    i0NgWzargGZjdjxk0CxISbyuhaIOlJiFChNMee1g1yzv.EDBcNrcucZ60XzV
    FpesmikJMiQYntCMhi.neyJOPW3YgAN_Z2qeF2t0phaE_6KmvfnSaE.7zrYY
    HFeml9s01a0W.Y.RBiLmrQ5MrHRPQQp3l8cqb75SqCPdBEthz
Received: from [173.2.235.35] by web122603.mail.ne1.yahoo.com via HTTP; Thu, 16 Oct 2014 06:21:55 PDT
X-Rocket-MIMEInfo: 002.001,SSBsaWtlIGNyb3AgMgprZXZpbiAKCgpPbiBXZWRuZXNkYXksIE9jdG9iZXIgMTUsIDIwMTQgNzozOCBQTSwgUHJpbnQgR3Vyb28gU3VwcG9ydCBUZWFtIDxzdXBwb3J0QHByaW50Z3Vyb28uY29tPiB3cm90ZToKICAKCgpIZWxsbyBLZXZpbiwKClRoYW5rIHlvdSBmb3IgeW91ciByZWNlbnQgb3JkZXIgZm9yIG9uZSAyMCB4IDUwIHBhbm9yYW1pYyBwcmVtaXVtIHBob3RvIApwcmludCEKClRvIGVuc3VyZSB0aGF0IHdlIGRlbGl2ZXIgYSBwcmludCB0aGF0IHdpbGwgbWVldCB5b3VyIGhpZ2hlc3QgCmV4cGVjdGEBMAEBAQE-
X-Mailer: YahooMailWebService/0.8.203.696
References: <5f02510ea8aac85bb5dd8a1709ad9c32@MYDOMAIN.com>
Message-ID: <1413465715.36463.YahooMailNeo@web122603.mail.ne1.yahoo.com>
Date: Thu, 16 Oct 2014 06:21:55 -0700
From: FIRST NAME CHANGED <FIRSTNAMECHANGED@yahoo.com>
Reply-To:FIRST NAME CHANGED <FIRSTNAMECHANGED@yahoo.com>
Subject: Re: EMAIL SUBJECT CHANGED
To: "support@MYDOMAIN.com" <support@MYDOMAIN.com>
In-Reply-To: <5f02510ea8aac85bb5dd8a1709ad9c32@MYDOMAIN.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="1706509047-974124801-1413465715=:36463"
X-Identified-User: {0000:host131.hostmonster.com:local:local} {sentby:Delivered locally}

second header:

Return-path: <SECONDNAMECHANGED@gmail.com>
Envelope-to: support@MYDOMAIN.com
Delivery-date: Thu, 16 Oct 2014 07:23:42 -0600
Received: from [209.85.217.182] (port=64623 helo=mail-lb0-f182.google.com)
    by host131.hostmonster.com with esmtps (TLSv1:AES128-SHA:128)
    (Exim 4.82)
    (envelope-from <SECONDNAMECHANGED@gmail.com>)
    id 1Xel1q-0000ql-Et
    for support@MYDOMAIN.com; Thu, 16 Oct 2014 07:23:42 -0600
Received: by mail-lb0-f182.google.com with SMTP id z11so2805932lbi.27
    for <support@MYDOMAIN.com>; Thu, 16 Oct 2014 06:23:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=gmail.com; s=20120113;
    h=mime-version:in-reply-to:references:date:message-id:subject:from:to
    :content-type;
    bh=Xz9U1PMTBrWGWkDdVg0Q7dJnM/OwDcVhQ2XnvUltoq4=;
    b=BjEp8PVqJxAJvTKbTgFpJnslvFjrC8JkmZ3qj5zYOeBOhu92QMxNW6gsCFXAbMPbH2
    ykovPgslfNPApjrId+OikaAXeqS9Sc0hMbUqsCHd9ghHY38QbcJ7TDgavPiKNu9GSKyV
    8zhE7lsmK/CCFuCJarzlUcyQ46SDoi0hguiCjlkqKlMzJxrbsg77s+fflnxPQ6LwT7En
    VCtI0hA2sC5aUH9F6UPRo4Tlj3w1CXfuVaqSKe8W83bkWcjjAD5SjTctnKK4ZAe1KuGT
    EVFI74yLVc9U7mtrT1kh2J1rikH4BNtAyHAkVpr+fE0Vp7tNUrDFJxzjiSsN9yxfEFzt
    q7EQ==
MIME-Version: 1.0
X-Received: by 10.152.88.70 with SMTP id be6mr1665551lab.72.1413465817608;
    Thu, 16 Oct 2014 06:23:37 -0700 (PDT)
Received: by 10.25.23.11 with HTTP; Thu, 16 Oct 2014 06:23:37 -0700 (PDT)
Received: by 10.25.23.11 with HTTP; Thu, 16 Oct 2014 06:23:37 -0700 (PDT)
In-Reply-To: <8060ae84679eca89226d880d7f07027f@MYDOMAIN.com>
References: <8060ae84679eca89226d880d7f07027f@MYDOMAIN.com>
Date: Thu, 16 Oct 2014 09:23:37 -0400
Message-ID: <CAEFd=w8A=6wKk9hYczF2acsDJ_0CbL9C=mTf8PzmFyoBPLGuCw@mail.gmail.com>
Subject: Re: EMAIL SUBJECT CHANGED
From: SECOND NAME CHANGED <SECONDNAMECHANGED@gmail.com>
To: support@MYDOMAIN.com
Content-Type: multipart/alternative; boundary=001a11c26176f5f80405058a2711
X-Identified-User: {0000:host131.hostmonster.com:local:local} {sentby:Delivered locally}

Once again replying to answers here due to restricted access:

Mark, thank you so much your help has been invaluable.

Clockwork-Muse, I think you can make good use of that TOUR link located at the bottom of your screen. Particularly the "Ask questions, get answers, no distractions" section. Just because you can't wrap your head around why this question was asked does not make it any less valid. I am taking proactive SECURITY precautions to ensure neither I or an unsuspecting victim of possible account fraud get burned by a scammer.

Although I am incredibly new to the forum does not mean I am new to Stack Exchange. I have successfully been using and learning from this amazing resource for years without ever having to ask a question. So please instead of drawing these scenarios for which there is an infinite number. "What if it's a cat and a dog that placed the order? What if they came from another planet? What if it's because it is close to Halloween? What if it is the same person?" Stick to the forum rules. Or if it really does concern you that much, you can ask what my situation is and I will tell you, then maybe my question wouldn't bother you so much. I apologize for the tone but it is irritating to expect an answer and get opinion. Thanks for your response none the less.

  • 1
    Even if they do come from the same person, why does it matter? Granted, buying something from two different accounts is unusual, but not unreasonable - what about a business versus personal purchase, from two differently purposed accounts? Or for two different lines of business or something? What is it you plan on doing if it is the same person? Your customer may have a right to complain if you deny him just because he's using two different accounts... – Clockwork-Muse Oct 17 '14 at 10:16
1

The headers on the first email are consistent with it being sent using Yahoo's webmail interface from a person using an IP address from Cablevision's internet service. The headers on the second are consistent with it being sent via Gmail's webmail interface; Google does not provide any information about the sender's IP or location.

Are they the same person or different people? There's no way to tell from the available information.

  • Posting the reply on behalf of @czar: Mark, you mention that Yahoo does provide IP information. Can you indicate to me which IP address is the one you are referring to? I see about three different ones in the Yahoo related header, and I am still a bit confused on how to decipher. I would like to trace that IP and see if it at least comes up in the same state that the order was placed. I realize this may prove to be fruitless given the reach ISP's provide, but I'd like to take the extra step for piece of mind, before I make my final decision on how to handle this situation I'm in. – Ebenezar John Paul Oct 17 '14 at 5:42
  • The bottommost "received" line: Received: from [173.2.235.35] by web122603.mail.ne1.yahoo.com via HTTP; Thu, 16 Oct 2014 06:21:55 PDT. – Mark Oct 17 '14 at 8:15
0

There is no way to tell with certitude if this came from the same user without more information from both Yahoo and Google, which would not be forthcoming. The received from IP (at least with Gmail for sure) is changed to Google's so you can't see the original IP address. This may also be the case with Yahoo.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.