Headers - Yahoo! Mail

[Trainmaster]

Retrieving Headers in Yahoo! Mail:

When viewing a message, click the "Full Headers" link in the lower right-hand corner. You can then copy the headers at the top of the message.

http://recs.fraudwatchers.org/sco/yahoo-hdr.png

To restore the original state, click in the same spot where it will now say "Basic Headers."

[joewein]

The most important header line in Yahoo is the last line starting with "Received: from", which should include "via HTTP".

It makes it possible to trace the sender to an Internet Service Provider (ISP) and usually indicates the country the email was really sent from.

Example:
Received: from [41.207.162.5] by web45208.mail.sp1.yahoo.com
via HTTP; Sat, 28 Jul 2007 07:49:17 PDT
Date: Sat, 28 Jul 2007 07:49:17 -0700 (PDT)
From: frank allen <frank_allen01@yahoo.com>
Reply-To: fank_allen@dr.com
Subject: {Spam?} I need your help in this transaction


Copy the IP address inside the square brackets, go to http://www.domaintools.com/ and search for this or simply add it to the http://www.domaintools.com/ URL like this:

http://www.domaintools.com/41.207.162.5

In this case you get a reply that indicates the email was sent from Togo in West Africa.

[ant958]

Thanks

How can I get those same headers from outlook 2003?

[Rob]

here is an explanation: http://www.msexchange.org/articles/Outlook-Internet-Headers.html

[ant958]

Thanks

[ant958]

Where can I checkout an email address to see if associated with fraud?

thanks
This is the address:
newlyborn02467@yahoo.com

[Rob]

www.urgentmessage.org is a database of scam-emails where you can search (besides the internet search engines).
Very often, you can get better results by entering more informations, such as scammer names, domain-names, etc.It also helps often if you add "scam or "fraud" in the internet-search.

We may be able to help ypu if you could tell us something about the content of the emails that were sent with this email-address.

[ant958]

The emails were short indicating a desire to chat.

I made first contact.

The subject from norway, but the classical "I am in Ghana" now set off every single alarm in my memory.

The photo of a very attractive white female with no obvious connection with west africa. As of yet no requests for money.

One interesting note: A photo of hers has a coaxial plate and US outlet on the wall.

Of course I asked where the photo was taken, and she indicated her room there.

I do not think Ghana uses 110V as in the US.

just a casual observation.

thanks

[Rob]

Yes, you're correct. These photos are copied from the web. The attractive female is most likely a hairy, ugly scammer from west-africa who pretends to be a beauty queen.

[Frazzle]

Where can I checkout an email address to see if associated with fraud?

You can check it out at www.scamomatic.com. But scammers typically change email addresses every couple of weeks, so it's possible that it isn't there.

You can also check out the content of an email by pasting it into the form at scamomatic. Or you can click on the "Scam Checker" link in the Main Menu on this site.

[firedragon]

we use Bigpond - how do we read their headers? :dunno: :confused:

[FW Admin]

You may find this page on BigPond's site useful:

How to Read Email Headers (https://bigpond.custhelp.com/cgi-bin/bigpond.cfg/php/enduser/std_adp.php?p_faqid=9107&p_sid=9SOmwESi&p_lva=12076&p_page=1)

[firedragon]

thank you for the link - we are still learning.........

appreciated! :):oops:

[tweety2005]

41.219.226.84

I would like to know if this is a legitimate domain...

Tweety

[Sarah]

Which site are you asing about? An IP address often has many sites on it.

[poirot]

41.219.226.84 is from Nigeria. However to know if it's legitimate or not, you should post the email address and the content of the message in question.

The fact that you are inquiring about a Nigerian I.P. address on an anti-fraud site indicates you have doubts. Any doubtful emails from Nigeria that I have been asked about where scams. No a single one was legitimate. So it's likely a scam.