scam - 74.82.24.121

[happygirl65]

I have been talking with a guy who is supposed to be in Iraq,and when I check his ip address its all in Sunnyvale California,is that a automatic scam.
ip address 67.195.160.76
68.142.207.115
67.195.168.31
74.82.24.121
209.131.36.158
216.55.165.32
When i questioned him about it before he said that the army re rooted his address for national security .thanks hope someone can help

 

[EQ Admin]

Re: scam

Hello,

Can you post the full email headers from an email they sent you?

Yahoo + Yahoo Classic Directions - http://www.emailquestions.com/full-email-headers/163-yahoo-mail.html

The new Yahoo Mail Beta directions - http://www.emailquestions.com/full-email-headers/2632-yahoo-mail-beta.html

The full email headers will help us figure out part of the story.

The IP addresses you mentioned look like Yahoo IP addresses and some other ISP's.

They do not appear to be the IP address(es) of their computer. I think you are looking at the wrong IP's in the headers.

What is your gut instinct? Generally if everything seems OK it probably is, but if your gut thinks something is wrong then that's likely to be true too. Does what they say make sense? Do they tend to contradict themselves or give you facts that can't be true / are misleading / are half truths? Have they asked you for money or information more personal that what they are willing to tell you?

to Email Questions!

 

[EQ Admin]

Re: scam

Yahoo's registered location is Sunnyvale, CA.

Registrant:
Domain Administrator
Yahoo! Inc.
701 First Avenue
Sunnyvale CA 94089
US
domainadmin@yahoo-inc.com +1.4083493300 Fax: +1.4083493301

I think posting the full email headers would be best so we can help you read them.

 

[happygirl65]

Re: scam

From Paul Kelly Wed Jul 21 12:03:15 2010
X-Apparently-To: morag_mcleod65@yahoo.co.uk via 212.82.110.230; Wed, 21 Jul 2010 12:03:17 +0000
Return-Path: <p_kel70@yahoo.com>
X-YMailISG: ._.EYg4WLDskZVNDVl.t8DMXiBF3181lXEgM4By5xeI6BCx4
85haa.DE4DrCpx6uKnJFYbqeAKJN5GmcnqHeuUvi8uIimWhk59YV_xTF9gdS
.QfdnwSCP.e_V7ZEP9yhQjhuHPPrBS2P6DQS2jU8hqkkwNulGeQTaqGl2fXd
I7aKhyUWbxwHr8eYN3PcFz5cDgknBxCN7cdoBkPbclkmnkbPfF1gwXnEZQ4J
4HZQkMDOebcCpWT8AyGMjP2ajnpb_0Wh0iOzRkaLmAoVQKv4BeB0MIiV.4YF
197V_L1fuxf87owgRNxYWg6vJXOBm9uwFXbL6OvqzwJIEol00Dv5U3E_lX.S
iUUCTu14J_vwAkYybSIibh0X2gQj2xCvsKBHoERmHaHVkmXRUyBsGSET3pWb
L2CQs5kXKGXYNlOwjDF8XTmk.gn7.veXV1EoPDgnmHfBylxKry6Gb8rooI7A
nOVhMPddyNRbS0Ym.72iL0M8U3ua_uoRQe_EUn57UFzgsoVY4k_cvGh6cfdJ
rr_DeeiR6jBwxYKyUkPdVFh9kn.E4YiGa6xjvNlXpnIpM_uqx6wbRsLHfwQF
8DZHrLGpAJg0zjxHPCuvK3Nx0cGnucKevzj_kpmrTxRb6.bCkgMAKa1vLOHs
O2h7.1tIbquZy_s6Il.YIWR7DkRxcYbuO4tSJ5XGQYNswi0jPH8vQtr0UG6g
5ouZhFYHA6AW4CeBKSQDAs9eoNWwxrlmvVZhi6vtHQ3eVH34bi0TZwnNX33Y
QkT.PLuCsulrH.HxAmSgLK7BbcVoWu58jGIbUt1P6VvFMm3jx1cFjemmAm5P
RaEx23SGFh2VxThTGxZ8YUXm2eyqOlvDXv8F8lDr5ryoEQs4_bYbKJ50.baf
7PzBFj9NO2vS8PcQl4evzLMzriFOmA1.Vv49kH0lDij5loUvp5Cl16eInAAZ
jGaBu5fYML7szkfgWYzd3JIV_HROx7Hy16QaXZg35Oqjh37_8yVps5Hjg9Hx
X-Originating-IP: [68.142.207.115]
Authentication-Results: mta1032.mail.ird.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO web32101.mail.mud.yahoo.com) (68.142.207.115)
by mta1032.mail.ird.yahoo.com with SMTP; Wed, 21 Jul 2010 12:03:17 +0000
Received: (qmail 50601 invoked by uid 60001); 21 Jul 2010 12:03:15 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1279713795; bh=Djbyk4EiCd/Kh/t11MbhLtJt2OGg+7saamVagbemsiQ=; h=Message-ID:X-YMail-OSG:Received:X-Mailerate:From:Subject:To:MIME-Version:Content-Type; b=UUvu8k9x897sNcA9JEPAS81nd3LPvyXk9LJuDChtIrd4Ud2rMa94HLVoZAcA6vB3s5XSAc+ltGzm558mu/Frh7E/nEQHdw+BLkojUO7cKFdoXE/kZrFDrQJh8hRNK34HHftzGC1TRblvIMoCxz1Bo321iZPZnBYSqr4dnS29h6A=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailerate:From:Subject:To:MIME-Version:Content-Type;
b=QoS6i9JIh5A68IR6f4ZH9aqfTE2IUwGNdD61NERxDzqArrhxGUN2HKq5XyW7xNLMVw4EXIjKQ93WaN9jSEbYxIz4ID6lBH9SjmACHHc6PlDqWq0K/RxvuXmawlWiyXF/AfercOrAryqNbqTkwcKPOuzFkydUGqM55P6ieRnqBzo=;
Message-ID: <323850.49798.qm@web32101.mail.mud.yahoo.com>
X-YMail-OSG: rgz816oVM1lnAwLgOHAz0KOynqoXa3nZg7pclnNkxGG8VCE
ra2KxQNkxFwcEe_fuHODM1Rh8wQmA8lT1vUn3lca96B.rsEIoSv0bubC7auZ
ByZYsmKh2I3bLG3eAEsc4IdIJ_zhVbLBDaCq_76AihH6ZuGhyhILRm0HEeDC
pEH8NFN9JVo9ncb_Au5Cy1WaLRfYcU2AwCjpMX9RiLS3BZ1WCkDp8nb89vBl
8wI6FyAGBD7Vbq33rFwDV1lylfm0vaQWIhh7lF7zMRbKV5nmYyGoR
Received: from [74.82.24.121] by web32101.mail.mud.yahoo.com via HTTP; Wed, 21 Jul 2010 05:03:15 PDT
X-Mailer: YahooMailClassic/11.2.4 YahooMailWebService/0.8.105.277674
Date: Wed, 21 Jul 2010 05:03:15 -0700 (PDT)
From: Paul Kelly <p_kel70@yahoo.com>
Subject: details u need
To: morag_mcleod65@yahoo.co.uk
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1795413396-1279713795=:49798"
Content-Length: 817


this is the full header thanks for your help happygirl

 

[EQ Admin]

Re: scam

Their IP address is 74.82.24.121

The IP address 74.82.24.121 does not have any reverse DNS.

It does not appear to have anything to do with the Military or U.S. Government.

Their end of a traceroute is :

10 10gigabitethernet1-1.core1.mci1.he.net (72.52.92.2) 107.059 ms 108.947 ms 106.348 ms
11 10gigabitethernet1-1.core1.den1.he.net (72.52.92.6) 110.882 ms 106.847 ms 106.620 ms
12 10gigabitethernet1-4.core1.lax2.he.net (72.52.92.38) 100.765 ms 101.122 ms 100.262 ms
13 10gigabitethernet7-3.core1.sjc2.he.net (184.105.213.5) 103.785 ms 104.046 ms 112.670 ms
14 10gigabitethernet1-1.core1.fmt1.he.net (72.52.92.109) 104.527 ms 111.449 ms 103.985 ms
15 te1-1.ve5.crr1.fmt1.egihosting.com (64.71.129.70) 104.323 ms 109.794 ms 146.029 ms
16 72.13.81.222 (72.13.81.222) 104.186 ms 104.219 ms 105.166 ms
* * *


From what I can see I would suspect that you are dealing with a scammer.

 

[EQ Admin]

I added the IP address to the subject of this discussion.

Often times someone else who is suspicious of being scammed will do a google search for the IP addresses and find this information.

They may reply and let you know that they were also contacted by the scammer.