Is this another Craigslist scam?

Hi All,

I'd love some help in determining if this is a scam.

Here is the first email I was sent:
From: Janice Reynolds <[email protected]>
Subject: Macbook Pro 15" w/ Snow Leopard - $800 (*)
Date: November 8, 2009 3:04:07 AM PST
To: [email protected]
Delivered-To: *@gmail.com
Received: by 10.90.99.11 with SMTP id w11cs54984agb; Sun, 8 Nov 2009 03:04:08 -0800 (PST)
Received: by 10.114.68.14 with SMTP id q14mr10943456waa.103.1257678248190; Sun, 08 Nov 2009 03:04:08 -0800 (PST)
Received: from mxo6p.craigslist.org (mxo6p.craigslist.org [208.82.236.171]) by mx.google.com with ESMTP id 27si3935094pzk.111.2009.11.08.03.04.07; Sun, 08 Nov 2009 03:04:08 -0800 (PST)
Received: from mail-pw0-f84.google.com (mail-pw0-f84.google.com [209.85.160.84]) by mxi5p.craigslist.org (Postfix) with ESMTP id 63C8D5D38B for <[email protected]>; Sun, 8 Nov 2009 03:04:07 -0800 (PST)
Received: by pwj2 with SMTP id 2so376230pwj.13 for <[email protected]>; Sun, 08 Nov 2009 03:04:07 -0800 (PST)
Received: by 10.143.25.9 with SMTP id c9mr698964wfj.7.1257678247108; Sun, 08 Nov 2009 03:04:07 -0800 (PST)
Return-Path: <bounce-anon-*[email protected]>
Received-Spf: pass (google.com: domain of bounce-anon-*[email protected] designates 208.82.236.171 as permitted sender) client-ip=208.82.236.171;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce-anon-*[email protected] designates 208.82.236.171 as permitted sender) smtp.mail=bounce-anon-*[email protected]; dkim=neutral (body hash did not verify) [email protected]
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=bSIqcxkL8ZHKWRGcnxP1iDSLEE88JugxRKaTDFDCytY=; b=cUFWNdspZY5mNUStM4WrgLdAy+Iggr6yy8jOzbDAOqOFWAgq2NRTHcP2bIX3NymGM2 rSqOcmwUjNHmaGjoVOPaiFHB5d7/4wd03OHQQflm1HA5EudDmiMx562xB7f8pipVNjGH LaK8a98y44N66QS/0LXFEyjjDV9HO6dwXKZFY=
Domainkey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=CpIeYC6yFt4p9vj1TEoY5T6nEkhRzQ2znK5GRYXlJtWMvIq5wo4H6dCUUuqvmR0AjH kGwCVtiocTgTJ0gLBMTtqnAXw3VduWcrgGSezNyXn0I7236IZ7sYONuO/taPEjUennp5 zGQfT0akxOmN9g59x1KHJjFfreMtgz1r9ZU10=
Mime-Version: 1.0
Message-Id: <[email protected]>
Content-Type: multipart/alternative; boundary=001636e1f73e2922d90477da09eb

* CRAIGSLIST ADVISORY --- AVOID SCAMS BY DEALING LOCALLY
** Avoid: wiring money, cross-border deals, work-at-home
** Beware: cashier checks, money orders, escrow, shipping
** More Info: http://www.craigslist.org/about/scams.html




--
Do you still have it for sale,is it in good working condition and how much do you really want to sell it?

this message was remailed to you via: [email protected]


--------------------------------------------------------------------------------------------


Here is the second email I got:

From: Janice Reynolds <[email protected]>
Subject: Re: Macbook Pro 15" w/ Snow Leopard - $800 (*)
Date: November 8, 2009 12:13:59 PM PST
To: * <*@gmail.com>
Delivered-To: *@gmail.com
Received: by 10.90.99.11 with SMTP id w11cs74564agb; Sun, 8 Nov 2009 12:14:01 -0800 (PST)
Received: by 10.114.45.13 with SMTP id s13mr12060187was.167.1257711240973; Sun, 08 Nov 2009 12:14:00 -0800 (PST)
Received: from mail-pz0-f131.google.com (mail-pz0-f131.google.com [209.85.222.131]) by mx.google.com with ESMTP id 35si4958505pzk.128.2009.11.08.12.13.59; Sun, 08 Nov 2009 12:13:59 -0800 (PST)
Received: by mail-pz0-f131.google.com with SMTP id 37so298424pzk.10 for <*@gmail.com>; Sun, 08 Nov 2009 12:13:59 -0800 (PST)
Received: from mr.google.com ([10.142.3.3]) by 10.142.3.3 with SMTP id 3mr756089wfc.141.1257711239184 (num_hops = 1); Sun, 08 Nov 2009 12:13:59 -0800 (PST)
Received: by 10.142.3.3 with SMTP id 3mr756089wfc.141.1257711239179; Sun, 08 Nov 2009 12:13:59 -0800 (PST)
Return-Path: <[email protected]>
Return-Path: <[email protected]>
Received-Spf: pass (google.com: domain of [email protected] designates 209.85.222.131 as permitted sender) client-ip=209.85.222.131;
Received-Spf: pass (google.com: domain of [email protected] designates 10.142.3.3 as permitted sender) client-ip=10.142.3.3;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 209.85.222.131 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received-spf:received:dkim-signature :domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=vbX6LUX9XiVPXR6K8ZdUBpRzKvZGLkGqnGoWvdr+BxM=; b=cYaUEqpsCAqTeFvWXAGxVX3F3WDWZi+A84ykmZiYe4FmwOpFUn5qV+gpj9hiZksXPH imEoLscNJvDuU0VBuGriQ8Nb5dJKzLiQjnfaSE/CCVSaKg8byh0GYv3tMwMqhtdyawK0 gZJq/lLItsTPZjq+OorXfUR7nVWSoy1i2BMuA=
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=vbX6LUX9XiVPXR6K8ZdUBpRzKvZGLkGqnGoWvdr+BxM=; b=tne8v3N1/YImc8dAR93MpSenPMBhcnWa1yxHDBGwH60fv93DD0sT/ycZwO30US3sIZ VMMjWYCUDRCqMUUNyT33oNTt4eZzrx2Jfzqt2rGBao1GWH9haaFtKd3EE67jF6QOO9Az KmjhnvfmRayFGUwenmhC6Fge9F46eiGZ92l2o=
Domainkey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=received-spf:authentication-results:dkim-signature :domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type; b=MNwZ8BYGHUCWrju6ccbdL+N+Nhrxy6RORU4e4v97lGNLF5E8Y25G9hleAXNNCqDV4Q nFlMkdvV52JPq1zbRNBNaM6qGFowEy4Hm+PFAltH1/o9BgtwjbMygyGsfYdPQqktYN66 Xja4votsv+eBg2a7smMknYmhrql2gkmZLT0IE=
Domainkey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=DsASMw9reCwldgnAANmsAR+4/eCcOVOWxIQCIa2R0NWIWPk92bhYiUyN7qtU2GpASx qsFwuRquFvn8K+kQuzI8n6MCVU2v0oWzwtiNjUYEl0fWL3QteXC4/r+24UVpnkQU6lsc kku7v+/qAzTF/4hg5C7jULrzg1AOeFrAW/r4g=
Mime-Version: 1.0
In-Reply-To: <[email protected]>
References: <[email protected]> <[email protected]>
Message-Id: <[email protected]>
Content-Type: multipart/alternative; boundary=0016368e2704a42f390477e1b756

I really appreciate your response.I am located in South Jersey,NJ.
I really need to buy this and send to my
son schooling outside the state.I have been trying to
buy this on ebay but its so very stressful buying on ebay.I would not
want to loose out this opportunity so i will like to make you an offer
of $830 so as to wrap up the sale.I will be paying through PAYPAL
because i have a verified account with paypal.So
kindly get back with your paypal email address so i can make payment
into your paypal account.Once payment clears,shipment will be handled
by me through my personal fedex account,so you dont have to pay for
shipment.Get back to me if my approval is granted.I would like to see more
pictures please.
Kindest Regards


--------------------------------------------------------------------------------------------

Thanks for the help.

Hi Jbaranick

Welcome to Scamwarners.

It certainly does look like a scam, in this case they are trying to get you to send your item to them without actually paying for it.

This sticky will describe the scam very well viewtopic.php?f=6&t=3567

I have done a search on a small portion of the text in that second email and can confirm that yes, it is definately a scam Click Here to see the search result

If you have any other questions, please feel free to ask.

So I realize this post is several years old. But the same ol' folks are still scamming a lot of people. I just lost about $600 USD by not paying attention.

The first clue is the horrible english the sender (from New Jersey??) sent. Although it happens... some people can't spell.

What's MORE important is where this email came from:

From: Janice Reynolds <[email protected]>
Subject: Re: Macbook Pro 15" w/ Snow Leopard - $800 (*)
Date: November 8, 2009 12:13:59 PM PST
To: * <*@gmail.com>
Delivered-To: *@gmail.com
Received: by 10.90.99.11 with SMTP id w11cs74564agb; Sun, 8 Nov 2009 12:14:01 -0800 (PST)
Received: by 10.114.45.13 with SMTP id s13mr12060187was.167.1257711240973; Sun, 08 Nov 2009 12:14:00 -0800 (PST)
Received: from mail-pz0-f131.google.com (mail-pz0-f131.google.com [209.85.222.131]) by mx.google.com with ESMTP id 35si4958505pzk.128.2009.11.08.12.13.59; Sun, 08 Nov 2009 12:13:59 -0800 (PST)
Received: by mail-pz0-f131.google.com with SMTP id 37so298424pzk.10 for <*@gmail.com>; Sun, 08 Nov 2009 12:13:59 -0800 (PST)
Received: from mr.google.com ([10.142.3.3]) by 10.142.3.3 with SMTP id 3mr756089wfc.141.1257711239184 (num_hops = 1); Sun, 08 Nov 2009 12:13:59 -0800 (PST)
Received: by 10.142.3.3 with SMTP id 3mr756089wfc.141.1257711239179; Sun, 08 Nov 2009 12:13:59 -0800 (PST)
Return-Path: <[email protected]>
Return-Path: <[email protected]>
<blah blah>

What's relavent here is the Received: from mr.google.com (forged) ([10.142.3.3]) ... etc

Doing a conventional IP lookup is of no help. You get something like this back:
IP Address: 10.142.3.3
Country: Private
Country Flag:
Updated: Jan. 4, 2012

That's because the IP address is part of a block of IP addresses in Nigeria.

Seriously.

http://www.ip-adress.com/map/Map/201f16 ... af18707fa1
(you have to zoom out a little to see the map)

So... if you have business with folks in Nigeria, go for it. But if you're looking to buy a laptop, book travel or make $65million from an inheritance.... be warned. Folks in Nigeria don't often give you your money back.

-ben

10.*.*.* is not in Nigeria. It is in a local-area network. Gmail, if accessed through the web, hides the IP address of the sender, so if a Gmail user sends to another Gmail user, there's no way to tell from the headers where either of them is.

Sorry you got scammed, but glad you found us!