Craigslist Ad and Email Message

Here is one of the Craigslist ads placed for the scam:

http://newyork.craigslist.org/stn/cas/1863787691.html

Latina from Staten Island - w4m

---

Date: 2010-07-26, 11:26AM EDT

---

ever had good puerto rican pussy? well now's your chance. get in touch for details

Here is a typical reply you get when you respond to the ad:

hey *****, first things first, YES im real. i need a huge favor before we meet up though. i have a term paper due for my online summer class but i dont have the time or the want to write one, so i found a term paper online to purchase. the link is below. buy it, then send me proof you bought it, then we can meet up. if your down for this, send proof ASAP. the first guy that sends proof will be my next FWB.

USA PA Paper - $45.99!

alright so basically purchase the term paper, email me the paypal receipt or the first paragraph paragraph, then we meet up somewhere public, talk for a bit, head somewhere private like my place or yours, do what i do best ;], i go home expecting the FULL term paper in my inbox, then done. if your good, then we will repeat steps 6-7. im not going to respond unless its proof. if you received this email, that means the offer still stands.

Here is another typical reply you get when you respond to the ad:

hey *****, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the paper below or proof that you have it, we can meet at a public place and then to my apartment. im a history major and i need it for my online class. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it, you`ll just get blocked. no one has pulled through yet, so let me know if your down.

The USA PA E-Book - $45.99!

alright so basically purchase the term paper, email me the paypal receipt or the first paragraph paragraph, then we meet up somewhere public, talk for a bit, head somewhere private like my place or yours, do what i do best ;], i go home expecting the FULL term paper in my inbox, then done. if your good, then we will repeat steps 6-7. im not going to respond unless its proof. if you received this email, that means the offer still stands.

Here are some message headers:

Delivered-To: *****@*****.com
Received: by 10.231.154.131 with SMTP id o3cs277222ibw;
Tue, 27 Jul 2010 21:44:04 -0700 (PDT)
Received: by 10.101.189.8 with SMTP id r8mr10892584anp.53.1280292243318;
Tue, 27 Jul 2010 21:44:03 -0700 (PDT)
Return-Path: <delayedr@serverhk.wrzhost.com>
Received: from serverhk.wrzhost.com ([91.207.192.103])
by mx.google.com with ESMTP id g29si13920081ann.159.2010.07.27.21.44.02;
Tue, 27 Jul 2010 21:44:03 -0700 (PDT)
Received-SPF: neutral (google.com: 91.207.192.103 is neither permitted nor denied by best guess record for domain of delayedr@serverhk.wrzhost.com) client-ip=91.207.192.103;
Authentication-Results: mx.google.com; spf=neutral (google.com: 91.207.192.103 is neither permitted nor denied by best guess record for domain of delayedr@serverhk.wrzhost.com) smtp.mail=delayedr@serverhk.wrzhost.com
Received: from delayedr by serverhk.wrzhost.com with local (Exim 4.69)
(envelope-from <delayedr@serverhk.wrzhost.com>)
id 1OdyUr-00066b-MK
for *****@*****.com; Wed, 28 Jul 2010 12:44:01 +0800
To: ***** <*****@*****.com>
Subject: RE: Your Personals Ad
Date: Wed, 28 Jul 2010 12:44:01 +0800
From: hotteztxcoed <hotteztxcoed@gmail.com>
Message-ID: <38440f402990cc744cf52e6edf2264e6@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_38440f402990cc744cf52e6edf2264e6"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - serverhk.wrzhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [720 717] / [47 12]
X-AntiAbuse: Sender Address Domain - serverhk.wrzhost.com

So he's using WRZHost again. Let's see if they close his account quickly this time instead of tolerating his scam for a while as they did in the past.

Oh, and here are some of the photos that are sent along with the email message. I edited out the bottom part of the second photo since it contains nudity.