Dodgy emails re classifieds

[Scooty100]

Anyone else had one of these ?

Update Fri 21st Aug 2015
We've recently noticed unusual activity in your PistonHeads account : Singing in from your iPhone , iPad , Samsung Tablet or Unknown Wireless Device.

Once you Log-In again, you will be provided with steps to restore your account access. We appreciate your understanding as we work to ensure account safety.

https://www.pistonheads.com/update-account/billing...


Note: If you disregard this notification your live advert will be removed within 24 hours.

When you submit your transaction for processing by WorldPay you confirm your acceptance of WorldPay's shopper privacy policy, a copy of which can be viewed at: http://www.worldpay.com/shopper/privacy/


This message was brought to you by PistonHeads .

© Haymarket Media Group Ltd, 174 Hammersmith Road, London, W6 7JP
Registered in England No. 267189

To unsubscribe from future PistonHeads emails, click here and change your marketing preferences in your account details.
Haymarket Media Group Ltd is a member of the Direct Marketing Association and registered under the Data Protection Act 1998. For more information on how we process your personal information please read our privacy policy.

Buying a used car without an HPI Check is a massive risk. According to

[GTRene]

yep, me...
just in, yesterday someone responded to my car ad with a very strange email...
so I kept it also a bit cryptic knowing that when I send a mail back they got my email and can do things with such.

so today I got a email from 'pistonheads' all looked normal, there ia also 1 real pistonheads mail in it,but that only in the small letters down in the mail, they copied it I guess.
All other links when you hoover your mouse over it, says tinyurl.com and some more, so I was very sceptic and ofcourse did not answer or click on those links, only hoovered over those...its a phisingmail or how you call those, I make a prtScrm of it.

so, see>>>

[GTRene]

IP idress in the united states? I deleted my email from it, hope that is enough, I'm not a PC nerd
here are the details from that mail.

said:

x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensxNRGNyaWNyfLsirKg7EBrdnZLrK5g42kCZ0OeeIYD973Ge7ytu939/ZhBcYCjMQMQvdPU44AdrLhqDzXD+8Hyfq2Z1Cpabkswb9x/FvbHAs=
Authentication-Results: hotmail.com; spf=permerror (sender IP is 209.86.89.65) smtp.mailfrom=[e-mail]; dkim=none header.d=pistonheads.com; x-hmca=none header.id=[e-mail]
X-SID-PRA: [e-mail]
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vRd0IOwuxii4gogRGV1IFDtKoK6dfnmUVqsU0OtPQoKY52CydoZFkQhU1nysd5ccH8nyg7E9GtdLdRYnaVvMqgdWAw5zPBsYcxgZa6OQJWZ2Wl//cXigxJTlXo5YBv9KjxRFxR2nQTubt/J7tM0QQF1MsnZ9Rfo8mHCzG6BaCFoPTUX3memX7D9dv+n66ZOhXm02ro0YVwgqIG21WnKGZn8FLml+dDDiZDNv1EDwmaGPw==
Received: from elasmtp-kukur.atl.sa.earthlink.net ([209.86.89.65]) by SNT004-MC1F56.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
Fri, 21 Aug 2015 10:43:26 -0700
Received: from [81.133.216.151] (helo=Ult-PC)
by elasmtp-kukur.atl.sa.earthlink.net with esmtpsa (TLSv1:AES256-SHA:256)
(Exim 4.67)
(envelope-from <[e-mail]>)
id 1ZSqKb-00016c-Fy
for xxxxxxxxxxxxxxxxxxxxxx; Fri, 21 Aug 2015 13:42:22 -0400
From: "adverts" <[e-mail]>
Subject: Re: PistonHeads: Your PistonHeads Account has been reviewed.
To: xxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: multipart/alternative; boundary="eRqpAdyzF9I55Vu=_ny7YP5l7FvZn2nZBG"
MIME-Version: 1.0
Reply-To: [e-mail]
Date: Fri, 21 Aug 2015 11:42:19 -0600
Message-Id: <201508211142196594870E4C$150CC73DBD@ULTPC>
X-ELNK-Trace: 46b389b63a8224bf9b03eeef827898b14d2b10475b5711202ba207de90a3050d96eb2cd33c92305922082545f654dbb8350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 81.133.216.151
Return-Path: [e-mail]
X-OriginalArrivalTime: 21 Aug 2015 17:43:26.0236 (UTC) FILETIME=[E20A75C0:01D0DC38]

that sender IP is 209.86.89.65 came out here?

http://209.86.89.65.ipaddress.com/

Edited by GTRene on Friday 21st August 21:27

[Richie200]

I received this the other day. I didn't respond as it looks somewhat dodgy to me. Anyone here know if this is a scam. I currently have the car in question for sale but the email just doesn't seem right to me???

[m33ufo]

Richie200 said:

I received this the other day. I didn't respond as it looks somewhat dodgy to me. Anyone here know if this is a scam. I currently have the car in question for sale but the email just doesn't seem right to me???

I had the exact same one. Not for your car of course!

[GTRene]

Richie200 said:

I received this the other day. I didn't respond as it looks somewhat dodgy to me. Anyone here know if this is a scam. I currently have the car in question for sale but the email just doesn't seem right to me???

mine used also almost the same email, see [e-mail]

more and more it indeed looks like a scam, glad I did not react further or clicked on those links.

next time I get a mail from someone interested I sent a mail back (if I remember :-)) with another mailbox then the one that is connected with PH that way if, I get then a mail back from the scammer from 'PH" by that mailbox, I know it must be a scam, because I only can come by one email account that is linked with PH so if then such scam PH mail comes in the other mailbox which with I reacted to someone say the day before, I know its a scam for sure.

edit, hm, that IP address which was in the US could be gmail...because it was send by gmail and so their IP address? hm...not that easy as I thought
anyways, use another email then the one that is connected with PH if you then get the PH scam mail their, you know who's the scammer.

Edited by GTRene on Sunday 23 August 18:58

[gowmonster]

scammier than a scammy thing, they are using an open relay to phish.

don't click on any links in it, and certainly don't put your username/password in or you will very quickly be advertising cars and have your email address changed to email them when people reply to the adverts.

[GT3cs]

I have exactly the same wording on email for my car ....... But from a more normal email address which I googled before responding and found the guy on linked in . I replied , we discussed a bit more , didn't agree on a price and that was that .

If it's a scam I'm not quite sure what ?

When you respond to an advert does PH not give you the option to just send some standard wording ? Ie I'm interested in your porsche etc ?

[GTRene]

GT3cs said:

I have exactly the same wording on email for my car ....... But from a more normal email address which I googled before responding and found the guy on linked in . I replied , we discussed a bit more , didn't agree on a price and that was that .

If it's a scam I'm not quite sure what ?

When you respond to an advert does PH not give you the option to just send some standard wording ? Ie I'm interested in your porsche etc ?

but when you hoover with your mouse over the react links, what says them, I mean pistonheads or tinyurl or something?

[GT3cs]

On an iPad so can't hover over it ?

[GT3cs]

Links in email all connect back to PH ?

Wording is identical to above though , just different model . Very strange .

[GTRene]

GT3cs said:

On an iPad so can't hover over it ?

don't know how it works on a I-pad, I'm already glad that I can do some stuff on a desctop PC

but I guess there is a way to see whats the link really says, I guess with google you could find such, but
when it says something like this tinyurl.com/xxxxx and something, its not from pistonheads me thinks.

there is however also one real pistonheads link in those email scams, when you hoover over that it is pistonheads,
but there are also some false pistonhead links that look like them, but just are a little bit different.

But I'm telling the above whats in the second mail is, the first one is real, but a scammer, he then uses the email you gave him a answer with for the scam pistonheads mail, I make a screen copy from that and will post.

Edited by GTRene on Monday 24th August 18:15

[GTRene]

edit...I already deleted that second scam email...hm, sorry, I was to afraid that I would make a mistake by pressing on such false link.