2009-07-23

A Test for Rental Scams

I'm looking for an apartment, and I seem to get an awful lot of e-mails from people that have beautiful apartments for low, low prices but for whatever reason they won't show me the places. Or they say they'll meet me and when I show up a confused woman answers the door and says, "No, there is no apartment for rent here."

Today I'm going to describe to you how you can check if you are being scammed. Go into your email client and turn on all of the headers (in Thunderbird, this is View->Headers->All). You'll see a giant chain of "received" headers that look like:

Received: from [216.252.122.218] by n75.bullet.mail.sp1.yahoo.com with NNFMP;
22 Jul 2009 20:09:46 -0000
Received: from [67.195.9.83] by t3.bullet.sp1.yahoo.com with NNFMP;
22 Jul 2009 20:09:46 -0000
Received: from [67.195.9.105] by t3.bullet.mail.gq1.yahoo.com with NNFMP;
22 Jul 2009 20:09:46 -0000
Received: from [127.0.0.1] by omp109.mail.gq1.yahoo.com with NNFMP;
22 Jul 2009 20:09:46 -0000

At one end of these headers will be your e-mail provider, while at the other end will be the IP address of the computer that sent the email address:

Received: from SRV502.tudelft.net ([131.180.4.18]) by ...
...
...
...
Received: from [41.205.182.125] by web111904.mail.gq1.yahoo.com via HTTP;
Wed, 22 Jul 2009 13:09:45 PDT

Sometimes the address of the originating computer is listed a bit differently:

Received: from BLU116-W26 ([65.55.116.72]) by ...
X-Originating-IP: [62.173.35.6]

The person might have masked the IP of their computer, but this is complicated and most scammers are idiots. Anyways, you can take this IP to a handy geolocation look-up service and find out the originating location.

IP: 41.205.182.125
Host: dial-pool07.ab.starcomms.net
Country: Nigeria

Every now and then the country won't be listed, but the host name you get back has information you can use to determine the country. For example, 62.173.35.6 resolves to 35-6.rv.ipnxtelecoms.com but the geolocation service doesn't give a country for this IP. ipNX Telecom has its headquarters in...Lagos, Nigeria.

I suppose in the future I'll have to screen any email about apartments. Sometimes I really hate people.

EDIT: Your email client actually uses the same method I describe above to label some emails as being probable scams. Usually IP blocks assigned to certain ISPs and sometimes even entire countries are labeled as suspect.

4 comments:

Jenn said...

hey look, blog posts!
you're inspiring.

And here I thought, when you said that the apartment hunting was filled with scams, that it was unlikely. Wow. Jerks! At least you're on to them...

oogRobot said...

Three of the four scam e-mails I received were from craigslist. One was from an English-speaking apartment site for ex-pats. Another reason to be wary of craigslist - I assume the scammers take advantage of people who want to move over here without being able to visit.

alison said...

Did I send you the link to It's Lovely I'll Take It yet? Might make you feel better about apartment hunting finds.

oogRobot said...

I have to admit that there were no comfy-chairs-near-toilet apartments...though in the category of bathroom humor I think the apartments with shelf toilets come in a close second.