[amsat-bb] Nigerian scam span purporting to be from W0SL

[Phil Karn]

Today I got a scam email purporting to be from Roy Welch, W0SL, asking 
for an emergency loan. If I got it, I suspect many others on amsat-bb 
got it too.

The originating IP address is in Nigeria. Where else?

I've seen this exact scam before. In those cases someone had stolen the 
password of the person they were pretending to be.

I don't think that happened here. The "From" address was his correct 
email account 'rdwelch at swbell.net' but the Reply-To: address was 
'rdwelclh at yahoo.com'. Note the extra 'l'.

I think the scammers created this second account on Yahoo and used it to 
send the scam email, forging Roy's address in the from field. Any reply 
would, of course, go to the scammer's address on Yahoo and many people 
might not notice the subtle change.

swbell.net has no SPF (Sender Policy Framework) records in the Domain 
Name System to indicate to the rest of the Internet which IP addresses 
may legitimately originate email from that domain, so recipient systems 
cannot easily detect forgeries.