Thomas Muir stuck in Africa?

[Nick Baty]

Removed

[The original poster has removed his posts to this topic - Musicus, moderator]

[quaeritor]

Me too - I think you've been hacked, Thomas - I got two copies to two of my (rather many) email addresses. I'll PM you with a bit more background. (I can't believe you'd ask for a "favor"!)

Q

[Hare]

I've had a similar email too!

[docmattc]

I'll join the list too (email from 'Thomas', not Nick's nun!)

Thomas last posted to the forum on Saturday lunchtime, I suspect not from Africa (which is for more vague a location than Thomas would ever supply, even if his grammar, spelling and literary style had suddenly taken this turn for the worse)

The email is also suspicious in having no "To:" field

Still, if we all send him 850 quid he's going to be a rich man!

[dunstan]

Does anybody have a phone number for him? His account has clearly been compromised (yes, I had one too) and he needs to reclaim it pronto.

[docmattc]

Does anybody have a phone number for him? His account has clearly been compromised (yes, I had one too) and he needs to reclaim it pronto.

I believe a phone message has been left for him.

[Hare]

I've had a similar email too!

from my Viagra-selling nun?

No - Thomas!

(unless - no!! )

[gwyn]

Same here.

Did I mention that I too am stuck in Africa, so any spare funds...

[quaeritor]

Didn't this happen to someone slightly more famous (sorry, Thomas) recently - Jack Straw perhaps? - perhaps this is a sort of double scam? I noticed that the reply address (check the "message source") is actually genuinely Thomas's as posted in another thread (unwisely?) so any "Reply" would go to him and not the hacker.

Curious, that.

Q

[Dot]

Thomas has been on the phone to me. A hacker has changed his password. He is at his mother's at present. I have sent a message to report the abuse, and he is trying to get the account closed down. If anyone can offer more informed help, I can give you his current phone no. I think further speculation on this thread may be futile....

Dot

[presbyter]

The details

From: t.e.muir@hotmail.co.uk
Subject: Hello
Date: 30 March 2009 11:30:55 BST
Return-Path: <t.e.muir@hotmail.co.uk>
Return-Path: t.e.muir@hotmail.co.uk
Delivered-To:
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ZandOs-admin
X-Spam-Level:
X-Spam-Status: No, score=-1.3 required=4.0 tests=BAYES_00,HTML_MESSAGE, MISSING_HEADERS autolearn=no version=3.2.5
Received: (qmail 7955 invoked from network); 30 Mar 2009 11:36:00 +0100
Received: from bay0-omc1-s35.bay0.hotmail.com (65.54.246.107) by 80.82.118.16 with SMTP; 30 Mar 2009 11:36:00 +0100
Received: from BAY108-W3 ([65.54.162.103]) by bay0-omc1-s35.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 30 Mar 2009 03:30:55 -0700
Message-Id: <BAY108-W3529CA855B6E66828FCA4808D0@phx.gbl>
Content-Type: multipart/alternative; boundary="_a4f4a663-dcf8-4edb-9400-e69e65f8ac4c_"
X-Originating-Ip: [41.219.193.36]
Importance: Normal
Mime-Version: 1.0
X-Originalarrivaltime: 30 Mar 2009 10:30:55.0672 (UTC) FILETIME=[9BBE6380:01C9B122]

[presbyter]

More details

OrgName: African Network Information Center
OrgID: AFRINIC
Address: 03B3 - 3rd Floor - Ebene Cyber Tower
Address: Cyber City
Address: Ebene
Address: Mauritius
City: Ebene
StateProv:
PostalCode: 0001
Country: MU

ReferralServer: whois://whois.afrinic.net

NetRange: 41.0.0.0 - 41.255.255.255
CIDR: 41.0.0.0/8
NetName: NET41
NetHandle: NET-41-0-0-0-1
Parent:
NetType: Allocated to AfriNIC
NameServer: NS1.AFRINIC.NET
NameServer: NS-SEC.RIPE.NET
NameServer: NS.LACNIC.NET
NameServer: TINNIE.ARIN.NET
Comment:
RegDate: 2005-04-12
Updated: 2005-07-12

OrgAbuseHandle: GENER11-ARIN
OrgAbuseName: Generic POC
OrgAbusePhone: +230 4666616
OrgAbuseEmail: abusepoc@afrinic.net

OrgTechHandle: GENER11-ARIN
OrgTechName: Generic POC
OrgTechPhone: +230 4666616
OrgTechEmail: abusepoc@afrinic.net

[quaeritor]

Hmmm, Presbyter - guess you're a tad more advanced than me on this kind of stuff!

Deferentially,

Q

[musicus]

Thanks, Presbyter. May I say how good it is to see you back on here?

This is a relatively well-known scam, but quite an embarrassing one. (Didn't the Home Secretary suffer this too? Oh, no... that was something else!)

If anyone can provide reliable advice as to how to prevent or (God forbid) deal with this scam, please post it here. I believe that that would be a useful service to our readers.

[dmu3tem]

Dear All,

Many thanks for the messages. Yes, I have been a victim of a fraud and someone has stolen my e.mail account. What is more the person has changed the settings so that I cannot get into the account to wipe out everything and close it down. The vital thing then is not to respond to any e.mails purporting to come from t.e.muir@hotmail.co.uk as this merely puts you in touch with the fraudster.

I have telephoned everyone I can think of to warn them of this; but there may be gaps; so many thanks for posting this up for me.

Thomas (Muir)