Date:         Thu, 21 Aug 2003 07:46:01 -0400
Reply-To:     vanagon@BILL-COLLINS.NET
Sender:       Vanagon Mailing List <vanagon@gerry.vanagon.com>
From:         Bill Collins <vanagon@BILL-COLLINS.NET>
Subject:      Re: eBay e-mail header: is this guy out to scam me?
Comments: To: andrew.grebneff@STONEBOW.OTAGO.AC.NZ
In-Reply-To:  <a05210603bb698bae1106@[203.167.170.58]>
Content-Type: text/plain; charset=iso-8859-1

> The bit I wonder about the first message is this:
>
> X-Spam-Status: No, hits=4.9 required=5.0
>         tests=FORGED_YAHOO_RCVD,FROM_ENDS_IN_NUMS,MSG_ID_ADDED_BY_MTA_3,
>               NO_REAL_NAME,Q_FOR_SELLER
>         version=2.55
>
> Does the FORGED bit above mean that the sender's address has been
> altered of faked?

Yes it has been faked, but not in the way you suspect.  He sent the mail
via ebay's forwarding system that fakes the header to make it look like
the mail came from him instead of ebay.

>This is a private response to an eBay bid, offering me
> the same item cheaper;

That's a violation of ebay's rules (but not uncommon)


> I even wondered if both messages are from the same person. ASAP is not
> an acronym I'd use every day...

Lots of people do use ASAP.


Even though I disagree with some of your reasons to question this, there's
something about these offers that don't pass the "smell" test for me.  I
wouldn't risk it unless its a really good deal and you can pay in a way
that gives you some recourse if something goes wrong.

Bill