A friend was recently looking for a used iPhone so we decided to browse the local craigslist. After some searching we saw an amazingly good deal (first red flag? :)) that included both an iPhone and iPod Touch from what seemed like a good seller. We decided to follow-up, but it wasn’t until 1am that we sent the contact email. Next day we got the following reply back…
sorry I sold them.. but I ordered them from suppliers I found from WEBSITE_REMOVED .. they have much cheaper prices than amazon.com
sorry again I hope I could have been of some help
Sent from my iPhone.
I have removed the website URL (WEBSITE_REMOVED) because I don’t want to promote it any further 🙂 I was amused by this reply because it was sent around 3am (two hours after our inquiry) and it sounded a bit too much like an advertisement. Also, I get many emails from friends that have iPhones (some of whom have decided to keep that signature!) and that last line didn’t look right. So, I decided to look further into it. The obvious things to check were the email headers to see if they had any signs of an iPhone. Before I looked at the headers for the reply I checked out the headers from a genuine reply. The most obvious sign was the X-Mailer header.
X-Mailer: iPhone Mail (7A400)
Then I looked at this header in the reply from “steve,” and guess what I found.
X-Mailer: Chilkat Software Inc (http://www.chilkatsoft.com)
A quick look at that site and I found out that Chilkat Software makes .NET libraries. Well, that, along with the bogus “Sent from my iPhone.” proves that this is definitely a scam. Another evidence is the peculiar timing of the reply (within 2 hours, at 3 in the morning!), but that can’t be used to prove 🙂 Also, it was the period at the end that isn’t part of the stock “Sent from my XYZ Device” message, subtle but noticeable.