Today I got a scam email purporting to be from Roy Welch, W0SL, asking for an emergency loan. If I got it, I suspect many others on amsat-bb got it too.
The originating IP address is in Nigeria. Where else?
I've seen this exact scam before. In those cases someone had stolen the password of the person they were pretending to be.
I don't think that happened here. The "From" address was his correct email account '[email protected]' but the Reply-To: address was '[email protected]'. Note the extra 'l'.
I think the scammers created this second account on Yahoo and used it to send the scam email, forging Roy's address in the from field. Any reply would, of course, go to the scammer's address on Yahoo and many people might not notice the subtle change.
swbell.net has no SPF (Sender Policy Framework) records in the Domain Name System to indicate to the rest of the Internet which IP addresses may legitimately originate email from that domain, so recipient systems cannot easily detect forgeries.