[email protected]

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri May 08, 2009 6:20 pm

I have been corresponding with a supposed 30 year old who had a profile on tagged.com. We have been e-mailing and YAHOO messaging for a couple weeks now.Today, I sent an e-mail asking 'a typical guy question': "So, tell me, what are your measurements?" I ask; and I got a believable response;

"hunnie i am missing u if only u know how much i love u... i will never give u on you.... i wanna be with u so make sure u let this work out fine.... i will also be here waiting for the real western union details and as well i will love u to scan the slips and send it to me..."

"my body structure is Hair: Brown Height: 5'8"
Eyes: brown Bust: 34"
Dress: 3 - 4 Waist: 25"
Shoe: 7.5 Hips: 34"
34-36 Shoe size 6,5"
i love u"

That all sounds about right. She even sent me a pic to "reference."
(I know.....it could be fake)

I looked at the message header and the last thing it said was:

Content-Type: multipart/alternative; boundary="0-1803168786-1241790994=:2716"
X-Proofpoint-Virus-Version: vendor=fsecure engine=4.65.7400:2.4.4,1.2.40,4.0.164 definitions=2009-05-08_06:2009-04-28,2009-05-08,2009-05-08 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx engine=3.1.0-0810130000 definitions=main-0905080071

The info contained under "Content-Type" doesn't necessarily mean this e-mail (and this person) is (are) legit, does it.

Posted: Fri May 08, 2009 6:26 pm

The format of those measurements sounds like they have been pulled from a site profile.

No normal woman would refer to her "body structure" or give all of those measurements. They would just say something like 5'8" 34-25-34.

Elite Baiter Joined: 15 Sep 2008 Posts: 1006

^^^^A "normal woman" wouldn't give out her measurements. Very Happy

Quote:

my body structure is Hair

I don't think I would want to see this. Confused

Posted: Fri May 08, 2009 6:31 pm

B8er wrote:

The format of those measurements sounds like they have been pulled from a site profile.

No normal woman would refer to her "body structure" or give all of those measurements. They would just say something like 5'8" 34-25-34.

Yeah, I know. I was just checking to see if anyone else had a different take on it.

THANX

Posted: Fri May 08, 2009 8:44 pm

It´s a real man´s worst nightmare to find out after very "sensitive" corresponding with a women,that in fact she is he.
There is some kind of shades of doupt in the air before.

Quote:

i am missing u if only u know how much i love u.

after this gave man´s howling,it´s quite shore it´s he... Shocked

Posted: Fri May 08, 2009 9:36 pm

Peter Pulimov wrote:

It´s a real man´s worst nightmare to find out after very "sensitive" corresponding with a women,that in fact she is he.
There is some kind of shades of doupt in the air before.

after this gave man´s howling,it´s quite shore it´s he... Shocked

WTF are you talking about? ENGLISH.....complete sentences please!

Posted: Fri May 08, 2009 9:45 pm

^^^^ Not all posters on here have English as their first language.

Posted: Fri May 08, 2009 9:48 pm

B8er wrote:

^^^^ Not all posters on here have English as their first language.

True............my apologies......lost my head.

Posted: Fri May 08, 2009 10:11 pm

removed quote of previous post -Ima

--------------------------------------------------
Can anybody "de-code" this?

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
received: from proofpoint-cluster.metrocast.net (proofpoint-cluster.metrocast.net [65.175.128.136])by mail.metrocast.net (Postfix) with ESMTP id 418895D6914for <[email protected]>; Fri, 8 May 2009 19:33:09 +0000 (GMT)
received: from n3a.bullet.mail.ac4.yahoo.com (n3a.bullet.mail.ac4.yahoo.com [76.13.13.66])by lemon.metrocast.net (8.13.8/8.13. Cool

with SMTP id n48JX58U031468for <[email protected]>; Fri, 8 May 2009 19:33:06 GMT
received: from [76.13.13.26] by n3.bullet.mail.ac4.yahoo.com with NNFMP; 08 May 2009 19:33:05 -0000
received: from [76.13.10.177] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 08 May 2009 19:33:05 -0000
received: from [127.0.0.1] by omp118.mail.ac4.yahoo.com with NNFMP; 08 May 2009 19:33:05 -0000
received: (qmail 41871 invoked by uid 60001); 8 May 2009 19:33:05 -0000
received: from [41.219.204.96] by web59608.mail.ac4.yahoo.com via HTTP; Fri, 08 May 2009 12:33:04 PDT
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Dkim-Signature: snipped to fix thread blowout
Domainkey-Signature: snipped to fix thread blowout -Ima
X-Mailer: YahooMailWebService/0.7.289.1
Date: Fri, 8 May 2009 12:33:04 -0700 (PDT)
From: Prisca Ruan <[email protected]>
Reply-To: [email protected]
Subject: Re: About Those Western Union Slips.
In-Reply-To: <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1421729903-1241811184=:41493"
X-Proofpoint-Virus-Version: vendor=fsecure engine=4.65.7400:2.4.4,1.2.40,4.0.164 definitions=2009-05-08_06:2009-04-28,2009-05-08,2009-05-08 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore

Baiting Guru Joined: 03 May 2007 Posts: 18313

This is the important bit: received: from [41.219.204.96]

That IP resolves to Lagos, Nigeria.

You can paste the whole header into this tool to find out the originating IP:

http://headertool.apelord.com/headers

Thank you for apologizing to Peter.

Posted: Sat May 09, 2009 3:07 am

Hi GEEIMATREE

I am glad you realised something was wrong before losing any money to the scammer.

A couple of things to note.

You like fish, and Templar nights right? it would be best to ask a mod to have your username changed if you are going to stick around.

If you take a look at this thread http://forum.419eater.com/forum/viewtopic.php?t=125681 you will learn some great information about scammers that will help to keep you safe from them.

Finally, I know many other forums out there are not the most friendly of places, but here, we do try to be as friendly and welcoming as possible, I know you have already apologised to Peter but it is worth saying that Peter has a much better insight into how these scammers affect their victims than most. He now devotes a lot of his time and energy to helping people he doesn't know to avoid scams and considering his first language is not English, he does a fantstic job of it.

You just never know exactly who is behind the words you read on the internet.

Posted: Sat May 09, 2009 5:46 am

Welcome to eater, I would take Murry up on his advice. This person like many others I've encountered sounds like a scammer, camgirl, or any other type or delinquent on the internet. I'm glad you've decided to do some research and homework before getting emotionally involved in the situation. Which, believe me, can be a tricky situation to get out of. Emotional attachment is one of the hardest things to get by, the feeling of betrayal and damage to your personal pride. If you need any advice don't hesitate to ask were all here to help. Have a good one. Very Happy

Posted: Sat May 09, 2009 1:52 pm

I got another e-mail this morning and this was the header analysis:
Is this telling me that this person is a fraus/scammer? or is she for real.
I haven't sent anything to anybody.....yet.....
----------------------------------------------------
Header Analysis
The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
65.175.128.136 United States (Rochester)* Whois Google DNSStuff Urgentmessage.org
76.13.13.64 United States (Sunnyvale)* Whois Google DNSStuff Urgentmessage.org
76.13.13.26 United States (Sunnyvale)* Whois Google DNSStuff Urgentmessage.org
76.13.10.175 United States (Sunnyvale)* Whois Google DNSStuff Urgentmessage.org
41.219.194.134 Nigeria (Lagos)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

Return-Path:
X-Original-To:
Delivered-To: [email protected]
received: from proofpoint-cluster.metrocast.net (proofpoint-cluster.metrocast.net [65.175.128.136])by mail.metrocast.net (Postfix) with ESMTP id 2F9DC5D68FAfor ; Sat, 9 May 2009 12:36:08 +0000 (GMT)
received: from n1a.bullet.mail.ac4.yahoo.com (n1a.bullet.mail.ac4.yahoo.com [76.13.13.64])by apple.metrocast.net (8.13.8/8.13. Cool

with SMTP id n49Ca0cC010178for ; Sat, 9 May 2009 12:36:02 GMT
received: from [76.13.13.26] by n1.bullet.mail.ac4.yahoo.com with NNFMP; 09 May 2009 12:36:00 -0000
received: from [76.13.10.175] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 09 May 2009 12:36:00 -0000
received: from [127.0.0.1] by omp116.mail.ac4.yahoo.com with NNFMP; 09 May 2009 12:36:00 -0000
received: (qmail 80928 invoked by uid 60001); 9 May 2009 12:36:00 -0000
received: from [41.219.194.134] by web59608.mail.ac4.yahoo.com via HTTP; Sat, 09 May 2009 05:36:00 PDT
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1241872560; bh=MSEbaQGk7lUSDGrmeLKSZC9sMzrjM/rZtmeiPJnKGFg=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
Message-Id: <[email protected]>
X-Ymail-Osg:
Date: Sat, 9 May 2009 05:36:00 -0700 (PDT)
From: Prisca Ruan
Reply-To: [email protected]
Subject: Re: I'll Send You The $200
To:
In-Reply-To: <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1665336272-1241872560=:28636"
X-Proofpoint-Virus-Version: vendor=fsecure engine=4.65.7400:2.4.4,1.2.40,4.0.164 definitions=2009-05-08_08:2009-04-28,2009-05-08,2009-05-08 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx engine=3.1.0-0810130000 definitions=main-0905080215

--------------------------------------------------------------------------------

<a name="accuracy>
Note on Accuracy: The country listings are generally accurate, but are sometimes wrong when the owner of an IP block covers a wide geographical area. Other common errors:

If identified, the City for the IP appears in brackets next to the country. MaxMind claims that their GeoLiteCountry database is between 60% and 75% accurate.
The Netherlands is sometimes mis-identified as Denmark
Pacific Rim nations are sometimes confused, such as China, Australia, Philipines, etc.
If in doubt, check the Whois record.

Removed quote of previous post. No need to quote posts, just use @username when responding to someone -Ima

Posted: Sat May 09, 2009 2:01 pm

^^^^ You might want to edit your post as it's got your email address in it.

To answer your question, did 'she' tell you that she was in Lagos or somewhere else? If it is somewhere else then yes 'she' is definitely a scammer.

If 'she' admits to being in Lagos, then she is probably still a scammer.

Posted: Sat May 09, 2009 2:51 pm

I am pretty comfortable calling it a scammer

The writing in the profile is consistent with Vlad while the header points to Lagos

A few searches on the email address point to nothing consistent however enough to raise concern

Click Here
and Here
We cant say for sure that they are all the same person but certainly adds to suspicion

The internet cafe used is here

Quote:

person: NAVNEET SINGH
address: Plot 1261, Bishop Kale Close, off Saka Tinubu
address: Victoria Island, Lagos, Nigeria
phone: +234-1-804-1234
fax-no: +234-1-811-0301
e-mail: ********@starcomms.com
nic-hdl: NS4-AFRINIC
source: AFRINIC # Filtered

person: Catalin Miclaus
address: Plot 1261C, Bishop Kale Close, off Saka Tinubu
phone: +234-1-8041234
fax-no: +234-1-8110301
e-mail: *******@starcomms.com
nic-hdl: CM9-AFRINIC

and if you put that address into a search "Plot 1261C, Bishop Kale Close, off Saka Tinubu" you get all of These hits some of them will point here as I have baited loads of scammers operating from the same location.

Ok, so none of this is exact proof, I girl, presumably very attractive and white, who is from Russia going by the writing, is now in an internet cafe in Lagos and desperate for a man.

Like I say, I am pretty comfortable calling it a scam but if you want to post a picture or 2 and some early emails we should be able to give you more evidence

Posted: Sat May 09, 2009 11:11 pm

Removed quote of previous post. Please use the reply button instead of the quote button when posting. -Ima
-------------------------------------------------------------------------------------
Below is what she sent me this morning (9MAY09)
The one one below this one dated 8MAY09, with the ******* is what [I] sent to [her], I think it was Friday night. (I took my e-mail address out THIS time, if it really matters [now].

Just so y'all know, all that mushy crap [I] wrote was for [her] benefit.
I want to see how far I can take this before she tells me to take a long walk off a short pier.

For purposes of this post, I [tried] to delete [my] e-mail address.
If any of [you] find it in there, [you] won't send me a bunch-o-crap.....
right?????
------------------------------------------------------------------------------------
Darling i am for real i am really feeling so lonely here i want to share the rest of my life with you there,darling i want you for real i want to be in your arms to share the rest of my life with you.My Love just try and get the $200 sent today don't worry about your bill when i get to you there we can cash the Check i have with me here ill pay them off i love u..so plz sent the money today

--- On Fri, 5/8/09, ********wrote:

From: ********************
Subject: I'll Send You The $200
To: [email protected]
Date: Friday, May 8, 2009, 11:16 PM

It's just going to take some time for me to keep up with my bills and put that amount aside.

I'm afraid my bills have to come first. When I have saved the $200, I will let you know.

I am SO SORRY I hurt you.......I REALLY want to believe in you and now that I have learned something new, I DO believe in you. My problem is, my head argues with my heart when I meet someone; it doesn't matter if it's online or out in town.

My brains tell me to be cautious; be careful; but my heart wants to jump into things no matter what the risks are because my heart wants SO BADLY to be loved by someone who is as open as you are.

Prisca.....PLEASE!! FORGIVE........My paranoia is over........I WANT YOU......I LOVE YOU.....

I NEED YOU FOREVER

Please say you forgive me. Say you want me and want to be with me and want to have a life [together] and I promise you I will do what I can so we can be together.

I never meant to hurt you.....I am SOOOOOO SORRY.

Can we hug now? <;-(
D

Return-Path: <[email protected]>
X-Original-To: ***********
Delivered-To: hxj6-a@************
received: from proofpoint-cluster.*******(proofpoint-cluster.*********.net [.175.128.136])by mail.metrocast.net (Postfix) with ESMTP id 2F9DC5D68FAfor <@net>; Sat, 9 May 2009 12:36:08 +0000 (GMT)
received: from n1a.bullet.mail.ac4.yahoo.com (n1a.bullet.mail.ac4.yahoo.com [76.13.13.64])by apple.metrocast.net (8.13.8/8.13. Cool

with SMTP id n49Ca0cC010178for <[email protected]>; Sat, 9 May 2009 12:36:02 GMT
received: from [76.13.13.26] by n1.bullet.mail.ac4.yahoo.com with NNFMP; 09 May 2009 12:36:00 -0000
received: from [76.13.10.175] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 09 May 2009 12:36:00 -0000
received: from [127.0.0.1] by omp116.mail.ac4.yahoo.com with NNFMP; 09 May 2009 12:36:00 -0000
received: (qmail 80928 invoked by uid 60001); 9 May 2009 12:36:00 -0000
received: from [41.219.194.134] by web59608.mail.ac4.yahoo.com via HTTP; Sat, 09 May 2009 05:36:00 PDT
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Dkim-Signature: snipped -Ima
Domainkey-Signature: snipped -Ima
X-Mailer: YahooMailWebService/0.7.289.10
Date: Sat, 9 May 2009 05:36:00 -0700 (PDT)
From: Prisca Ruan <[email protected]>
Reply-To: [email protected]
Subject: Re: I'll Send You The $200
To: [email protected]
In-Reply-To: <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1665336272-1241872560=:28636"
X-Proofpoint-Virus-Version: vendor=fsecure engine=4.65.7400:2.4.4,1.2.40,4.0.164 definitions=2009-05-08_08:2009-04-28,2009-05-08,2009-05-08 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx engine=3.1.0-0810130000 definitions=main-0905080215

Posted: Sat May 09, 2009 11:49 pm

100% pure scam.

Oh, and welcome to Eater!

Posted: Sun May 10, 2009 2:08 am

Firstly welcome to eater, geeimatree, Glad you found us before
you got taken for any money.

A couple of small point's, with regard to your scammer. As to your Header info.

Quote:

65.175.128.136 United States (Rochester)
76.13.13.64 United States (Sunnyvale)
76.13.13.26 United States (Sunnyvale)
76.13.10.175 United States (Sunnyvale)

Disregard these, there simply saying your new friend is using a
yahoo e-mail address.
The last one is the important one.

Quote:

41.219.194.134 Nigeria (Lagos)

This shows up as,,

Scammer Net Range! (ID: 3612)
IP Block41.219.192.0 - 41.219.255.255
CountryVictoria Island, Lagos, Nigeria
CommentsStarcomms Nigeria Limited
Abuse [email protected],[email protected]

The request for a $200 starter is quite common for a Vlad, I think
what we have here, and I'm drawing a rather long bow on this one.
is someone based in Lagos, who's using stolen Russian script. and
once he goes off script, his diction falls apart. As in personal measurements to you.

Quote:

"my body structure is Hair: Brown Height: 5'8"
Eyes: brown Bust: 34"
Dress: 3 - 4 Waist: 25"
Shoe: 7.5 Hips: 34"
34-36 Shoe size 6,5"
i love u"

All sorts of wonderful things come to mind, But if I read it correctly
your new friend has at least 4 feet. and there different sizes. If her dress size is 3 or 4, then she's about 8 years old. Confused

Still the important thing is he/she/it loves you. And that in itself
tells you it's a scammer.

So please bait it safely, ask advise on here, apply for a mentor,
and keep your money in the bank

Posted: Sun May 10, 2009 5:12 am

Dorothy wrote:

100% pure scam.

Oh, and welcome to Eater!

Thanks Dot. Very Happy

Posted: Sun May 10, 2009 6:07 am

Weareborg:

In the US a dress size of 3 or 4 is actually appropriate for a very petite/thin adult woman (most models would be size 4 or less).

The measurements are given in inches--so even though the OP doesn't say, I am guessing this scammer is pretending to be American (Nigeria uses the metric system--if "she" were real and honest about being Nigerian, the measurements would be in cm). Based on the way it is written (the 34-36 size range is the real giveaway), I suspect the scammer pulled those measurements from a sizing chart on an American clothing website, though he still made a few cut-and-paste mistakes.

He also screwed up the shoe sizes, (I really do want to see those 4 feet or those two very different feet). American women's shoe sizes wouldn't be written as 7.5 or 6,5 -- we don't use decimals in shoe sizes, so those would be written as 7 1/2 and 6 1/2.