Follow the bouncing IP

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 10 Mar 2008 Posts: 17

I'm having a little trouble trying to find out what this scam will become, if anyone has heard of something like this, I would be interested in knowing more

I got a message from someone on a dating site (B00k0fMatches) and supposedly she's from Texas, small town, 3000 ppl, etc. she is of latin origin. Photos looked pretty hot, but never believe them. She starts writing and seems to become attached quite quickly. Works as a graphics artist but no examples of her work. Within a week of writing she said she may go the the UK to meet with someone interested in her work. (No examples she can show me, but someone in England wants to see her work - yeah right). Nothing further comes of it.

Asked her to send additional pics, they are all micro-mini thumbnails. When asked about they size, she said they were full images when she sent them. (Even though she is a graphics artists)

A few days later, her brother dies in a car acccident. But little further is said about that.

Then she has to go to the UK to meet with her father's estate lawyer to review some legal papers about her Dad's property in the UK. Won't answer what the papers are, but she said she really wants to talk when she gets back, she has good news for "us". And in the meantime, miss you, growing close, told my mother about you, yadda yadda yadda.

Sends me her phone number which appears to be a UK area code (?)

Then last night, as part of wanting to grow close, she wants pics of me, plus my full name and mother's full name. (Gave her names based on 3 different cultures and managed to mis-spell them when repeated)

When tracing the email headers, we've got a bit of a bouncing ball:
Texas
Chicago, Illinois
Lagos
Lagos
Lagos
41.221.174.28 (Bakin Kogi, Nigeria)
41.221.174.28 (Bakin Kogi, Nigeria)
Lancaster, PA

So far "she" is not asking for anything (beyond the personal info), not quite sure what this scam might become. And it looks like there are upm to 4 ppl involved on the other end according to the header trace.

Any thoughts anyone?

Posted: Tue Nov 17, 2009 3:48 pm

can you post the full headers? I am sure someone will ask that and I know that they use proxies and somtimes it takes a few emails to see where they are from and if ip did show nigeria I would say with almost100% certanity it is a scam, I am sure it is setting up the scenerio and will ask for money shortly. I am fairly new here my self and I am sure someone with more experience will be along shortly and by the way welcome! Very Happy

Posted: Tue Nov 17, 2009 3:51 pm

ps you can use www. tineye to research the pictures.

Hello I'm New here! Joined: 10 Mar 2008 Posts: 17

Thanks for the replies and thanks for the pic search link. Ran it, but no luck. I'm just surprised no hook yet after almost three weeks of communcation. Either this person is very new or they haven't figured out which scam to pull.

And did try the header trace through a few different trace programs, they all have the same results (in as much as they come from diff sources, US, then Nigeria, then abck to US)

Ohh well, will update you all when "she" returns to her small town in Texas!

Posted: Tue Nov 17, 2009 5:00 pm

some scammers do it that way try to build up your trust and then ask for the money and some ask after the second email just have fun and post her letters and pics for others to read and the more experienced would be able to tell you right away if it is a suspected scam.

Posted: Tue Nov 17, 2009 5:03 pm

oh and another thing are you baiting safe by using an email address which hides your ip?

Posted: Tue Nov 17, 2009 5:19 pm

I don't mean to sound cynical, but a Nigerian IP when "she's" pretending to be in Texas is a pretty good indicator of a scam.

He'll ask you for money eventually. In fact, I'm surprised he never used the "brother died" excuse to get something out of you. As for the UK number, it's most likely a Flextel number which redirects to West Africa. Is it a +44-70?

Finally, with regard to the IP addresses, can you post the headers up.

Posted: Tue Nov 17, 2009 5:58 pm

Hello there Vapour,

First of all I apologize for my co-baiters janeegrl and Nickthecop. They forgot to welcome you to eater! (Well, re-welcome, since you have been inactive for quite a while).

I have indeed no doubt it's a scammer. There are some red flags you mentioned and discovered for yourself, and obviously the reference to Nigeria is the biggest one of them all.

Regarding the phone number, I have a strong feeling Nick is correct on this one, it will most likely be a redirection number.

And, just like the others I'm curious for the headers, they sound a bit peculiar to me.

Other than that, bait safe and have fun!

PS: Nick, what are you doing in the love basement? First time I see you here, surely you aren't telling me you're going to start romancing? Very Happy

A big welcome to you too! Very Happy

Posted: Tue Nov 17, 2009 6:11 pm

Caligula wrote:

First of all I apologize for my co-baiters janeegrl and Nickthecop. They forgot to welcome you to eater!

Bah! PR hound.

Caligula wrote:

I have a strong feeling Nick is correct

Wise words. Wise words, indeed.

Caligula wrote:

Nick, what are you doing in the love basement? First time I see you here, surely you aren't telling me you're going to start romancing? Very Happy

Don't be absurd. I didn't even know where this was posted. All I saw was "IP" and I assumed it was something in Help, Hints and Tips. In fact, it might as well be, but I won't say anything since Nurse Nasty will just not move it to spite me.

Posted: Tue Nov 17, 2009 6:22 pm

*cough*

Pulling things out of context, huh? Wink

I believe my full quote was:

The once almighty emperor of Rome wrote:

I have a strong feeling Nick is correct on this one

Small difference Wink

And me being a PR hound.. Well.. I must admit, they've trained me well Laughing

Posted: Tue Nov 17, 2009 6:34 pm

Don't play hard to get now... Wink

Posted: Tue Nov 17, 2009 6:45 pm

@Caligula hey I welcomed him in my first post to him, i guess you didn't see Wink

Posted: Tue Nov 17, 2009 6:50 pm

OH! *Bends over to receive a deserved slap*

I guess it's the baiting affecting me, never reading a whole mail now has its effect on forum posts aswell Laughing

And the same applies to being hard to get, I think

Posted: Tue Nov 17, 2009 6:52 pm

@ Caligula no worries!

Hello I'm New here! Joined: 10 Mar 2008 Posts: 17

Many thanks to all for the welcome and replies. Will eventually figure out how to post the photos. In the meantime...

Definitely it is a +44 phone number. Haven't called it becuase I told her it's too expensive and will wait for her to give me her Texas number when she gets back.

As for IP headers, most recent email.....

X-Apparently-To: ****@yahoo.com via 68.142.206.37; Mon, 16 Nov 2009 10:15:55 -0800
Return-Path: <*****[email protected]>
X-YMailISG:
X-Originating-IP: [98.136.44.51]
Authentication-Results: mta126.mail.re1.yahoo.com from=yahoo.com; domainkeys=fail (bad sig); from=yahoo.com; dkim=permerror (bad sig)
Received: from 98.136.44.51 (HELO n75.bullet.mail.sp1.yahoo.com) (98.136.44.51) by mta126.mail.re1.yahoo.com with SMTP; Mon, 16 Nov 2009 10:15:54 -0800
Received: from [216.252.122.217] by n75.bullet.mail.sp1.yahoo.com with NNFMP; 16 Nov 2009 18:15:41 -0000
Received: from [69.147.84.88] by t2.bullet.sp1.yahoo.com with NNFMP; 16 Nov 2009 18:15:41 -0000
Received: from [127.0.0.1] by omp204.mail.sp1.yahoo.com with NNFMP; 16 Nov 2009 18:15:41 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 99447 invoked by uid 60001); 16 Nov 2009 18:15:41 -0000

Received: from [63.119.14.20] by web44713.mail.sp1.yahoo.com via HTTP; Mon, 16 Nov 2009 10:15:40 PST
X-Mailer: YahooMailClassic/8.1.6 YahooMailWebService/0.7.361.4
Date: Mon, 16 Nov 2009 10:15:40 -0800 (PST)
From: Debby Wilfred <****[email protected]> Add sender to Contacts
Subject: Hi Dave
To: ****@yahoo.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-2083169336-1258395340=:98452"
Content-Length: 4385

and from the first email

X-Apparently-To: ****@yahoo.com via 68.142.206.35; Mon, 02 Nov 2009 08:53:59 -0800
Return-Path: <[email protected]>
X-YMailISG: fAEolj4WLDsZWAFyXxq50ghynNG0xWu99_
X-Originating-IP: [98.136.44.36]
Authentication-Results: mta288.mail.re4.yahoo.com from=yahoo.com; domainkeys=fail (bad sig); from=yahoo.com; dkim=permerror (bad sig)
Received: from 98.136.44.36 (HELO n71.bullet.mail.sp1.yahoo.com) (98.136.44.36) by mta288.mail.re4.yahoo.com with SMTP; Mon, 02 Nov 2009 08:53:56 -0800
Received: from [216.252.122.217] by n71.bullet.mail.sp1.yahoo.com with NNFMP; 02 Nov 2009 16:53:43 -0000
Received: from [69.147.65.165] by t2.bullet.sp1.yahoo.com with NNFMP; 02 Nov 2009 16:53:43 -0000
Received: from [127.0.0.1] by omp500.mail.sp1.yahoo.com with NNFMP; 02 Nov 2009 16:53:43 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 53553 invoked by uid 60001); 2 Nov 2009 16:53:43 -0000

Received: from [66.135.42.52] by web44708.mail.sp1.yahoo.com via HTTP; Mon, 02 Nov 2009 08:53:42 PST
X-Mailer: YahooMailClassic/7.0.14 YahooMailWebService/0.7.361.4
Date: Mon, 2 Nov 2009 08:53:42 -0800 (PST)
From: Debby Wilfred <****[email protected]> Add sender to Contacts
Subject: Hi Dave....
To: Dave NOT DISCLOSED <****@yahoo.com>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1915806315-1257180822=:53349"
Content-Length: 7244

Unfortunately was not "safe sending" and used my own email to respond. Duh, yes, I know!

@ Vapour, I had already edited out you email address and the long domain keys to prevent blowout, then you replaced the headers again, you git Laughing

- SP

Posted: Tue Nov 17, 2009 7:20 pm

okay delete your email from the posts okay, set up an account on gmail or hushmail to name a few and to post photo set up account on any photo hosting site like photobucket for example.

Posted: Tue Nov 17, 2009 7:37 pm

ip adresses aren't my speciality, but I'm quite sure that they were both sent from proxy's.

Posted: Tue Nov 17, 2009 7:39 pm

Both headers seem to come from Texas. It's possible that one of your friends is badgering you, or the IP could simply be spoofed for authenticity. In the case of the latter, it certainly is more high-tech than what I'm used to from lads.

Vapour wrote:

Definitely it is a +44 phone number.

A ha. It is a +44 number. But is it a +44-70 number? That's the key. Wink

Hello I'm New here! Joined: 10 Mar 2008 Posts: 17

The number given was +44702402****

Posted: Tue Nov 17, 2009 7:46 pm

See, the +44-70 numbers are granted by FlexTel. I've got one myself and I'm all the way in NorCal. Most go to West Africa.

http://www.flextel.com/

Posted: Tue Nov 17, 2009 7:46 pm

Received: from [63.119.14.20]
Received: from [66.135.42.52]

Both of these are Proxy Servers. Try entering them here:

http://whatismyipaddress.com/

Posted: Tue Nov 17, 2009 7:47 pm

the first one i got lancaster pa and for the second one i got san antiono texas she must move quick lol these are proxys for sure also note in the headers the NNFMP, which means this email address is being watched no his on its email address i would say 100% this is a scam from nigeria

Posted: Tue Nov 17, 2009 7:48 pm

Note this in header "with NNFMP; 16 Nov 2009"

Quote:

YAHOO USE SPECIAL PROTOCOL NAMED “NNFMP” TO DENOTE SENDER MAY BE IN SCAMMER LIST

OR USING ANY SPECIAL SOFTWARE TO HIDE THEIR OWN IP ADDRESS AND DETAILS

@ Vapour welcome to Eater.

Your header is stretching the page
could you please snip some code from your header post.

Posted: Tue Nov 17, 2009 7:52 pm

@kate hi see you taught me well Very Happy

Quote:

YAHOO USE SPECIAL PROTOCOL NAMED “NNFMP” TO DENOTE SENDER MAY BE IN SCAMMER LIST

OR USING ANY SPECIAL SOFTWARE TO HIDE THEIR OWN IP ADDRESS AND DETAILS

Hello I'm New here! Joined: 10 Mar 2008 Posts: 17

NNFMP? Ohhh very cool. Well, will be interesting to see "her" next move and see what sort of fun we can have with this one.

You all are awesome!