She has PAID to upgrade...

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Jul 27, 2011 11:13 pm

I'd forgotten about an old RL Profile on (deleted), when I received an unexpected Message from a Member supposedly in Cape Verde. It all stinks of scam, and I want to pass her e.mail address on to the baiting community, but BP has a free membership option with limited features, and despite that she has PAID to upgrade to 'Extra' Membership. Her Profile Description is below and I attach her Profile Pic. I’ve run it through Tin Eye with no result. I’ve Googled her Profile Description and found something similar on just one other site.

Quote:

I am sweet,open,honest,basically down to earth and easy going,creative, people watcher,coffee addicted,affectionate,emotionally very stable,self confident,adventure seeking,hate shopping kind of person. I like to read the latest novel,watch movies of any kind,watch a few sports events,explore new places,travel and sight seeing.I am always up for new adventures.I have already learned the lesson that life is short,way too short for games,dishonesty or drama.

The kind of person that sparks my interest is an honest,funny and comfortable person. I'd like to meet someone I can laugh with.I don't want to have all the same interests but some would be nice.I'd love to meet someone who gives me butterflies,haven't had those in a long time.
I would love to find some one that sees the world the way I do.Life is about fun and laughter,meeting new people,doing new things,no regrets,never saying can't.A man that is outgoing,laughs easily,confident,smart,warm,friendly,stable,honest and open to new places,people and ideas.

How many Vlads PAY for enhanced memberships on dating sites? How accurate am I in suspecting that this one is a Scammer?

Thanks.

Posted: Thu Jul 28, 2011 1:25 am

Sometimes it's better to google only part of the profile--just choose something unique. When I do that, I actually find a few almost identical profiles:

http://www.google.com/search?q=%22people+watcher%2Ccoffee+addicted%2Caffectionate%22&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a#q=%22people+watcher,coffee+addicted,affectionate%22&hl=en&client=firefox-a&hs=Bra&rls=org.mozilla:en-US:official&prmd=ivns&ei=0bgwTsCVD8_TgAfCxZDmCg&start=0&sa=N&filter=0&bav=on.2,or.r_gc.r_pw.&fp=a5fe8bc1a5780e47&biw=1366&bih=565

Though I lean strongly toward scammer, I wouldn't be ready to say it with absolute certainty yet. As far as the paid membership goes, scammers will get paid memberships--but it's not their own money--they will typically use stolen credit card info or scam a victim into paying.

Posted: Thu Jul 28, 2011 11:09 am

^^^ Thanks for this. I've looked at one of the similar Profiles and the name used is the same as that on the site (Juliet). The Profile Pic is of a different woman.

I've noticed with increasing weariness that many - maybe most - people on dating sites tend to use the same old phrases; ie, 'my friends say I'm attractive'/'bubbly'/'glass half full person'/'wicked sense of humour', etc. However, the above Profile is far too similar, almost identical, to some of those you have linked to.

Yes, it seems to be a scam. Thanks again.

Posted: Thu Jul 28, 2011 6:17 pm

No hit on Google image search Sad

Posted: Fri Jul 29, 2011 12:10 am

Well, she has today sent me this:

Quote:

...i will be open to the idea of a visit or relocation to you but i will need your help to do so...

One thing I am curious about is her IP, which wanders around all over the world. She is using Yahoo, but iptrackeronline gives me a different result each time, including:

Quote:

[quote="ipTRACKERonline.com"]Header Analysis Quick Report
Originating IP: 2.118.35.170
Originating ISP: RUZZO RETI SPA
City: n/a
Country of Origin: Italy

Quote:

[quote="ipTRACKERonline.com"]Header Analysis Quick Report
Originating IP: 109.73.51.28
Originating ISP: ispOne business GmbH
City: n/a
Country of Origin: Germany

Quote:

[quote="ipTRACKERonline.com"]Header Analysis Quick Report
Originating IP: 109.73.51.28
Originating ISP: ispOne business GmbH
City: n/a
Country of Origin: Germany

Quote:

[quote="ipTRACKERonline.com"]Header Analysis Quick Report
Originating IP: 81.169.134.241
Originating ISP: Strato Rechenzentrum, Berlin
City: Berlin
Country of Origin: Germany

Quote:

[quote="ipTRACKERonline.com"]Header Analysis Quick Report
Originating IP: 99.148.71.59
Originating ISP: SBC Internet Services
City: Chicago
Country of Origin: United States

I wondered if she was using a proxy, or HideMyAss, but I tried unsuccessfully to log into my own Yahoo account with HMA, since HMA blocks cookies. It may be that she is using software like https://www.torproject.org/ Anyway, here is her latest header. It may be that someone can see something in it that I can’t:

Quote:

Return-Path: <[email protected]>
Received: from smtp2.hushmail.com (smtp2.hushmail.com [65.39.178.134])
by imap12.hushmail.com (Cyrus v2.3.7-Invoca-RPM-2.3.7-7.el5_6.4) with LMTPA;
Thu, 28 Jul 2011 13:36:45 +0000
X-Sieve: CMU Sieve 2.3
Received: from smtp2.hushmail.com (localhost.localdomain [127.0.0.1])
by smtp2.hushmail.com (Postfix) with SMTP id B3DC5E6888
for <[email protected]>; Thu, 28 Jul 2011 13:36:43 +0000 (UTC)
X-Hush-Verified-Domain: yahoo.com
Received: from nm9-vm2.bullet.mail.ne1.yahoo.com (nm9-vm2.bullet.mail.ne1.yahoo.com [98.138.90.157])
by smtp2.hushmail.com (Postfix) with SMTP
for <[email protected]>; Thu, 28 Jul 2011 13:36:39 +0000 (UTC)
Received: from [98.138.90.51] by nm9.bullet.mail.ne1.yahoo.com with NNFMP; 28 Jul 2011 13:36:33 -0000
Received: from [98.138.87.7] by tm4.bullet.mail.ne1.yahoo.com with NNFMP; 28 Jul 2011 13:36:33 -0000
Received: from [127.0.0.1] by omp1007.mail.ne1.yahoo.com with NNFMP; 28 Jul 2011 13:36:33 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 9750 invoked by uid 60001); 28 Jul 2011 13:36:33 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1311860193; bh=do5yXq6P/NfkEbph5scxpc8ubUda1e33lKMiB6ClQzU=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=tk6FIHm2Fqltv7dhKbfEblD+io9Ch73uA1uEu2n6n967ozlsJfc7tSR5CyWSMQFt5P2wD+1tCLeaqjW2Jc+MqvIJ91/
JlZTu0eRCYCijHXJgngdpv4AI67QbwuDjcgW0tWicr/CpANqcwauqfiKbgvDQIOBM1HrL/pHYV5UN+6c=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=JtQnQDdMufcO0BrRq255FUNaTTmbGvY2nzzjYlPkAaNVjVpfssp+tvKm6M7DRiu33LrTLinzRaOqbGbeGYt3VBMWXh
4+4yasyvf4rQsqaw2kdPrZBnT+NmHvsXLGlNqrsgOkl8QxAF5thDemwYbspKBENePPgmYPluTeWzpf6r0=;
X-YMail-OSG: 7L9nVL0VM1lIpneG1FYevBe_PuQpvW4.sIqsyANirCC3OS.
NZUhQEVXQ_lRR0buRBleV6f6CioLjqHs_usjCFNDrIWyGMsxGiINCllP0Uze
bGouARw0TpvaYiO.3WnbuesLm8Gf1007MWOL9HSACRc_NEF8ObQ_yV_WCiU2
035faNHpVT9YNUBEtgU5wsE5GA8FCpN6dxz0OBS4kikZ4tfGXnRNh5An71pQ
1B4sOI3Mhx8dDFyspD3nSQyFwi6rcNjI6x..DYRlsvNJMR3sz6dk2OI1nxAn
RtF2TZIVkuqwWKHc16nqnAdLDJhMbuXWBmdzETWLe2vo1bTAURuoLrZY9J5y
_2Ub2UnYbL_lXTKQ-
Received: from [99.148.71.59] by web121604.mail.ne1.yahoo.com via HTTP; Thu, 28 Jul 2011 06:36:33 PDT
X-Mailer: YahooMailClassic/14.0.3 YahooMailWebService/0.8.112.310352
Message-ID: <[email protected]>
Date: Thu, 28 Jul 2011 06:36:33 -0700 (PDT)
From: JDerby <[email protected]>
Subject: xxxxx
To: [email protected]
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1643041613-1311860193=:58581"

hello XXXXX,it will be great if you can open a yahoo account and also set up yahoo messenger so we can chat online,also am an open minded person and i will be open to the idea of a visit or relocation to you but i will need your help to do so,so let me know what you think about this and i will look forward to your mail and chating to you shortly.hugs Juliet

Posted: Fri Jul 29, 2011 12:50 am

You usually won't get a location when you see NNFMP in the headers.

NNFMP is a little-understood internal yahoo protocol that turns up from time to time - when you see NNFMP, you won't get an originating IP. NNFMP is frequently associated with spammers and scammers.

That initial attempt to get you onto yahoo is typical lad, and the writing is definitely western African.

Posted: Fri Jul 29, 2011 6:10 pm

^^^ Thanks for the info about NNFMP. Much appreciated.

I'm using Plain Text e.mail, so I can't include a SpyPig tracking image. I'm wondering if this might reveal the real IP: http://tools.dw-global.net/textmail.php.

Posted: Sat Jul 30, 2011 1:23 pm

Not sure about that one, but if you PM me the address you are using, I can set you up temporarily on my readnotify so you can tag the next few emails.

Posted: Sat Jul 30, 2011 11:40 pm

^^^ Thanks. I will do that.

Not quite a Newb Joined: 21 Jul 2011 Posts: 65

Dorothy wrote:

Not sure about that one, but if you PM me the address you are using, I can set you up temporarily on my readnotify so you can tag the next few emails.

Hi Dorothy, does readnotify cost anything? I'd like to track the location of a vlad. The ip addresses always point to the US, but jump around a lot. But the scammer wants me to send funds to Russia.

Posted: Sun Jul 31, 2011 12:40 am

If you go to readnotify.com, I believe you can do a free trial for an email or two. If you want to track several, it will require a paid suscription (I have one).

Not quite a Newb Joined: 21 Jul 2011 Posts: 65

I tried something called whoreadme. I got a reply to the email, but no notification that it was read. I wouldn't recommend it. Laughing

Posted: Tue Aug 09, 2011 1:27 am

I've sent at least 2 ReadNotify e.mails and it looks like he/she is in Chicago. I've since had an e.mail from a 'Travel Agent', requesting over $2000 USD for her documents and plane ticket from Ghana over to UK.

So, definitely a Scammer, but with a paid account. I reported it, but the site appears to have taken no action.

Posted: Wed Aug 17, 2011 4:01 am

I sent another report to the site admin, together with more comprehensive info, and her Profile has been removed. I am looking forward to asking 'her' why. Wink

Posted: Wed Aug 17, 2011 6:28 pm

Oh, dear.

Quote:

i think you just a scumbag just playing games with me,enjoy ur life u piece of work

419Eater is my life Joined: 08 Apr 2009 Posts: 375

Aww, what happened? Sad

Posted: Wed Aug 17, 2011 8:55 pm

Hee hee! At the end she goes all wiseguy, sopranos on your ass!

Quote:

u piece of work

Or should that be "woik" ?

Don't worry Monsignor. It ain't over 'till the fat lady sings, capeche?

Posted: Thu Aug 18, 2011 7:05 pm

'She' clearly doesn't realise.......... I'll be back! Smile

Posted: Sun Aug 21, 2011 1:08 am

I asked 'her' why its Profile was closed, and why her bank account was flagged as suspicious, and this arrived shortly afterwards:

Quote:

you are a very stupid man and you just here to play games and lair a lot and this will be my last mail to you and i will block you from reach me ,u r very useless man who get online to play with poeples emotions my bank account is new and there has been no activity on it apart from the required minimum deposit to open it so that tells me how fake u r and fuckin lair you are and you are a crazed man who gets pleasure in lying to people there was always something phony about u and i finally can tell it,also thanks for flagging my profile as i will get them to flag ur profile soon u son of a bitch

She has PAID to upgrade...	View next topic View previous topic