Potential Scamming?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 26 Feb 2005 Posts: 16

Airline codes wrote:

IATA Code: BA
ICAO Code: BAW
IATA Accounting / Prefix Code: 125

Ticket number should be 125 xxxx xxx xxx if BA issued the ticket or the originating outgoing flight is on BA. 016 is united. 001 is American. None of this should vary from country to country as it's set by international treaty.

Posted: Wed Jun 28, 2006 10:26 am

Doesn't look like I mentioned it, but she was asking for the $2000 for the BTA amount and said if she didn't get it, she was going to die.

Hello I'm New here! Joined: 26 Feb 2005 Posts: 16

BA0085 goes from London Heathrow to Vancouver, B.C.

BA Website wrote:

17:15 Depart Heathrow (London)
18:35 Arrive Vancouver

BA0085 British Airways

You can book it here:

http://www.britishairways.com/travel/fx/public/en_gb

Just put in some fake dates. Originating airport is LHR. Destination is YVR for Vancouver, B.C.

Posted: Wed Jun 28, 2006 10:59 am

Yeah, I just went through and checked prices for it. Can't fly out of Nigeria, but you can fly to it from LAX in California.

Total $ 2,399.40 Including Taxes

Overall money he sent was $2440, over a period of a month or so. The $1700 was for the flight, and the rest of it was for paying for her Internet and a phone bill, I think, all of it wired Western Union.

The Western Union bills (I'm looking at the receipt) were made out to a Sanmi Kelvin Tobi.

Hello I'm New here! Joined: 26 Feb 2005 Posts: 16

Well, between the pics from the modeling website & the fake airline confirmation, your pop should have enough info to see what's happening.

Victims very often will keep sending money, even after they have been warned by their family members & the authorities. That's a tough one.

Posted: Wed Jun 28, 2006 11:17 am

Thankfully, from showing him this, he finally believes me.

Posted: Wed Jun 28, 2006 11:31 am

Also, that flight info is way past bogus. BAW0074 goes from Lagos to Heathrow. And, as it has been mentioned BAW0085 goes from Heathrow to Vancouver. Also, Riverside, CA does not have ANY scheduled commercial passenger service. And the only British Airways flights coming into LAX are coming straight from Heathrow (flights 269, 279, and 283).

EDIT: I see he finally believes this is a scam. Very good to hear. Smile

Posted: Wed Jun 28, 2006 11:46 am

Aye, agreed.

I went ahead and got a direct copy of the email heaader from his computer. I had him copy/paste the whole thing, so I'll edit this post in a bit and supply some pertinent data.

Most relevant data, admist a crapload of Javascript that could be found.

action="/ym/blocksender2?box=
Marry&MsgId=4851_244067_6249_1797_862_0_62_2489_1404266912&inc
=&Search=&YY=77445&order=down&sort=date&pos=0&view=a&head=b">

Note the Message ID.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Something that might interest your father, get him to read the forums on this site:

www.internet-love-scams.org

www.internet-love-scams.org/forum

There are many stories on there just like your fathers, glad to hear he has realised it's a scam!

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Kazlor wrote:

Most relevant data, admist a crapload of Javascript that could be found.

action="/ym/blocksender2?box=Marry&MsgId=4851_244067_6249_
1797_862_0_62_2489_1404266912&inc=&Search=&YY=77445&order
=down&sort=date&pos=0&view=a&head=b">

Note the Message ID.

Can you post the full headers please, we cannot learn anything from what you posted above.

Posted: Wed Jun 28, 2006 12:21 pm

Scam Patroller,

Are you sure? The entire thing is about 60k in size.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Nope, it's just a small bit of text, this is what full headers look like:

Quote:

From [email protected] Wed Jun 28 02:32:39 2006
X-Apparently-To: [email protected] via 217.146.188.204; Wed, 28 Jun 2006 07:59:21 +0000
X-YahooFilteredBulk: 217.110.105.71
X-Originating-IP: [217.110.105.71]
Return-Path: <[email protected]>
Authentication-Results: mta820.mail.ukl.yahoo.com
from=rs2.de; domainkeys=neutral (no sig)
Received: from 217.110.105.71 (HELO mail.topradio.de) (217.110.105.71)
by mta820.mail.ukl.yahoo.com with SMTP; Wed, 28 Jun 2006 07:59:21 +0000
Received: (qmail 12259 invoked by uid 1015); 28 Jun 2006 02:32:41 -0000
Cc: recipient list not shown: ;
Received: from 217.194.137.170 ([217.194.137.170])
by mail2.rs2.de (IMP) with HTTP
for <[email protected]@localhost>; Wed, 28 Jun 2006 04:32:39 +0200
Message-ID: <[email protected]>
Date: Wed, 28 Jun 2006 04:32:39 +0200
From: [email protected]
Subject: Reliable representative needed
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
User-Agent: Internet Messaging Program (IMP) 3.2.3
X-Originating-IP: 217.194.137.170
Content-Length: 1348

Can you break that long line of text action="/ym/blocksender2?box=Marry&MsgI like I did as it's blowing the forum out, cheers

Posted: Wed Jun 28, 2006 12:25 pm

Going through it all now. I'm not finding anything about a MIME version or anything like that.

Posted: Wed Jun 28, 2006 12:27 pm

In order to see the headers on Yahoo, go into the optionsthe, to the mail view and choose the "Full View" option. Then you should see the headers on that e-mail.

Posted: Wed Jun 28, 2006 12:28 pm

X-Apparently-To: Dad's [email protected] via 206.190.58.175; Sun, 18 Jun 2006 07:24:21 -0700
X-Originating-IP: [209.191.86.252]
Return-Path: <[email protected]>
Authentication-Results: mta250.mail.re2.yahoo.com from=yahoo.com; domainkeys=pass (ok)
Received: from 209.191.86.252 (HELO web39101.mail.mud.yahoo.com) (209.191.86.252) by mta250.mail.re2.yahoo.com with SMTP; Sun, 18 Jun 2006 07:24:21 -0700

Received: (qmail 24885 invoked by uid 60001); 18 Jun 2006 14:24:21
-0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-
Type:Content-Transfer-Encoding; b=3xorDjsZUXUOb/1Nz7JGEdJurWSF7ULterb+yWtJjrch3SS/4eGfuhKoG
VZi3xG1feJOS/qNrkhEP1U2jUD5KAtkJ5xkM0khAmsYGODgLitgqYkZjCo
7Nw3+tyOKW+P6MfoaMbiC0XDQS8Zuod0EN/LNH2st40aVKHnLEyc8zhI= ;
Message-ID: <[email protected]>
Received: from [81.199.62.132] by web39101.mail.mud.yahoo.com via HTTP; Sun, 18 Jun 2006 07:24:21 PDT
Date: Sun, 18 Jun 2006 07:24:21 -0700 (PDT)
From: Send an Instant Message "marry williams" <[email protected]> View Contact Details View Contact Details Add Mobile Alert
Yahoo! DomainKeys has confirmed that this message was sent by yahoo.com. Learn more
Subject: My Amor
To: Dad's [email protected]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1931766421-1150640661=:23713"
Content-Transfer-Encoding: 8bit
Content-Length: 862

MUCH better, thanks for allowing me my bonehead moment.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

They are probably in a Nigerian internet cafe as they often use Israeli satellite connections, as this GILAT SATCOM IP is:

Quote:

WHOIS results for 81.199.62.132

Location: Israel (high)

% Information related to '81.199.62.0 - 81.199.63.255'

inetnum: 81.199.62.0 - 81.199.63.255
netname: GilatSatcom-14
descr: Gilat Satcom Range
country: IL
admin-c: TECH6-RIPE
tech-c: TECH6-RIPE
status: ASSIGNED PA
mnt-by: AS12491-MNT
mnt-lower: AS12491-MNT
changed: **********@ripe.net 20060213
source: RIPE

person: Tech IP Planet
address: 21 Yegia Kapaim St.
address: Petach-Tikva
address: Israel
phone: +972 3 9255015
fax-no: +972 3 9217938
e-mail: ***@gilat.net
abuse-mailbox: *****@gilat.net
nic-hdl: TECH6-RIPE
notify: ***@gilat.net
mnt-by: AS12491-MNT
changed: ***@gilat.net 20060213
source: RIPE

% Information related to '81.199.62.0/23AS12491'

route: 81.199.62.0/23
descr: Gilat Satcom
origin: AS12491
mnt-by: AS12491-MNT
mnt-routes: AS12491-MNT
changed: **********@ripe.net 20060213
source: RIPE

Posted: Wed Jun 28, 2006 12:39 pm

I once baited a marry williams at [email protected].
Then she was just running a standard 419 and her picture was very different.

Posted: Wed Jun 28, 2006 12:44 pm

Funky. And I just ran it through a spam database.

http://www.dnsstuff.com/tools/ip4r.ch?ip=81.199.62.132

And

http://tqmcube.com/cgi-bin/rbltqm?ip=81.199.62.132

Posted: Wed Jun 28, 2006 2:55 pm

She's back online currently, if anyone cares to give it another go. I'd love to see this one go down.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Just checked she (he) is either off line or has blocked me from IM'ing them.

Quote:

marry williams appears to be offline and will receive your messages after signing in.

Posted: Wed Jun 28, 2006 3:03 pm

I'm watching my father type to her on his computer at this moment. He just got buzzed for taking so long to reply.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Damn, must have blocked me then Evil or Very Mad

Posted: Wed Jun 28, 2006 3:07 pm

Well, that sucks. Makes me want to get a mentor.

Oh, and I've got a good (sad, actually) one for you. He's taken up using Yahoo's little matchmaker bit instead of Match.com's. He won't change his info for it, either.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

I just added her to my Usman Bello contacts, she called me a scammer Rolling Eyes

Posted: Wed Jun 28, 2006 3:31 pm

I'd imagine the leet speak (or so I assume it is) might scare them off?