99 Percent sure a scam

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 12 Apr 2010 Posts: 3

Hello All!
I have recently become aware that a young lady I have been smitten with for the last several weeks is most likely a scammer.
Alla is ostensibly a Moldovan gynecologist.
She/He/It emailed me about a month ago saying she liked my profile on Yahoo and to write to her on an outside email address. I did so. However after several emails things did not feel right. She never directly answers personal questions I put to her, Has seemingly fallen for me after a few weeks of correspondence and is now talking about coming to visit me in the U.S. The IP of her emails is from Quebec as far as I can tell--there seems to be no IP link to Moldova or eastern europe. This person is using The Bat! even though she claims to be writing from an internet cafe. Her computer is supposedly being repaired. She has my full name and address. She gave me a name and address in Drochia Moldova and sent me a link to send her flowers (dreamflora.com) for her birthday, which I did using my credit card (I KNOW!-I am stupid). The floral service supposedly sent the flowers and the last email did mention the flowers. What do you think? Is this the woman of my dreams?
Please confirm my fears so I can move on to getting really annoyed.

Posted: Tue Apr 13, 2010 1:43 am

Yes, the signs of a scammer are there, as you suspect:

- She does not answer personal questions.
- She has fallen in love with you quickly.
- She is using The Bat! - a mass-mailing programme, which no ordinary person looking for romance needs to use.
- She says she wants to come and visit you.

Saying that she wants to come and visit you is likely to be the aim of her scam: she is likely to ask for some kind of financial assistance to do this. It might be quite a believable story, for example about how she has all her necessary travel documents except one, and she doesn't have money left for that one. Or it might be more blatant.

Scammers using The Bat! usually send out 'scripts' - pre-written letters. They don't always bother to read your replies, but just send their next script in sequence, which is why they can seem to be ignoring the subjects that you have raised, and not answering your questions.

Yes, 'she' is likely to actually be a 'he'. The photos that you have undoubtedly been sent may be of a model, or may be of the scammer's relative or friend.

If you go to our sister site ScamWarners, and have a look at the Romance scams forum here:

http://www.scamwarners.com/forum/viewforum.php?f=13

you'll see lots examples of early romance scam letters, and may find a lot of similarity to the ones that you have received.

You might like to post your own experience there as well.

Posted: Tue Apr 13, 2010 3:15 am

It's been a while, but occasionally you'll run into FAKE flower services, sometimes that will include VERIFICATION that 'your girl' got the goods you sent.....that are operated by the scammers. It's a scam in itself....

I looked at dreamflora.......and at the Who is. It's russian owned. Domain registered 2 months ago. Sad

I'd watch your credit card for fraud and/or cancel it.

You may even dispute the charges?

Check the 'reviews' page? They have 'reviews' from 2009, but the site was created in 2010???

I'm curious if the IP of the emails from the girl, and any emails from the flower service are the same?

Hello I'm New here! Joined: 12 Apr 2010 Posts: 3

Thank you all for your replies--I guess I needed outside confirmation for what I already knew. Yes, I suspected the flower service was a fake and canceled my credit card yesterday. There have been no other charges to the card but I figured I had best be safe. I checked the IP of the flower service confirmation email and it is based in Moscow so it seems to be different from Alla's IP. I am waiting for her response from my latest email asking lots of personal questions and telling her I will come to Moldova to visit her. Love is dead. I will post on scamwarners later.

Posted: Tue Apr 13, 2010 7:27 am

I have no doubt the flower seller is a scam in itself, Stepan said it is and he is always right about these things Wink

I was thinking perhaps the flowers were sent to another victim of the same scammer, it certainly wouldn't be the first time that one scam victim is used to make another scam victim think they are real.

That is not what happened in this case, but it is something else you need to be mindful of.

Posted: Tue Apr 13, 2010 9:49 am

The florist - or flower seller is controlled/set up by scammers. (fake website)

The money sent for flowers/chocolates/gifts etc is simply cash and not goods.

For instance $50 for a bouquet = $50 for the scammer.

See this report http://www.scamwarners.com/forum/viewtopic.php?p=25766#p25766

Quote:

We communicate some months, it is not short time and we become very close, Svetlana asked me that if you have good relation to me, why have not you send me flowers yet, by this way. I will be happy to get small bouquet, inexpensive, attention - this is what really important for me, you know, post does not work out well here and when I tryed to send flowers from USA to girlfriend for Day of the medical worker, and it could not went throw also, I tryed 3 timed with different sites and at least i sent nice flowers in time throw this site: (website link) by this way you can use the same site, i do not need expensive

I only hope you understand me.

This scammer used the very same tactic later in the bait - when "her" birthday.

Posted: Wed Apr 14, 2010 4:09 am

This is a nasty fake florist - he also has jewelry available and possibly is phising for email passwords too.

yellowsnow I hope you did not use the same password for your account at the florist as the one you use for your email account. If you have, please change the password immediately.

Quote:

Domain Name: DREAMFLORA.COM

Registrant:
private person
zygmantovich vladimir vladimirovich ([email protected])
Petra Glebki 90 7
Minsk
Minskaya obl.,220136
BY
Tel. +375.375296575453
Fax. +375.375296575453

Creation Date: 10-Feb-2010
Expiration Date: 10-Feb-2011
Domain servers in listed order:
ns2.agava.net.ru
ns1.agava.net.ru

Administrative Contact:
private person
zygmantovich vladimir vladimirovich ([email protected])
Petra Glebki 90 7
Minsk
Minskaya obl.,220136
BY
Tel. +375.375296575453
Fax. +375.375296575453

Technical Contact:
AGAVA Software
AGAVA Tech Department ([email protected])
Pervomayskaya St., 1
Dolgoprudniy
Moskovskaya oblast,141700
RU
Tel. +7.4957816537
Fax. +7.4957816537

Billing Contact:
AGAVA Software
Gleb Trofimov ([email protected])
Pervomayskaya St., 1
Dolgoprudnyi
MO,141700
RU
Tel. +7.4957816537
Fax. +7.4957816537

yellowsnow do you have any emails from this florist?

Posted: Wed Apr 14, 2010 7:13 am

I've checked out the site and this is very nasty to kill Confused

There are some indirect signs that it is a scammer site, but no hard evidence to convince the hoster to get it shut down. I signed up and went through the whole process, in the payment page you actually go to a https page of a company that deals online payments for several sites.

Posted: Wed Apr 14, 2010 12:07 pm

Can I guess the other sites look fishy, also?

Confused

Hello I'm New here! Joined: 12 Apr 2010 Posts: 3

Hello All--here are the emails I received from the florist--yes passwords changed and credit card is smoked. Here is header and emails I received. The emails are from a solomon sharberman.

From Solomon Sharberman Sun Apr 4 21:32:41 2010
X-Apparently-To: [deleted] Sun, 04 Apr 2010 14:32:35 -0700
Return-Path: <[email protected]>
X-YMailISG: <snipped>
X-Originating-IP: [89.108.66.111]
Authentication-Results: mta1175.mail.mud.yahoo.com from=;
domainkeys=neutral (no sig); from=dreamflora.com; dkim=neutral
(no sig)
Received: from 127.0.0.1 (EHLO cp16.agava.net) (89.108.66.111)
by mta1175.mail.mud.yahoo.com with SMTP; Sun, 04 Apr 2010 14:32:35 -0700
Received: from sunnyfl9 by cp16.agava.net with local (Exim 4.69 (FreeBSD))
(envelope-from <[email protected]>)
id 1NyXQv-000326-7P; Mon, 05 Apr 2010 01:32:41 +0400
To: [deleted]
Subject: Welcome to Dream Flora
From: "Solomon Sharberman" <[email protected]>
To: [deleted]
MIME-Version: 1.0
X-Mailer: osCommerce Mailer
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <[email protected]>
Date: Mon, 05 Apr 2010 01:32:41 +0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cp16.agava.net
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [2081 2081] / [26 6]
X-AntiAbuse: Sender Address Domain - cp16.agava.net
X-Source:
X-Source-Args:
X-Source-Dir:
Content-Length: 339

Quote:

Dear XXXXXX,

We welcome you to Dream Flora.

we hope that you will enjoy your shopping

For help with any of our online services, please email the store-owner: [email protected].

Note: This email address was given to us by one of our customers. If you did not signup to be a member, please send an email to [email protected].

Quote:

Dream Flora
------------------------------------------------------
Order Number: 695
Detailed Invoice: http:XXXXXX
Date Ordered: Monday 05 April, 2010

Happy Birthday Alla!
Big Kisses,
XXXXX

Products
------------------------------------------------------
1 x A Dozen Red Roses () = $75.00
------------------------------------------------------
Sub-Total: $75.00
Flat Rate (Best Way): $0.00
Total: $75.00

Delivery Address
------------------------------------------------------
Alla Gudal
Parovaya 13, Appt 4
Drochia, MD-2068
Drochia, Moldova, Republic of

Billing Address
------------------------------------------------------
XXXXXXX

Payment Method
------------------------------------------------------
2Checkout

Quote:

Dream Flora
------------------------------------------------------
Order Number: 695
Detailed Invoice: XXXXXX
Date Ordered: Monday 05 April, 2010

The comments for your order are

Your order has been delivered in time.

Your order has been updated to the following status.

New status: Delivered

Please reply to this email if you have any questions.

Fixed blowout - Branwen