Information on romance scams and scammers.
by NotInDisLifeTime Sat Oct 23, 2010 5:43 am
I met this man on a dating site. He said he lived in Columbus Ohio, was widowed, lost his wife and daughter in a hit and run accident four years ago, but had a son, and was doing his best to be a good father to him. He said he was born here in the states but his uncle took him to Germany when he lost his mother, and his father was no where to be found. He went on to say he grew up in Oberhausen Germany, and claimed his uncle had a business here in the states that he came back to take care of.

This is the first email I received from him.

Hello !!!Thursday, October 7, 2010 1:30 PM
From John Freeman Thu Oct 7 18:30:48 2010
X-Apparently-To:
Return-Path: <[email protected]>
X-YahooFilteredBulk: 98.136.45.13
Received-SPF: none (mta1225.mail.mud.yahoo.com: domain of [email protected] does not designate permitted sender hosts)
X-YMailISG: pGfo2RwcZAqk9oYy9OaWi6yCoePbvSvJjrBaXBb2WQihE6Yf 8PUJcTzKfcUUhcPd4Ekee6oUgBfi9aXnlupUuLO5fQmWKbz5BwSKaovQZ.9R Gxx3ATRp0Kb08_Q3VGFmQVywnnfcq_MBgoVFjrVP79bMLao9dMoMYRH.bNfG RpdO3JPshcZ5YDgMP19tCpS2axGJ5xdgKkneqRepx02yg57C3v9gtTlQJvRF 4aRewRyJKllQI5Mqi4BwkXEFQlb1bIdyMtlNTjjB.sOCLdjatNeQrNpIGu95 L1CuygnOyh3s4QQqtMvMp96PE5ZEKqPtePqLU3hEhxiX1qGO4u6xBSRHomOk aS3bn_FiXwZmhR97qVS2eW1J9cFW_fS7nJE8oB4mkanvHFkkrO2_QwVwOY95 5axWl4VekZpOV03moNwt8gPKzQr4R6lR6EO1VrMV3eNX1MgefeqF38Go5xmD hH86GQGzaO5xjIeyff7zivNZKtdG77gL6PtIs8GXyHh_7BTulY8akyQOZyaA prhqBMbB2UFo4nBFUW0OK0dxi9RybhYJywKhVf4sOrgTxBfwm40S7fdzlBuy rYN5jvUqKGwkXDUcdoKMlYO8VTlPY_sw8ooHRcdbOuOr6KaLGT0-
X-Originating-IP: [98.136.45.13] - Later discovered the IP is in Sunnyvale, CA
Authentication-Results: mta1225.mail.mud.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO n66a.bullet.mail.sp1.yahoo.com) (98.136.45.13) by mta1225.mail.mud.yahoo.com with SMTP; Thu, 07 Oct 2010 11:30:50 -0700
Received: from [69.147.84.145] by n66.bullet.mail.sp1.yahoo.com with NNFMP; 07 Oct 2010 18:30:49 -0000
Received: from [98.137.27.132] by t8.bullet.mail.sp1.yahoo.com with NNFMP; 07 Oct 2010 18:30:49 -0000
Received: from [67.195.9.110] by t4.bullet.mail.gq1.yahoo.com with NNFMP; 07 Oct 2010 18:30:49 -0000
Received: from [127.0.0.1] by omp114.mail.gq1.yahoo.com with NNFMP; 07 Oct 2010 18:30:49 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 77787 invoked by uid 60001); 7 Oct 2010 18:30:49 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1286476249; bh=RLOzZHi/2KqsBJ1oC8OSb+QHrNujZFYtDNRtBmq9+oI=; h=Message-ID:X-YMail-OSG:Received:X-RocketSRV:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=ZAJ6Stdymy8ux+tyEKuNvHgHVYygv6IhcFRVW/Gieth9plh7kEEFKhLRJAMcA0fbVaILhxj7IRuvx3JSzKxhDQuZMvGjXPf55QO5TH4z5rkbJuHxfem6MUcs9mPg75x4LqSpicy9d7KfkLGsPuHQnu0yAGu25MyasdExSBYSNLA=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-RocketSRV:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=XcA1fjEQhKp7O/6Wt9B0PHt1+pSoMxuToMzaLGPcBdpAmf1SpHpREsnTBTu+WImzcsLJ8KpIRVg1k/BnPuSKRecx8IiN8fFtt10XLJFottybqGYXGDy20wLrWvrdrqwVdlja4WJToJ8GapUViaEenQ5sZj5w/V/2kUjZvX6xJDU=;
Message-ID: <[email protected]>
X-YMail-OSG: b5q7Tl0VM1l6974ngp3Q_p96IjYvW3bmk4MvOBXsOtXb2ud 72KCzdlRkMoXWDkFPx.2cF5FRKw4paPLXO6L8sNz4s_e_SGIF1k7Bs5cjkk9 UE7T55lFzYtZ1xijaIfpbFFZG_pZuDFEgcdEQRp0toO_ZNgSG52RQASqwofw KdzcrBd53VVYk6rgrkKoa6VnGkrKSfRtgKv7PsP5DTXCA5hgyzLYf7jmLTY5 zPsXK8LINRVTPgoI53BkiU0ePestkGFN12cR5JEV3Yv15DgIpXd6x8FTn4KT pMMzO
Received: from [41.218.197.88] by web114216.mail.gq1.yahoo.com via HTTP; Thu, 07 Oct 2010 11:30:48 PDT
X-Mailer: YahooMailRC/504.5 YahooMailWebService/0.8.105.279950
Date: Thu, 7 Oct 2010 11:30:48 -0700 (PDT)
From: This sender is DomainKeys verified John Freeman <[email protected]> View contact details
Subject: Hello !!!
To:
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-866549178-1286476248=:70553"
Content-Length: 7039


Good afternoon to you. How are you today? Thinking of you fondly I just want to say Good afternoon and I hope you are fine and enjoy all you do. Just wanted you to know I was thinking of you and God bless you today as I know He will do. Just want you to know that i really enjoyed talking to you last night and am really happy I meet such a sweet wonderful woman like you and getting to know you. I just want you to know you that I care about you. Stay blessed

I care,
John

Then I received an email that made me suspicious, so I copied and pasted the first sentence into Google and found the very same letter on PoemsLovers.com
http://www.poemslovers.com/love_letters ... s/309.html

I MISS YOU SO MUCH !!!Sunday, October 10, 2010 2:31 AM
From John Freeman Sun Oct 10 07:31:46 2010
X-Apparently-To:
Return-Path: <[email protected]>
Received-SPF: none (mta1024.mail.sp2.yahoo.com: domain of [email protected] does not designate permitted sender hosts)
X-YMailISG: ghuJ_iocZApJ5fmspK3.V47m2Q1eZ3bZUN_J6UJz0x9x2a7t aewr1ZCr1ZLSuYTnNZCM60YTYVSQILfllYlbM7ugkf_h8NBAxfkac7Mt9rH6 eUpvys9FC7WLV.Eg_8X2tCv3HDZXwvUJOsMDFP64vyOsnZt6PHj64atStlxb ys5nhrWdu2yfgwFd33jnPoSuCyV2FCFBu_ZF_ex67k1EI7ciDglnCkWuZYzy H_DJCEO9oNkC6KMtZ1MpxhBHgTv4QYfXKi0_.F4ZgfyCR0_wefzrZCWfDk.F nf5Fc3P3qj_3kd_mlta6UlvKTygDxNQn0KYPqnu_Zn9LTkgvhB2hclsoYPi2 uGxG_6_VlOgD7l2uR8lsIuHvljP8YIMRIVCsFzyspbQU8Tlf1AsUPmN_scDe m5IVhy6y3JePODU1BENwB_lnl7OqlmETuYsL6lERiwDT9hvDUgDV1PnNl3Wh 0DVxesmLxyXprN28cDgVWCuGZPGNYz_NYbfRAVCSgAg9r3d4Ugbv1ABDeKIr r2SlTH4eP6Y2gRBFDAfNQizsiv_PkOZNTkyTRwYGv5kpVl.XSA_fB7HgAL2G pHsDJ17pZY0b.9CDnkwQZBsObsQdo_WHNt8MGs2YIN45CfPfEG5q8MLuUY0J nuX8Pj0BC_.Rl94cYJNBKTaQ4aPeJXjq8qQGCqjA5MfM5dc4ifRasZE5XPOn RWppFqzT2OnxDdo9WYPe9h1JS1N94W6NiQOCD17_HgbHs2Vjk7BwcMbczJR5 Fgw4UNPkG.Kwig_dlZ.BbofTjoapAKkkhEutbkQ7yREkmY58vkIem0gKk6Fa GnVKvMXqzC7XjMlYEw--
X-Originating-IP: [98.138.90.69]
Authentication-Results: mta1024.mail.sp2.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm6.bullet.mail.ne1.yahoo.com) (98.138.90.69) by mta1024.mail.sp2.yahoo.com with SMTP; Sun, 10 Oct 2010 00:38:32 -0700
Received: from [98.138.90.50] by nm6.bullet.mail.ne1.yahoo.com with NNFMP; 10 Oct 2010 07:38:29 -0000
Received: from [98.138.89.171] by tm3.bullet.mail.ne1.yahoo.com with NNFMP; 10 Oct 2010 07:38:29 -0000
Received: from [127.0.0.1] by omp1027.mail.ne1.yahoo.com with NNFMP; 10 Oct 2010 07:38:29 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 41360 invoked by uid 60001); 10 Oct 2010 07:31:47 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1286695907; bh=WZKPWvWGPos27BtJXyOmNT0oaxO64hgpoA9N+8MBpZc=; h=Message-ID:X-YMail-OSG:Received:X-RocketSRV:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=CypyLIrMN47sjG9ZmrCaaLH1sTesG4MFe/PhaU/GssMVHuiJ+EtmE2bhgUNMD8BqENn3LNOtW5atuEO3HuUdK33w1igEKadK76cVdizsH4xMIYeJD7Sq6sKMRbm7JF/B7y4x3rcxXM7YuuWa0NgwbZmTKEFE5Ik5yMB2wFRyxu4=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-RocketSRV:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=TJ5pT3BPHOiJ4Q2K97ykMWB3TaSsE1U18gpFAZMami8e4EE5Vv6A0T5CbgvhAvkvIkhoQmDqwl5QfuCZPd/HUeFlhnCeiQGz2YlcY0/xqG9hFhf0pk94i7lsFxaG/15sdIcAQG0WUANGSWs45hK4qfpZYJ++XBTI6hhJcOqa/TQ=;
Message-ID: <[email protected]>
X-YMail-OSG: 02DBpT0VM1n6dy2XYyvHln_W.d0ZhG4xwiHIOOZD8KtfJYV Jnn4eUWPnxuwq28g02l6JLzPuB3.AUSd4Uuz5Pi6z7Q6oJGE_RW_5xPV9DVU yevHV2S6AUaYuGD4nnd9IJE4__TELGz7bJbS38.lqmU8dP0t.e8PngUGHzyB C3FoaUUsAMWA8971dkoxrfg8Dem2GVzwFfp.ZNQa8BJ8IdEkZ0oQkzIGTAbP NiNK37Y6dkxEe2CL0NYxPE3vpttMBvnt8N8Robte3lQvO9yemb3uHNsad81u OtC4-
Received: from [41.218.235.21] by web114215.mail.gq1.yahoo.com via HTTP; Sun, 10 Oct 2010 00:31:46 PDT
X-Mailer: YahooMailRC/504.5 YahooMailWebService/0.8.106.282862
Date: Sun, 10 Oct 2010 00:31:46 -0700 (PDT)
From: This sender is DomainKeys verified John Freeman <[email protected]> View contact details
Subject: I MISS YOU SO MUCH !!!
To: MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-399597983-1286695906=:39044"
Content-Length: 9766

Hello,

Hey Beautiful, I just wanted to do something simple and to put a smile back on your face. I want everyone and the would to know that i have met a beautiful woman like you, a woman that mean a lot to me. Ever since you entered my life, I've been flying on cloud 9 and I have not come down yet.LOL....

I tell you this everyday, but you are the most beautiful person I know, inside and out and I see that more clearly with each passing day with your messages and time spent talking to you. I love everything about you, about us, you and me . You do something to me that no other has, you have made me so happy, the happiest I've ever been. You give me the most amazing feelings inside, a kind of feeling that is hard to find the right word to explain. I squeeze my pillow at night wishing you were here to hold me and kiss me goodnight....and tell me not to worry, you will be here when I wake up ....God I'm blushing lol. I have missed you so much and wish i could just pick up the phone and call you but is late and don't wanna disturb your sweetdreams...

I still don't know what I did to be so lucky to have you in my life, my dream come true... I am so thankful though. In this short time that we've been together getting to know each other, we have grown so much and I can't wait to see what the future holds for us ....Hope it will be something beautiful. Take care, and I'll talk to you later.

Hugs and kisses
John


Hello DarlingWednesday, October 13, 2010 1:14 PM
From John Freeman Wed Oct 13 18:14:24 2010
X-Apparently-To: Wed, 13 Oct 2010 11:14:29 -0700
Return-Path: <[email protected]>
Received-SPF: none (mta1195.mail.sk1.yahoo.com: domain of [email protected] does not designate permitted sender hosts)
X-YMailISG: sCycOzccZApyY7n76qy.jobAEqJOzfz6E.RR8s_jf5Y9AXyV e_vb0GuW9XUESOr0MISTzNLZefzDUxaIPyr9LZcYltq459Y_CxqZ29pfNSnu f4Pxu._asaOskrhmPMmTkvSZBaxAXKF.7TQu5P_tj9LOtsK82ewWkAhuDoD0 rkBl8XhTC9lO1LTa.NavEvtx5JG4DuLWOzet1wlb8CRz_ltC2._eLpvFP8hl sKLEbP4jbcVr_mhecivxx8bXxcUosKaYEJ5RJzWWm.Ae9IUJsbTyqcaE3gK1 Qcz97rT32TxN21ZMF1yIC.L_JN8ffFv9C_onoPk8TFXNltZIt9YX9VM5jilF b_c31aeRLKM2xwlULIOlzf6OOiVpsN8cdn_ci3WIC1wWd03lsr_I0CtHS1CX 7g8px7YuOkCRrIWCMmCakKclr.FRc.USCwurkFdw5ZFQQfvaemawmLp978dx .lsDe93gjj5M1tq.2Gn1AgytJoNKlZfOEg8qpWVajG32wW_yq2tdWrqu4TYz Yri66Ct97spoXRMGYfy.Z5N2uAcQraF9zOpx6vZ1rT4I2FXcrlt7AY_aMOX. ucMQrBknoRirVskFvlwPwMpIW7zcXrlBCr5CTONRqgCexcDHwNgFAz3IWTg-
X-Originating-IP: [98.139.91.222]
Authentication-Results: mta1195.mail.sk1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm22-vm0.bullet.mail.sp2.yahoo.com) (98.139.91.222) by mta1195.mail.sk1.yahoo.com with SMTP; Wed, 13 Oct 2010 11:14:29 -0700
Received: from [98.139.91.65] by nm22.bullet.mail.sp2.yahoo.com with NNFMP; 13 Oct 2010 18:14:25 -0000
Received: from [98.139.91.15] by tm5.bullet.mail.sp2.yahoo.com with NNFMP; 13 Oct 2010 18:14:25 -0000
Received: from [127.0.0.1] by omp1015.mail.sp2.yahoo.com with NNFMP; 13 Oct 2010 18:14:25 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 34797 invoked by uid 60001); 13 Oct 2010 18:14:24 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1286993664; bh=ir9gZtcfHwIxgDcnaTbbAkWHaKv3ySmI6xs8lAelGL4=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=CEwUZy9hlXKHC/HVukZGweWx85VR8mWJ2NSHClq7+FoiUmwPS8TGJ1wG1Q0ou//iCOlUlfR4Enwyxs6tbagfVhGXAmcWFVzQx/o51ySwS/PzBH5M7+GQYAiOrCX2QVOhXKWTGbU3CzoTny9h3M7xca0ZC+0B1JW4m01aOWCUyxM=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=1wqj8m4NTmLjVqcjlr0404hjRWD2+iIISz1t8BwQenOSXY7gY+QjTjP2vYH9/G4YKEHMS6BrqFEpYIIZwbCMHUWfCyVfg1A1t++GtGUVplofinsedyR+Ly4sMlUNWKfQah2wqsA46+l4uLB+3wUVcbFNOGJ0IZgx7asXHnvhM3Q=;
Message-ID: <[email protected]>
X-YMail-OSG: crvaJZcVM1lE8LawaoTAsexyvpqwUjDe6lI8Cdm8qMR4jGM CkkcnzJKqvRPX9x2oH3mAuWFSMFJ.l8ukIGK3GAE7WLszI2zq3iCyrq5qgKU Zqab9yu6W0BL6pJvxSnTFk7_6r92PObarH2WgLkT9NHclFRj2wiMgjW5aETN jKUSYP2nWR_ZJlHkiSWMoK2nJcms4xtQALZkolLD4yikD2H4DoqKP.L_aq1z fK.nrXv66kcaYMk4njdd6mXwCUI8g3Q4fk8KosRog4OxPLn6CSW5RXhtVtqa fKrXi
Received: from [41.190.89.51] by web114209.mail.gq1.yahoo.com via HTTP; Wed, 13 Oct 2010 11:14:24 PDT
X-Mailer: YahooMailWebService/0.8.106.282862
Date: Wed, 13 Oct 2010 11:14:24 -0700 (PDT)
From: This sender is DomainKeys verified John Freeman <[email protected]> View contact details
Subject: Hello Darling
To:
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1033504573-1286993664=:25481"
Content-Length: 13749
Compact Headers

Hello Honey,

Since day one we've shared something incredible, something that most people only dream of...You, you, you and you alone reign in my heart. You are the one i desire without whom i could not be complete. I will live for you alone and i will work for you alone. I will share with you my thoughts, my heart, my mind, my body and everything i got in my life. I can not wait to embrace you in my arms honey. I will never use force on you not even by words. In your presence, i will always be honest, transparent and sincere. I want to be at your side ...just hold you, kiss you squeeze you and love you till my life drain out of my body. Honey all that I want to get at is that I love you so much and everything about you is so perfect and choosing you to be with me is and will forever be the most wise decision I have and will forever take.
After I got of the phone with yesterday, I had a call that the goods has arrived safe at port of Ghana so am in the bank preparing my travelers check and my credit cards for the trip tomorrow. I LOVE YOU.....I will get back with you later

Love always,
John

Since arriving in Ghana he has experienced a number of problems, and is now asking for financial help from me. I've told him I can't help him, and he claims to understand, but always turns the conversation back to needing money. He asked for my address stating he wanted to send me a check to cash for him, and added he also has some "goods" he wants to have shipped to my home. I told him I couldn't do that and have severed all contact with him.

The following are pictures he sent to me.

Image


Image
Last edited by NotInDisLifeTime on Sat Oct 23, 2010 6:54 am, edited 1 time in total.
Advertisement

by Mac Ramses Sat Oct 23, 2010 6:05 am
You made a note on the IP being in Sunnyvale, CA. That's not the location of the scammer, that's the IP Address of the Yahoo! Mail Server.

Read headers from bottom to top, and usually the first IP is the one you want.

From the 3 headers here are the IP's.

Received: from [41.218.197.88] (Ghana Telecom)
Received: from [41.218.235.21] (Ghana Telecom)
Received: from [41.190.89.51] (Zain Communications, Ghana)

As you already know how to get headers, use the following online tool to help you identify the IP's quickly.
http://headertool.apelord.com/ or http://www.iptrackeronline.com/header.php

I am the son, begotten by Ra
by NotInDisLifeTime Sat Oct 23, 2010 6:19 am
Thank you for the information Mac. It will come in very handy.

Who is online

Users browsing this forum: ClaudeBot and 18 guests