IP Address Technical Question

A user hijacked my previous IP Question Post so here is another question. A potential scammer from Poland claimed he was working a menial job in Malta for a month. He has a yahoo.de email address. When he was in Poland all his dynamic IP addresses originated from Poland. The time he said he was in Malta the dynamic IP addresses originated from Malta. So far, so good. But when he claimed he returned to Poland, his email IP addresses STILL ORIGINATED FROM MALTA. Also, the spacing between paragraphs is now two or three times normal. The top text line of each email since he claimed he returned from Poland reads:
Normal 0 21 false false false PL X-NONE X-NONE

Is he still in Malta? Could he be back in Poland and still have IP addresses originating from Malta? Is he using a Maltese proxy and forgot to turn it off - Could that be causing the screwy spacing and top text line?

Someone tech savvy please respond.

P.S. Will try calling his landline in Poland to see if he is really there.

We need the full headers to answer the question and also the full email addresses he uses. IP numbers are easily faked and as was said before, he may have faked his Polish and Malta IP and not switched back. We don't have the IP numbers to check if they are a proxy. Until we have full details it is impossible to go further with this .

THIS MESSAGE HAS BEEN DELETED BY USER.

with NNFMP

A trick which scammers love to use.

195.158.122.131 SEEMS LIKE A LEGIT IP and not a proxy, and Pawel seems like a real Polish name. Is there any reason why you think this is a possible scammer? It is not unusual for Polish people to go and do menial jobs overseas as do many FSU people. They get a better wage, and a holiday for a while with work chucked in and save up while away.They are often Engineer and Medical Students etc. on a year out. Why not work all summer on a fruit farm, or picking onions, or beans on piece work. I don't find there is enough to label Paul as a scammer in any way. There are many reasons why an email can bounce about the system and not get delivered for a few days, even if we assume it takes seconds. I don't know why you ask us about this and I feel that we have had to wring the info from you to answer.
REMOVED BY ME is his facebook profile seen after I wrote the above lines. I am certain I am correct and that Paul is a decent Polish man studying Ecomomics at University in Krakow. You have the definitive answer. Mods please note.

WIKI

NNFMP is an internal protocol not recognised by IANA or the RFC's. Yahoo uses this protocol to internally route e-mail traffic across their network. The acronym stands for "Newman No-Frills Mail Protocol". It's a simple, high-performance protocol comparable to QMTP.

The Quick Mail Transfer Protocol (QMTP) is an e-mail transmission protocol that is designed to have better performance than Simple Mail Transfer Protocol (SMTP), the de facto standard. It was designed and implemented by Daniel J. Bernstein.
QMTP uses fewer round trips, or transmissions compared to SMTP.

An internal mechanism we have no control or option but to use in Yahoo.

I have seen the post viewtopic.php?f=13&t=22625&p=63741#p63741 and think you refer to this person. I think he is able to travel to US AND IS TAKING A YEAR OUT FROM uNIVERSITY TO GET AROUND A WHILE. He probably saved up his fare to US from his work and he wants a visa for temporary work when there. I still see no connection here with a scam attempt and am completely satisfied that Paul is an honest person

Thank you Began Steele for your very detailed and knowledgable answers. This gives me a great deal of peace of mind. But please note, you did not need to "wring" the info out of me. I answered immediately upon reading your post. If I was hesitant in providing specific info like names it was precisely because I was not sure whether Paul was a scammer or not and so did not want to post his name. I consider this responsible behavior as I don't believe in blasting someone's name or info on the Internet unless I have positive proof.

What still concerns me is that Paul claims to have arrived back in Poland six days ago but his IP address still originates from Malta. It is not a question of an email bouncing around a few days because his latest emails are replies to my emails which I have sent since he supposedly left Malta. I cannot think of a plausible reason he would lie about his whereabouts as it has no bearing on our correspondence. Perhaps I am being over-cautious about being scammed, but it doesn't make any logical sense that an email from Poland would have a Maltese IP address. Because you are far more technologically savvy than I am, perhaps you can provide a logical answer.

Thanks AP . I checked across many websites for the email address given and Pauls email is used to set up the FB profile. Surely he only needs to sign a visa waiver form to visit US? UNLESS HE HAS DONE A DASTARDLY DEED AND GOT BUSTED FOR IT. I doubt that but not I have planned to go to US so did'nt look the recent facts up. Is it possible he is using a card for internet linking? He paid a months worth and is using it up? Please delete his name from posts before. I honestly don't see him as a scammer. Sorry if I seem a bit hard but massive experience also brings some gut feelings. I am not being warned inside by tiny mistakes and I run several sites for contacts/dating and checking IP etc daily to allow or ban. I think I know well, with similar info to what I explain here. I like catching scammers and they don't escape.

To: Began Steele. I am impressed with your sleuthing, especially your ability to track Paul's email address to his FB profile. I only hope your gut feeling is right because I'm in for a lot of grief if Paul is not legit. i'M GOING TO DELETE PAUL'S FULL NAME AND EMAIL ADDRESS FROM PREVIOUS POSTS. Would you please do the same in your posts where you mention his name, FB profile, etc.

Again I want to thank you for your time & research into my concerns. Wish to god I had your technical savvy!

Finally, just to make sure I understand you: Could Paul have pre-paid for an internet card which is why a Maltese IP address is showing up in the header when he is emailing from Poland?

P.S. There are no visa waivers for Polish Nationals. They have to get a visa to visit the U.S. just like in the old days. It's a very contentious issue in Poland.

can an IP address really come from one place if they are somewhere else and if so how is that possible?

@everret, Scammers often subscribe to a service that allows them to change their IP from (Country,State,Region) this will allow them to pretend to be somewhere they are not.

so if I run their IP address and they say they are in Afghanistan but it is showing california is it possible for that to happen?

If it is showing California they are more than likely using Gmail. Some email provider will not release the IP address. You will get the IP address of the email provider.

I am 100% sure you are not talking with a soldier in Afghanistan. Read here > viewtopic.php?f=13&t=6527