RUSSIAN Romance??

Information on romance scams and scammers.

RUSSIAN Romance??

by needforspeed Wed Dec 28, 2011 6:46 pm
Could someone have a look at this and see if its a scam please?
[1st Email Source Code]
x-store-info:SmXCjkY1Un5L3qlTmewTw2528Vzv4BD3pHcjsXuajJlLBhiyeQPaAb3BDkw755SNSmAQF29oJM86pfRg1Fze8OMcwr71BoY/z2FsRxF+K+iebS+hA65/+g==
Authentication-Results: hotmail.com; sender-id=temperror (sender IP is 217.146.176.222) [email protected]; dkim=pass (testing mode) header.d=yahoo.com; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: [email protected]
X-DKIM-Result: Pass(t)
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtHRD0wO1NDTD0w
X-Message-Info: DFa+w7oqK+9KtdTT4RrJBX6a9ax2hC643zpl/CubkeGnltcu4zkbtJQr+MqBokCkH5ixuwJG0iciat11XbWrUicOmSREehVxkUdAOlq80CxOthYgQ7vVSyoAyyJ9QrJ2ZfokIxp7Lf0=
Received: from nm24-vm6.bullet.mail.ukl.yahoo.com ([217.146.176.222]) by SNT0-MC4-F21.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Fri, 16 Dec 2011 04:33:51 -0800
Received: from [217.146.183.214] by nm24.bullet.mail.ukl.yahoo.com with NNFMP; 16 Dec 2011 12:33:50 -0000
Received: from [77.238.184.71] by tm7.bullet.mail.ukl.yahoo.com with NNFMP; 16 Dec 2011 12:33:50 -0000
Received: from [127.0.0.1] by smtp140.mail.ukl.yahoo.com with NNFMP; 16 Dec 2011 12:33:50 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1324038830; bh=aNP2nux+oJKCONJhErSj3HCu1DDsCXuWeel91rWhqZo=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Date:From:X-Priority:Message-ID:To:Subject:In-Reply-To:References:MIME-Version:Content-Type; b=WzIvlUs5anEcdT3qPa1xBzGtcV+0E6WJFKN1+O+4+T6wL1pe7gMtQa0cpjVsop1QKzIZXzaOVpMmOMJu0b8wF9zYkaLTaZG5IS9JXRx8TobMuWsq1m1F7FZQBlCbWE1xYIrGVv2aLtvUtC07xLAyySQhBqzLbZpFz6PRs9ed78Y=
X-Yahoo-Newman-Id: [email protected]
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: VvUM3lkVM1mlvcktirfbdPAnlJFYeHXEnCulRv.edmpE07V
BvRD8i1uHEGY6CueLJF483wnlPZm0hq9Yg7gYetCjYW.WQq5woc6PU4jIyhm
_kfAe5EwDNhuiK7zrtJZaNkRjsx3RabKH8Q4kNBfcQ8iEAhf8qV3XA10NUqX
E1g.F0et74t61lIhaK1WH6708RjE2riDd7j3LnXwjJKVYMvatkU0SBa.2jMv
MCADNlEkGxqgQcz8oex74USnm0V3K_0WLlZwoJ47Fw.Ijo6TJC6EOe7RYzYO
cwItkAusAnhtNR4egNhRsXpqLCmIF0n4AsxLaaX1jblUSr3anGOMclq7GRho
JO_1W4op.HT_jL6I-
X-Yahoo-SMTP: uSqEyrmswBAmYibVytuo3K1u7gYRDO.RUzk-
Received: from [172.16.1.250] ([email protected] with plain)
by smtp140.mail.ukl.yahoo.com with SMTP; 16 Dec 2011 12:33:43 +0000 GMT
Date: Fri, 16 Dec 2011 18:31:52 +0600
From: [email protected]
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: Francis S Crocombe <[email protected]>
Subject: Hi
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------118381551078B107"
Return-Path: [email protected]
X-OriginalArrivalTime: 16 Dec 2011 12:33:51.0912 (UTC) FILETIME=[F7B18A80:01CCBBEE]

------------118381551078B107
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<html><head><title>Hi</title>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Diso-8859-1">
</head>
<body>
<span style=3D" font-family:'Courier New'; font-size: 9pt;">

[2nd Email Source Code]

x-store-info:SmXCjkY1Un5L3qlTmewTw2528Vzv4BD3pHcjsXuajJlm8uaNFkh1drnjdoaSmNWfVvxGkezR+AWUzBS3i84N1DBCHOgFKhKUSxxIRGfp5Fe4pGhfE3r5DA==
Authentication-Results: hotmail.com; sender-id=temperror (sender IP is 217.146.177.79) [email protected]; dkim=pass (testing mode) header.d=yahoo.com; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: [email protected]
X-DKIM-Result: Pass(t)
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtHRD0wO1NDTD0w
X-Message-Info: DFa+w7oqK+9KtdTT4RrJBQV2F43qRRF9V/6eowJLXgx5KoUra9F4eW5az9j4sVzjml4iy/75dUZEUtUCu6A48eVbYlQkQnqn534Q+v/AhPueRGSIve7KDvWVlEqiWNw02INaaeS3SKA=
Received: from BAY0-MC1-F27.Bay0.hotmail.com ([10.1.207.37]) by COL0-IMC1-S6.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Wed, 14 Dec 2011 04:03:40 -0800
Received: from nm25-vm3.bullet.mail.ukl.yahoo.com ([217.146.177.79]) by BAY0-MC1-F27.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Wed, 14 Dec 2011 04:00:59 -0800
Received: from [217.146.183.182] by nm25.bullet.mail.ukl.yahoo.com with NNFMP; 14 Dec 2011 12:00:59 -0000
Received: from [77.238.184.76] by tm13.bullet.mail.ukl.yahoo.com with NNFMP; 14 Dec 2011 12:00:58 -0000
Received: from [127.0.0.1] by smtp145.mail.ukl.yahoo.com with NNFMP; 14 Dec 2011 12:00:58 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1323864058; bh=J4C4pqA/eyKY51Aayz1hmBgkUKvGIPAV+1PsJFRazEE=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Date:From:X-Priority:Message-ID:To:Subject:In-Reply-To:References:MIME-Version:Content-Type; b=w+X+hdCGzfKoyF1SE7eUcfyPS2IQy1517g7AW0CYwiiZKWVo83t2BNXUvhmVCN5DM0Ze2LxdcmycAk87DOgW+F+981ObKxmGekiTZBkEcV6MHJMTWMAJopacqUG09yLBIQ5v+SpRB86ZKwOHP2zojq76HZVBXbGXJMorfTCH5G8=
X-Yahoo-Newman-Id: [email protected]
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: geb1AysVM1l1VQ.db0XjhpT5oEctFp9pb3CscFvkyu0irxG
IIYxY8TQWwreIiJJZKwGlRYUGu.03vQ9w.H5_IyyukKO0WJBTsDkiQMYUwAA
5BNGIpc4rh.rycLoODEbKze08dIiABTmka8XEwWjoXv0zRDK3lom1CN9W1Ri
4UZTHh30TaFOOxaV6hyfXgFaFVWyC7Za1LiBe0DH_7eJjhd.1ZT.WKgZ7XzU
jJpq_f0vX9TPvQogTCMn9jyltwm1vSQZwOlL.W8j4u__0QH_dWo6.TeHpUC_
7eZ8sL81K3.dUMg_3oxubM6UcKTmb8EKdL7GFUpgBDk8ig_vv3wLflepBK_K
d3K_fgiTOn7XMmw--
X-Yahoo-SMTP: uSqEyrmswBAmYibVytuo3K1u7gYRDO.RUzk-
Received: from [172.16.1.250] ([email protected] with plain)
by smtp145.mail.ukl.yahoo.com with SMTP; 14 Dec 2011 12:00:54 +0000 GMT
Date: Wed, 14 Dec 2011 17:55:20 +0600
From: [email protected]
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: Francis S Crocombe <[email protected]>
Subject: Hi
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------2F772133CC787B"
Return-Path: [email protected]
X-OriginalArrivalTime: 14 Dec 2011 12:01:00.0067 (UTC) FILETIME=[0B8E5F30:01CCBA58]

------------2F772133CC787B
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<html><head><title>Hi</title>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Diso-8859-1">
</head>
<body>
<span style=3D" font-family:'Courier New'; font-size: 9pt;">

I have more if anyone needs to have a look. The numbers and codes are different in each email! Is this normal?
Advertisement

Re: RUSSIAN Romance??

by Andy Hood Wed Dec 28, 2011 7:03 pm
IP is a "probable" track to Lisbon, Portugal. There could be other reasons for this though. Thats why it is a probable. Can you please post more info? What kind of personal info are you being told?

Re: RUSSIAN Romance??

by needforspeed Thu Dec 29, 2011 7:58 pm
The letter starts by exchanging info like what do you do for a living, hobbies, family, exchanging photo's. Then it progressed to her planning a holiday over here so we could learn more about each other. One recent letter told me that she booked her holiday from work, travelled to Novosibirsk to stay in accommodation whilst she applies for a general visitors visa, meanwhile she arranged medical insurance but couldn't afford the air tickets, so she asked me to help her by sending money through Western Union. The letter today started by saying greetings francis, but further down the letter she called me kevin on two occasions. I couldn't believe she left accommodation in Surgut to find temporary accommodation in Novosibirsk where the visa centre is. Surly she would be paying rent for two places. Also she asked me for euros, i don't use euros.
The latest source code for today is shown on number 2.

[1 another letter source code]

x-store-info:SmXCjkY1Un5L3qlTmewTw2528Vzv4BD3oVwPqvwx6IvjjEdpJLuHYf1z7fFuZfkvvOeZfJqITKsd5Mg2YQzjKTSqBuY0hDFdno1pDTAEdjhFcuZxi4uIFg==
Authentication-Results: hotmail.com; sender-id=temperror (sender IP is 72.30.239.23) [email protected]; dkim=pass (testing mode) header.d=yahoo.com; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: [email protected]
X-DKIM-Result: Pass(t)
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtHRD0wO1NDTD0w
X-Message-Info: DFa+w7oqK+9KtdTT4RrJBbgpuFj+YGGTuN5sMpYhLwsBZqteBJMLDE5dkKivwICcjpSOR4bDgm/GR6u0IbjY/maGRVwVxEASI9GnmYxG1d1FORHPmagHS/evuoDSNYNcIMy044V6qq4=
Received: from nm38-vm7.bullet.mail.bf1.yahoo.com ([72.30.239.23]) by COL0-MC1-F8.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Tue, 6 Dec 2011 06:15:28 -0800
Received: from [98.139.212.150] by nm38.bullet.mail.bf1.yahoo.com with NNFMP; 06 Dec 2011 14:15:28 -0000
Received: from [98.139.213.9] by tm7.bullet.mail.bf1.yahoo.com with NNFMP; 06 Dec 2011 14:15:28 -0000
Received: from [127.0.0.1] by smtp109.mail.bf1.yahoo.com with NNFMP; 06 Dec 2011 14:15:28 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1323180928; bh=qg5Rhadg8B0TuGtbad96RD5uEXsqCO4scFwmFEO2zpc=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Date:From:X-Priority:Message-ID:To:Subject:In-Reply-To:References:MIME-Version:Content-Type; b=xNxuD27XCknTC1uHcz/KI1JcAtdUrBN6YclC7yFit7k6lgZAw9gA0vJWo4NgMar9kEMf8IxhfNj8fMuYywNrpRuRtJWsAzvHROMh39U22Bf+bsQ2saXdnLrkckO0XnnWpPeibUjCdlKsdc1S/lp9p6s409Rvq34FeQ3xJ9lCMXA=
X-Yahoo-Newman-Id: [email protected]
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: MRrKYsIVM1luDcfRq9enhllawFLYwS_dHbQYPz7pFW_Cz11
0wZdqyQSGUEqgDUX_oH2e35i99qzG7j7rAQ7wij4fpXQ6uwwubHWunIQ6aj6
wc_drE1Jk01jovf2Kg0ElQPMQ84XiRd7KJKwikn9dGbl._W.9xgl_cmXUz8S
KLW7yyyV_CKz.nvG8.OrCmPMP8cfQnjmOBiFrFyOb3mxWW0VTL.kNReLQMKT
KvwpdLSyvKBz39tHws6aluwlXdiSrVW8nlQ_bScPyMrKrXbG0GXJQeNb5.sc
qhnMBLmhfzJf8Wxalf__4PulFj5fEl7MXPj.bNus2O_RLGm9PSEbP2wvAbgI
2tKSIQfPtcFsvvoqnN_pMMt07ixMURJZjFbJlYq681yoz
X-Yahoo-SMTP: uSqEyrmswBAmYibVytuo3K1u7gYRDO.RUzk-
Received: from [172.16.1.250] ([email protected] with plain)
by smtp109.mail.bf1.yahoo.com with SMTP; 06 Dec 2011 06:15:26 -0800 PST
Date: Tue, 6 Dec 2011 20:04:01 +0600
From: [email protected]
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: xxx
Subject: Good afternoon
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------3493FD2DCA9251"
Return-Path: [email protected]
X-OriginalArrivalTime: 06 Dec 2011 14:15:28.0681 (UTC) FILETIME=[81852990:01CCB421]

------------3493FD2DCA9251
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

[2]

x-store-info:SmXCjkY1Un5L3qlTmewTw69gy3Wq4YV3cVJjJxgjBnSxbTpOoEyP6lUaSk8TAHa5K/oPqPg+z6iQfaiudCH4cOAQDmy0PYvNPRoJ+2ax0a+i3EdIoDH9DNF2RCVyj01w
Authentication-Results: hotmail.com; sender-id=temperror (sender IP is 217.146.183.232) [email protected]; dkim=pass (testing mode) header.d=yahoo.com; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: [email protected]
X-DKIM-Result: Pass(t)
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtHRD0wO1NDTD0w
X-Message-Info: DFa+w7oqK+9KtdTT4RrJBfmJPAWG0qKnyLsmFAfBWbW4jVw2itzLB9mJtskCZOLGNjH7hxplrK2hTFk5U8V8DOWfyOlpmeXAIFzKArPUwgDU2Hk+zva7xPBab9hskrPDyw3F8zSk384=
Received: from nm5-vm0.bullet.mail.ukl.yahoo.com ([217.146.183.232]) by COL0-MC3-F14.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Thu, 29 Dec 2011 03:23:43 -0800
Received: from [217.146.183.217] by nm5.bullet.mail.ukl.yahoo.com with NNFMP; 29 Dec 2011 11:23:42 -0000
Received: from [77.238.184.64] by tm10.bullet.mail.ukl.yahoo.com with NNFMP; 29 Dec 2011 11:23:42 -0000
Received: from [127.0.0.1] by smtp133.mail.ukl.yahoo.com with NNFMP; 29 Dec 2011 11:23:42 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1325157822; bh=B+JPBHOtwqvyV3LJmAVX6PTZg5c4CpGzqH3ck7srHIw=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Date:From:X-Priority:Message-ID:To:Subject:In-Reply-To:References:MIME-Version:Content-Type:Content-Transfer-Encoding; b=c1ch1f2iDV6iWgcy/YAUy5F93mUjUgZLYDqZHNEgd/IVcfXdd87uT/SyNnRU1ZX+sYEzJ9Jm/PXbBFYxQZ58GVxfN3mT7aAsr6Hn7Q/U1E1mHqnItMVFUh0/3dn1adHdEowe8+m6CEDk1wW9YARjMqlVPzgVne4giZjmNqVoKT4=
X-Yahoo-Newman-Id: [email protected]
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: KN1IJ1oVM1ncIeF0eFSPskLqosbS.ueX0ZLHinYOXAIEgI1
_ZpVS1hGx6uz_URrjwAWWwXVGcv6RcerWmw.zVeA.9_y_SKGb6jukVL4b.dy
merjZKd2slLNetFwAOLFEXV_yBScJDpV.cXYwuRs2bYtuPykYAJta4MtpIYd
DixrfDi_iRnaW8ZA5rsCRACM75OeFUAqad2uebBcRJEkE7M3gDIJJZGBsL0A
HomoBEL2_iQqS3OeQSWASmy.oDiAYHinVt5W9.VIBu3shNv2zETeMsMkLsqs
vZBGRBp.tN0lkdN5yTmJJ3L4CIX3VnJ0amzB8y2O8OnaGSVPXEVfYAdAvJhY
qegwBE8oY5ozRbg--
X-Yahoo-SMTP: uSqEyrmswBAmYibVytuo3K1u7gYRDO.RUzk-
Received: from [192.168.88.96] ([email protected] with plain)
by smtp133.mail.ukl.yahoo.com with SMTP; 29 Dec 2011 11:23:41 +0000 GMT
Date: Thu, 29 Dec 2011 17:24:02 +0600
From: [email protected]
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: removed - dotti
Subject: Hello
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Return-Path: [email protected]
X-OriginalArrivalTime: 29 Dec 2011 11:23:43.0523 (UTC) FILETIME=[52AB1730:01CCC61C]

Greetings my darling Francis.
I have read your letter.
I sit also to crying, I do not know, that to me now to do.
I do not ask from you money, I ask from you the help.
I am ready to waste time, money and my forces. Because I know, that I wish to meet you. I wish to be with you. Both of us want it. You want it? I do not have not enough 325 euros. Therefore I ask you to help me with this sum. I have already learnt all information here. Next week I am ready to go to you and to meet you. I ask you there were to me 325 euros.
We do correct things, and I am confident, that we will be happy together. I should have your support. We should be one command and then we will be happy.
We with you have dreams which we can carry out after our meeting. When I think of the future, in my dreams there is you Kevin. I should tell to you, that I did not test to anybody such strong feelings. I love you Kevin.
Well, here I admitted to you. In the dreams I represented, that I am you for a hand and I look in your beautiful eyes and I say these important words for me: I love you!
I will wait for your answer.
Yours Anastasiya.

Re: RUSSIAN Romance??

by Dotti Thu Dec 29, 2011 8:11 pm
This is what matters right here:
by nm5.bullet.mail.ukl.yahoo.com with NNFMP


NNFMP is a little-understood yahoo protocol, but it is most often associated with spammers and scammers. It typically indicates forged headers.

Alone, it is not definitive evidence of a scam, but when you add the "quick to fall in love," pushing for a visit, the rather unusual visa arrangements, the name confusion (missed a couple of copy-pastes) and the WU request, you are squarely in scammer territory here.

Need to post photos? http://scamwarners.com/forum/viewtopic.php?f=28&t=3219
Are you a victim of a romance scam? Read here for advice and FAQ's.

Re: RUSSIAN Romance??

by needforspeed Fri Dec 30, 2011 1:50 pm
Thank you very much for that info. I will be more careful next time.

Re: RUSSIAN Romance??

by vonpaso xlura Fri Dec 30, 2011 11:37 pm
She's scamming several victims at once, and there's another named Kevin. I once had a conversation with a vladina in Russia (Izhevsk, Udmurtia, to be precise; at least that's where she said she was) and figured out she was talking with many men at once in a different manner. This was long before I knew anything about romance scams. I know a fair bit of Russian, and as her English showed clear signs of being Russian translated by computer (and not hand-composed with a dictionary - I know enough Russian to tell the difference), I started talking with her in Russian. After a while, she reverted to Babelrybski, while probably mystifying another victim with Russian. When she claimed to have studied English and German and forgotten the German, I knew "she" was a fake. (I already knew she was either a man or an Udmurt because she said "I have never been married" in the masculine. Udmurt lacks gender.)

Anytime anyone overseas that you don't know asks for Western Union or MoneyGram first, without trying other methods of payment, it's a scam.

Also, it's pretty hard for a woman of marriageable age in a Second World country (and even harder in a Third) to get a tourist or visitor visa to the USA. I don't know about the UK, never having been there, but it's probably difficult there too.

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10
Return to Romance scams

Who is online

Users browsing this forum: ClaudeBot and 15 guests