Is this a scammer?

I met this guy online and so far I'm not sure if he's for real or not. He says he lives in Italy and that makes me wonder. Here is the first email header from the email address he used


From [email protected] Wed Jan 18 09:43:41 2012
X-Apparently-To: xxxxxxxxxxx via 98.138.91.87; Wed, 18 Jan 2012 09:46:20 -0800
Return-Path: <[email protected]>
Received-SPF: none (domain of photographer.net does not designate permitted sender hosts)
PC9URD48L1RSPjwvVEJPRFk.PC9UQUJMRT48L1REPjwvVFI.Cgo8L0RJVj4K
Rm9udDogQ2FzbG9uTm81NDBTd2FEPC9GT05UPjwvRElWPgpQaG90b2dyYXBo
IGlTdG9ja3Bob3RvPC9BPjwvRk9OVD48L0RJVj48L1REPjwvVFI.PC9UQk9E
WT48L1RBQkxFPjwvVEQ.PC9UUj48L1RCT0RZPjwvVEFCTEU.PC9URD48L1RS
PjwvVEJPRFk.PC9UQUJMRT48L0JPRFk.PC9IVE1MPgEwAQEBAUltYWdlMTEx
LmpwZwNpbWFnZS9qcGVnAwM5NgJsb2dvMi5qcGcDaW1hZ2UvanBlZwMDNQIw
MSBVbmEgUm90b25kYSBTdWwgTWFyZS5tcDMDYXVkaW8vbXBlZwMDNDUxOQIw
MiBBcHJpIElsIEN1b3JlLm1wMwNhdWRpby9tcGVnAwM2Nzc2AjE2IFVOIEFN
T1JFIENPU0kgR1JBTkRFLm1wMwNhdWRpby9tcGVnAwM1NTYy
X-YMailISG: jKaHys0WLDvnplCSgW3e_ESDigkO.WQ.oY9wywp8za86Bewn
rTqGfTIKdyyqciYITVScVQQR2ZmQ2AH9T2GvtwATVKsk3qfOTzde1sqx8CVW
cNNa.YHyBm6ixmIxro6sOLL..qHrRD44.ZhxGFJ8Xc6vgLjUETbbsd87lyyf
D1YJK7vtVlp3g7Oq0dsAAkVR4MEYnAUiqIR7VwzoZc4orAND6mZbfEY51rhj
.DLvAcMleuP4.MKvW2GD.n90hMd5ZV2aMTUsQvSEYR2HGEzgl_WU117gHnk7
jzyhRIWq4Am8ITH6LgIloYxDeqlt6KaiOITnumnNTUx2cjvaaNquuhZaEdWS
1wqnzv8vSlsfTGYaDlVR8d.w1M8Jen3P5Qp1SMKBqMK548_ZnqcuYanXfRMj
ODEPcm30jcFGrsKbLNlzorSugRDCXBBxskdt787ojMAhwdkdATv15eLTHYDM
Itch8MOw9F7hYoelVk0jqamU5UD.Ud55uKmyZNsEIsuRtqOvj5FD.QevTCUo
m9lUW3IskqAybYNsLF4frmbbwomOPH3_8W8nEN37AWcb9772PC1KJ0PKBAWg
488YUPCkARwkjHmgskxlhvDfUdVxxsaDstFnZl6eYU3x1eKMXsIVRwomgieG
2WdC1izk0Bd1ssQBqgZwTJKg_NKD8fwRSvSUzklek1fddSy9DrQ_I9U4gHTo
NpDNpCkdyvO1sl6Hx8VXrVBLHf.ToRPImpvNdzI_VXYLEEnlO3mN99iD0ShW
3MbpRHV43g9PvJgcmyLATG6GmaG825K_7puhlS4EqZvWvFZ7ZNdd.MZdKSLh
U_JiETHK3AdWCVaaX.xsgNHNwnPAzfKLhcOfhuiRqaFdWjJzey0O2IQK8MQk
yxoOg9PcNeAGZe8WKqcrNrTGBIKgFVkh2bfzr.AWwEBQ3xRWf3qxaJcZR_r3
mzG1.ADx2MvNxStrAnkocnr.rbRKRPHctLvyt2nyfVMU3XdWVoCr0Ky4VNmo
PbyJNw--
X-Originating-IP: [74.208.122.35]
Authentication-Results: mta1092.mail.mud.yahoo.com from=photographer.net; domainkeys=neutral (no sig); from=photographer.net; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO mailout-us.mail.com) (74.208.122.35)
by mta1092.mail.mud.yahoo.com with SMTP; Wed, 18 Jan 2012 09:46:18 -0800
Received: (qmail invoked by alias); 18 Jan 2012 17:43:06 -0000
Received: from host102-4-dynamic.36-79-r.retail.telecomitalia.it (EHLO seven-up-PC) [79.36.4.102]
by mail.gmx.com (mp-us009) with SMTP; 18 Jan 2012 12:43:06 -0500
X-Authenticated: #120904451
X-Provags-ID: V01U2FsdGVkX1+5vEJbEUy5wIJdW1FMO1wkBiL+P6Afvb0zO2j34S
Rk2CCelQ33ZN20
MIME-Version: 1.0
Message-Id: <4F1704CD.00005F.02760@SEVEN-UP-PC>
Date: Wed, 18 Jan 2012 18:43:41 +0100 (ora solare Europa occidentale)
Content-Type: Multipart/Mixed;
charset="iso-8859-1";
boundary="------------Boundary-00=_T890OAX66RO000000000"
X-Mailer: IncrediMail (6295163)
From: "[email protected]" <[email protected]>
X-FID: 2D452667-EDD7-4A2409783-FF7A63E5F6C1
X-Priority: 3
To: "xxxxxxxxxxxxxxxxx>
Subject: song7
Disposition-Notification-To: "[email protected]" <[email protected]>
X-Y-GMX-Trusted: 0
Content-Length: 17366565

When I check the IP it looks good to me. But now here is another email address he used.

From andrea puglisi Wed Jan 18 15:52:17 2012
X-Apparently-To: xxxxxxxxxxxxxxxxxx via 98.138.91.217; Wed, 18 Jan 2012 15:52:39 -0800
Return-Path: <[email protected]>
Received-SPF: pass (domain of gmail.com designates 209.85.160.42 as permitted sender)
bj7CoDwvc3Bhbj5zb25nPC9zcGFuPjwvc3Bhbj4uLi4uLi4uLjwvc3Bhbj7C
oDwvc3Bhbj5hbmRyZWEuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4u
Li5raXNzPC9zcGFuPgEwAQEBAT0_SVNPLTg4NTktMT9RP1RpX0F2cj1GMj0y
RW1wMz89A2F1ZGlvL21wZWcDAzYwOTMCVW4gS2lsby5tcDMDYXVkaW8vbXBl
ZwMDNDQ4OQJVbiB1b21vIHBpYW5nZSBzb2xvIHBlciBhbW9yZS5tcDMDYXVk
aW8vbXBlZwMDNDEzMAJWaWVuaSBEYSBNZS5tcDMDYXVkaW8vbXBlZwMDNTI2
NgI9P1VURi04P0I_V0dsc2FYTnZablFnMTVIWG5OZVIxNXpYbVNEWGtOZVYx
NnJYbFM1dGNETT0_PQNhdWRpby9tcGVnAwM1NTU5
X-YMailISG: xDTuafcWLDuDSMEt1JgbBGnUaWgLo_fTSybIMgZttg7AMFZE
4ueC5efN4h.PR_dAnghtD0X_Z56BvTV7FdkShONY4jiNzpDL0uHM8o32BlYi
M36WyW2Sii2PEK7BXhDof5RKIJenQc4Ydd_K5bKozfic8ZsSewL25CbRuJfD
MBOryiTa.yQjObkwH8YoW2sweiLxiyW_h7piFjsiyqmqsXurGDQshEywfbbu
WIW_qKBXtPOb8KDwl6jwh2ttwUvPL6VyJzY_.GSMwL.1x_60XLw65OimwqUI
2q9Z0V0uWoGPQ36GHXAuZpfx3A_Kj2JFwkW5WNLjjoJU9XovdqqN5xGJQX55
lzkGKNv8bOSgnD5_Ky5hZ9lqce01XUfPQUbyXdzXt1.WjQYH0HS7ucYOCRLU
ez0k.ApEj5pOtSG1kbbhvtg3qzRPCmjmF.zY9tFoR8C2BMbGu6VL9NJW8GJC
ZmX1SWMn636Aud_Z7Wr06_wu3iPTd0zFY.0ht7007o1s5dDlSPt_mvW_A0Ye
aTbXvhNuo5R9.nOaAogT7prYjnQUpWUQHYBlYBH2rRCnThlXJUlF8YJe6ie_
0H6Zfp86L4DhiPq3dOWZ51DyMTqm4NO7N28bn2Mtz.e7zikV3RYZaGgL7V5F
vcsxWR4QsDrkGO7rk13qaYVI9jaW3GMMnKpXNgVtqlzkdzNUsXZjw35pAMqB
i0ZPZJeJ7r3v3jYrNTwN6fllfHpDayNqfOseoCFsDNhQYJGDjc0D6q4KXrdX
oJOuyBrIOBcetx5D5WmzP_95IHdWbE1O6.AtUSDHFDtT1WZLUQ9aiE2J3Rtq
CAq0rFtoX56f1frny15QtapG_KgTJblUnxZzX4J41E4e_0g5j8bFSaHOT794
CXcI1T2MhWs0yn.QCIrZ0M3sRttO.VIq3.euyW8JDqVy9TbhYXmsEZ4zF2q2
x.C0KkOfd74YOnsOtwA6AUmOrS9iXvdqvzjhq9VlL3QIQkRczA--
X-Originating-IP: [209.85.160.42]
Authentication-Results: mta1334.mail.mud.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-pw0-f42.google.com) (209.85.160.42)
by mta1334.mail.mud.yahoo.com with SMTP; Wed, 18 Jan 2012 15:52:36 -0800
Received: by mail-pw0-f42.google.com with SMTP id 3so1092380pbz.1
for <xxxxxxxxxxxxxx>; Wed, 18 Jan 2012 15:52:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=mime-version:date:message-id:subject:from:to:content-type;
bh=fPS+dQIrX7LW3dhOJliKT5q8r9Bs5Xgkyyi7sjfBo9o=;
b=wSSmG6n5R2yboAsaJSm8FzxLWLLoeWlmMlnuoLvTuZhqt+TZB3H5PoVY5bDuyAPqNm
iGiKXZcY3BTexTjbNlmOeoD9rN9waCrJGlnRC+5Z527fQ2umjUWrfp4526MUmnZwDMJO
jxnJzEY9xkXCpfHvrVsxooifVu1mL+Uvqc3/Y=
MIME-Version: 1.0
Received: by 10.68.73.68 with SMTP id j4mr47332704pbv.40.1326930743062; Wed,
18 Jan 2012 15:52:23 -0800 (PST)
Received: by 10.142.204.17 with HTTP; Wed, 18 Jan 2012 15:52:17 -0800 (PST)
Date: Thu, 19 Jan 2012 00:52:17 +0100
Message-ID: <CANY+wmJXaoA5vbXWhL=Zvk+rF+EHUYJHbZ-ia95Lj76u7dSqfg@mail.gmail.com>
Subject: songs10
From: andrea puglisi <[email protected]>
To:xxxxxxxxxxxxxxxxx
Content-Type: multipart/mixed; boundary=f46d041b47e89517b804b6d623b1
Content-Length: 26149711

Can anyone help me please?

[email protected]
gmail doesn't send IPs, sorry

IP: 74.208.122.35
Hostname: mailout-us.mail.com
ISP: 1&1 Internet
Organization: 1&1 Internet
Type: Corporate
Country: United States
State/Region: Pennsylvania
City: Wayne

mailout-us.mail.com is associated with lots of scam and spam
IP yields 1,110 results on google

Can you provide additional information on Andrea Puglisi?

What kind of information would be helpful? I just met him and so far don't have any proof that he's a scammer, just have that gut feeling.

The first emails/messages he sent you would be helpful. If you are not comfortable posting them, you can send them by pm.

I too got a romance scam from an X-originating IP of 74.208.122.35 (a computer in America!).
They requested 19700 roubles:

"Hello my loved Mike!

I have read your letter attentively. But today I am a little tired, as I had many affairs. My dear Mike, today I talked to Mother. I asked it as I can arrive to you. My Mother has told, at it the girlfriend went abroad Russia earlier, and she addressed in special travel agency. Today I went to travel agency, I have learnt concerning a trip to you. And I have been a little upset. To me have told to go for border limits at first I should conclude with them the contract, at the beginning of official registration of papers. About contract nondisclosure. Concerning that that all documents I will make out it at them in agency.

To me have told in agency, the tourist visa, the passport for travel abroad, the medical insurance is required. And cost of all expenses of 19700 Russian roubles. It is the huge sum of money. I even could not think that these not so important documents, can cost a large quantity of money. It is awful. Most of all it is a shame to me, because I do not have such sum of money. And me remains except how to ask nothing your help. My loved husband Mike, I simply ask your help? I really do not know that to me to do. I still will talk to Mother about documents. I to it yet did not tell cost. Because right after Agencies I have gone to the Cafe Internet to tell about it to you. I at all do not know as to tell about it my Mother, it will be shocked. She at all will not believe that these documents can cost such big money. I hope you understand me?

Now I finish the letter. I am very strongly tired today. And I wish to sleep. I ask you, answer me as soon as possible. It is sweet I kiss you on the mouth. With love Nastenka."

From [email protected] Tue Mar 6 07:42:33 2012
X-Apparently-To: *****@yahoo.co.uk via 212.82.110.169; Mon, 05 Mar 2012 20:50:49 +0000
Return-Path: <[email protected]>
Received-SPF: none (domain of mail.com does not designate permitted sender hosts)
X-Originating-IP: [74.208.122.35]
Authentication-Results: mta1011.mail.ird.yahoo.com from=mail.com; domainkeys=neutral (no sig); from=mail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO mailout-us.mail.com) (74.208.122.35)
by mta1011.mail.ird.yahoo.com with SMTP; Mon, 05 Mar 2012 20:50:48 +0000
Received: (qmail invoked by alias); 05 Mar 2012 20:50:44 -0000
Received: from ARouen-651-1-441-50.w92-132.abo.wanadoo.fr (EHLO comp-1) [92.132.26.50]
by mail.gmx.com (mp-us009) with SMTP; 05 Mar 2012 15:50:44 -0500
X-Authenticated: #129319184
X-Provags-ID: V01U2FsdGVkX1+Lc2AwU0SLY3DgjnzCKWRfdKFl54rAHnpK8NR6ii
X+WfZthju9xWxO
Date: Mon, 5 Mar 2012 23:42:33 -0800
From: [email protected]
Reply-To: [email protected]
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: Mike N <*****@yahoo.co.uk>
Subject: Hello my loved Mike!
In-Reply-To: <[email protected]>
References: <[email protected]> <[email protected]> <[email protected]> <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------C4DD1C33E8D9DB0"
X-Y-GMX-Trusted: 0
Content-Length: 43040