Information on romance scams and scammers.
by rvp1 Sat Jun 23, 2012 6:50 am
This is my 2nd time reporting a scam. Ever since that first time, I've been able to sniff them out. I am a member of a dating site and it seems I've been made a target. I understand it is a risk meeting people this way however, I have met a few nice guys.

I have been contacted by someone else and at first it all sounds great, however the stories all seem to be the same. This person is a widower for 5 yrs, wife died in car accident, deceased parents, has a son 10yrs old, grew up in Florida but currently lives in New York. He is currently in London on business.

Below is the header for his e-mail, can you tell if it's legit? He did send me some pictures but I thought I would wait to post them until I heard from you first.


From Stephen Webster Fri Jun 22 05:10:21 2012
X-Apparently-To: [email protected] via 98.136.183.139; Fri, 22 Jun 2012 05:10:24 -0700
Return-Path: <[email protected]>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: TJW5dUMWLDt9A7WQV3MoSxZxoliFmJTVMxOU8aGhWNBIJHsl
r3QHmat.yHtn4q8_xM0ukjQk0X4w1ypkoKCOmyJh1o0mWOswiTCWHusRLhiL
NA_TYJgIrdc9wblp.WK1VuQ6GHpUnaCKE8D7qhme5gyljGqMXUWpqib63YCR
XLY2L7TZMnkDVJ9nQvFoWO.wzYfvhuez_6CmIvTonCbPVSFLUp_ejO2oko_z
hFYmXyTi4HP4XR8zFc.E8.JcDKRxT7mGryulanRtx.WUfIdj0X8B4UI8wVeP
FtAju7BDb.YPJXJxQ6W_L50neG_0UcgYh9eEO4lPB0m1ongL18pebEOU7XsO
qIsl8_s_AqcGJZNaAWpCn3zuSomeaMbBNUvG93TFYwj9Any4qYu_Xr717Y9t
c7fMKqJXfPeis6JeCxa3o9I.q3.hrW1.2DzWrARAkNw7LBt8lX6rhBb1Vq2g
D63GtdixzxwjQWkDJMx6543Xyrhl8eSOWcDy.Qq0LWHpJNpTKQz7DVrKQP.w
mSkK0dd1VIg6XD3.jitUiXVAqmPqkuhrcI5Q9a6bXbNFn.ScNbq6I4ObcumU
uQNPa34oFBIyvhCZe3sIp7gvawKWDZBfm4E0DiJWNFO.PQvdE9TtE4sWiEWA
QqYX4CW6m7Xy40c_4aJ4LxNK9E.Eli1kXesRrMg_Aa2_k5YeKW5lqZ6w6pjw
LbGOJb9Rt.FAa1__nepQPpLZpKOpJIAlq7r19qEK_dacj8FQgqIKRFsIF9Bi
pfEVpRvw7FPUUUv.XhmWvo2krzJy6GGaVCqysBndn7VmtQdkuZYMfT6r35Yc
l8qZzcn3EYx32QNZAllTElfN7l8za8C3OU.mt2wkvYkpi.9WwURL1Cy5Pvy9
eJ0wojihJXiSz0yVgOTVEdOruapO2616RBn5JGW3c8GtA5GK1FphuUkG7mfZ
pzVldBpASMlIpepKN0dlW1TwuuoUaAGCmux_iAoALy6kcPxdM.gBGqZ3DHCu
kV9JAjntXEjNGz0MbTh5tRiBd1y9Lu049kCzf8U4Saa98jvsnipdx5TDE2Pc
WQ6B0z0VyercQZ2kQQCiPvvmYMTvh2SDuVLC9N23UU_xGfSUwVt4e7StJyrr
TY_NBgL_plxaAJFT1a9SN.Jgzpc6DFjuSsCi8DNGGCAYmERRTQj.0iZNfkoF
5Th4tONin9ATuVLKwxRYT5kvT.1GAvOcb7VyHbCbotVzCkCesRmyeJJRU._L
ROFJH1RzDdVP6tTmVU2InGlvBezCnzt2Gxvpp0.uQUgfn4lICdXn7XlnXtXg
tK75qwayWDMpfM1K8VQ-
X-Originating-IP: [98.138.91.39]
Authentication-Results: mta1006.mail.sp2.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm2-vm0.bullet.mail.ne1.yahoo.com) (98.138.91.39)
by mta1006.mail.sp2.yahoo.com with SMTP; Fri, 22 Jun 2012 05:10:23 -0700
Received: from [98.138.90.56] by nm2.bullet.mail.ne1.yahoo.com with NNFMP; 22 Jun 2012 12:10:22 -0000
Received: from [98.138.89.174] by tm9.bullet.mail.ne1.yahoo.com with NNFMP; 22 Jun 2012 12:10:21 -0000
Received: from [127.0.0.1] by omp1030.mail.ne1.yahoo.com with NNFMP; 22 Jun 2012 12:10:21 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 98013 invoked by uid 60001); 22 Jun 2012 12:10:21 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1340367021; bh=8EBpJcnwtQTUfqg8y1UyRf6fk5UYjKZ6kVSu+nxcM8c=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=T3emGlb/k6QurGx3AP5Ti6TV+f4vCeLjbOfIinExB453vrmiPDYtp4k1QXKBr13MDojUm+t86ntDXlVehbB+bGxcZwYOE4JcEh5zk3vE/Un2Ba7nZV7W0NFi6sJBpPgsybBC3iMTObV7oKwbF0tMGMJtdpW7PoE0iWlCokj93EM=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=3EHD08qV4MQaiGWB15YBYEFMHw64tKAdzhSHlAzPZGrFlYtaszcKwbZRFrteDCFqB+jSlxl8Rpup48DLRMufTuA+jyMlkK9k7i48x7wxNoxrIh7ien3j0flOMQ7sQ+8+hh8oqWRmyE8w435fEE4sQBu7MKKAIjql0Y35mUUjhw4=;
X-YMail-OSG: 5MZ8x7kVM1k452whxwJS4zJtKeOBag6iYuOt0l4qQC2ExVj
Y2xRVxXtUGLGLXJuNcLvyxfprGM7N6OG5qzYXUUcjpF0eh9diRiYFici0DXo
UuMV8cE3XfXQVw2JyHNsC6ALeyLqUMH13syh7k1g5w7e3bcXuO0x1ohzketh
9lJQQQ8uiwG_Va358_.JiFzwxQ8wz64U5NgJvQP9DfutPqhLgls0SIGwgOA.
hIFHxJX.LGI3uqW4dtr34LkTHS.vIlDbbFUbF7g9q5MviwaWD7SB9ZePOuH4
vePWq9UHMItfKKpxaswupvEYAfzEMgAo5Yq9Z2IQedBH4mzu18Blm9jVpGGz
7lIoFJaVL7AV6bRQGZDWRp14PVEJR7KkVh4rZwsFD_961mmXPbRaX9DzNA2Y
un.vIhqNQwPHx
Received: from [41.215.160.161] by web122306.mail.ne1.yahoo.com via HTTP; Fri, 22 Jun 2012 05:10:21 PDT
X-Mailer: YahooMailWebService/0.8.118.349524
Message-ID: <[email protected]>
Date: Fri, 22 Jun 2012 05:10:21 -0700 (PDT)
From: Stephen Webster <[email protected]>
Reply-To: Stephen Webster <[email protected]>
Subject: about me!!
To: "[email protected]" <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="-140725594-1286559198-1340367021=:97045"
Content-Length: 171264

Thanks
Advertisement

by jolly_roger Sat Jun 23, 2012 7:55 am
From what I can see, the header has not been forged in any way. The mail appears to be originated from the computer with IP address 41.215.160.161
ISP for the above IP address is tigonet out of Accra Ghana, part of the Millicom group.
Re: He is currently in London on business. It seems the email header posted above has not originated out of London. Perhaps he sent it before travelling there, perhaps?
by Dotti Sat Jun 23, 2012 8:44 am
The Ghana IP says it all. Your suspicion is correct. He is a scammer. The background, too, is typical scammer.

Unfortunately, merely having a profile on a dating site makes you a target. If you are over 40 years old, you become a bigger target. If you started to correspond with a scammer and seemed to believe it in the beginning, you become even more desirable as a target.

The best thing you can do is stay aware and stay safe. Make sure you limit the personal information you give out until you are absolutely certain the person you are talking to is real, and be alert for signs of a scammer.

Need to post photos? http://scamwarners.com/forum/viewtopic.php?f=28&t=3219
Are you a victim of a romance scam? Read here for advice and FAQ's.

Who is online

Users browsing this forum: ClaudeBot, Google [Bot] and 13 guests