Information on romance scams and scammers.
by jolly_roger Sun Apr 04, 2010 3:50 am
Loosen up guys, pay attention.

Have been in contact with a well known scammer since late February 2010.
The scammer made initial contact through an Australian singles site. The profile stated her location as USA.
I replied and when the next email was received, it was explained the location was in fact Russia.
At this point in time, annazhuk profile disappeared from the dating site and I received a warning from another member.
Been writing to the subject trying to gain as much info as possible.

Known to me as: Anna Zhukova 40 I Chernyh Street, Tomsk 634063

Apparently this subject is a member of a scam syndicate.
Advertisement

by Chris Fuller Mon Apr 05, 2010 7:22 am
Thank you jolly_roger. Could you also post one or two emails you have received from 'Anna'?

Scammers often operate in groups or networks, assisting each other when necessary. Sometimes a correspondent might be 'passed on' from one scammer to another; sometimes another scammer will just 'help' by sending a few of the emails; sometimes another scammer might play a different rôle in the scam, for example the character of a travel agent, or lawyer.
by jolly_roger Mon Apr 05, 2010 8:43 am
Thanks Chris for the comments. These damned scammers are tricky blighters, that's for sure.
After the initial contact from the singles site, this being the first email received from the subject.

-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Status: n:0
X-SID-PRA: annazhuk <[email protected]>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpWu8d5UL7ShoVaVjsLzjHr/t75oPNJSIu5scSa1Lt4VxOhXRnjEn8z1vBKDzoByv2FllLqflEvKkv5YGmOGhX2S
Received: from mi1.bluebottle.com ([206.188.25.14]) by COL0-MC4-F48.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Wed, 24 Feb 2010 22:50:53 -0800
Received: from fe1.bluebottle.com (internal.bluebottle.com [206.188.24.43])
by mi1.bluebottle.com (8.13.1/8.13.1) with ESMTP id o1P6ortO018059
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
for <[email protected]>; Thu, 25 Feb 2010 06:50:53 GMT
Received: from [192.168.105.177] (71-9-8-189.dhcp.leds.al.charter.com [71.91.8.189] (may be forged))
(authenticated bits=0)
by fe1.bluebottle.com (8.13.1/8.13.1) with ESMTP id o1P6oK6q014689
for <[email protected]>; Thu, 25 Feb 2010 06:50:50 GMT
Date: Thu, 25 Feb 2010 09:50:09 +0300
From: annazhuk <[email protected]>
X-Mailer: The Bat! (v3.0.1.33) Professional
Reply-To: annazhuk <[email protected]>
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: Roger <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------591A52367BB90E3"
Return-Path: [email protected]
X-OriginalArrivalTime: 25 Feb 2010 06:50:54.0052 (UTC) FILETIME=[E01C0A40:01CAB5E6]

------------591A52367BB90E3
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi my new friend Roger!!!
Hope is it OK for you that I call you new friend?
All apologies for my delay. I really did not have free time before to
replay faster than now. Anyway it is so pleasant for me to get your letter.
So lets begin our dating. Few weeks ago my girlfriends recommended to
me to try to find friend via internet dating sites because I am still
alone and can not find my lovely male. I am so tired to be alone and I
can not find good male around me. So I decided to use my girlfriends'
recommendation so therefore you can see my letter here.
I tried to use some dating sites and I found your profile on one of
them. It called ConnectingSingles if I am right.
I liked your profile and decided to write correct you to learn more
about you.
As for me I must write next things.
My name is Anna. I am 28 years old right now, was
born on May, 23, 1981. I was born in Russia and right now I live in
Russia in city Tomsk. So if you are interesting to know where is it
you could use some search in internet to leran more about my city.
It is in about 3500 km to east from Moscow in Siberia region.
I am an average woman, I am not model or
something else. But my friends says that I am pretty woman.
I'm dark brunette with grey eyes. But time to time I
color my hair as most women I think. But my real hair color is brown.
But I like to be different hair color.
I live alone in an apartment. I do not have any kids and I have never
been married before. But I like kids. My mom lives in my city also not far from me.
I use the program-translator therefore my apologies for bad English language. I
hope that you will understand me. I can not say to
you that I know English good, for example when I am writting letter to
you I try to write in in English then when I reach difficult
words or phrases I use translator-programm's help.
My height 5 ' 7 ", weight about 60 kg (120 pounds).
I do not know how is your system of measurements but here is in Russia
we make it in cm, so my measurements from top to bottom are
87X61X89 in cm.
OK I will try to send a pics in my letters so you will see how I am
looks like, I think photos will say more than words. Today I will send
to you a one pic like I promised. This pic shows to you how I am looks
like just one I have with myself, so I promise to send more pics
next times.
Anyway I hope you will like it and will continue to date.
I will wait for your next letter soon.
Anna
by jolly_roger Mon Apr 05, 2010 9:21 am
The email headers are interesting in the fact, how does someone in russia manage to have 2 IP numbers pointing towards Bluebottle in Melbourne, 1 IP number shows Charter Aggregate in the USA and the other IP number is forged? Running the forged IP through a Traceroute goes from 1 to about 18 destinations (the last being Charter) and then destinations appear after Charter but they are firewalls and no final destination can be read.
The subject says from Tomsk but I'm fairly certain it's not.
I think?? the email originates in the GMT +3 timezone which Tomsk is a differing time zone.
Here is another message received not long ago.

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtTQ0w9MA==
X-Message-Status: n:0
X-SID-PRA: annazhuk <[email protected]>
X-AUTH-Result: NONE
X-Message-Info: JGTYoYF78jFjXm4wFKwMDY1fJbqPHzQneZQAQoAopIqpE1ibVQbvr7YUoXWv57JfRXoUAlvhfMVA4Q5iYJI4T1wcjLdetuq1
Received: from mi0.bluebottle.com ([206.188.25.15]) by COL0-MC4-F6.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sat, 20 Mar 2010 22:05:24 -0700
Received: from fe1.bluebottle.com (internal.bluebottle.com [206.188.24.43])
by mi0.bluebottle.com (8.13.1/8.13.1) with ESMTP id o2L55Oag016582
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
for <[email protected]>; Sun, 21 Mar 2010 05:05:24 GMT
Received: from [192.168.105.177] (84-149.207-68.elmore.res.rr.com [68.207.149.84])
(authenticated bits=0)
by fe1.bluebottle.com (8.13.1/8.13.1) with ESMTP id o2L53XKC016612
for <[email protected]>; Sun, 21 Mar 2010 05:05:07 GMT
Date: Sun, 21 Mar 2010 07:57:41 +0300
From: annazhuk <[email protected]>
X-Mailer: The Bat! (v3.0.1.33) Professional
Reply-To: annazhuk <[email protected]>
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: x <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------E512C13D31519BB3"
Return-Path: [email protected]
X-OriginalArrivalTime: 21 Mar 2010 05:05:24.0907 (UTC) FILETIME=[1D8F27B0:01CAC8B4]

------------E512C13D31519BB3
Content-Type: text/plain; charset=Windows-1251
Content-Transfer-Encoding: 8bit

Hi my lovely friend Roger.
I have some good news for you.
I just return from travel agency and few hours ago I got international passport.
So I will add a copy of it so you can see that I really got it.
So now I am ready to reach you.
I can not to be against my feelings. That's why I want our
meeting and make alot to this way.
But one problem I still have. I do not have money for visa
registration. I had some money before but I used it for my
international passport registration.
So now I need about 265 $ US else total.
This amount includes:
- Medicalsurvey (I might have blood testing before leaving).
- payment for visa registration,
- payment for promptness(because sometimes registration might borrow 4-6 months)
- Interview in embassy
I plan to register a student type of visa because it is the
easiest way to visit you. Other types of visa has some difficulties in
registration or theirs process are long.
But I must ask money help from you for payment for registration of my visa and
for visit your country, because I do not have any money right now.
So I am asking this money help from you.
I must pay for visa and passport myself only because I must
prove my solvency and payability this way, therefore I must do it
myself.
And if I don’t pay for it now, I could have
problems in the future with getting visa. And I don’t want to
miss this chance.
People in travel agency needs I must pay for visa registration in 7-12
days and no more. If I would not pay for registration in this period
my visa access will stop at all and so I will not be able to register
it again because it is really not easy to register visa for such young
woman as me. The possibility to register visa takes once a 2 years and if
not now I will not have chance in future 2 years to register it at
all.
So please try to find way to help me this money sooner, so I might pay
for registration sooner because as you may understand the process of
registration visa will take few weeks.
So if you would send money help that amount today or tomorrow I will be able
to pick up your money help faster and pay for it so we would not loose
any time, so it would take less time and we could meet each other faster.
It would very pleasant for me if you will be able to help to me amount
for visa sooner. I hope on your help. Simply I do not have any other
way to find this money because I spent money for passport already.
Or I must let you know something if you would help to me this money
it will nessesary to do it via Money Gram or
Western Union transfer system because we have only these
kinds of transfer system in our city. Also as I have heard it is
faster and easy, because sending money via mail or post office is some
dangerous and crazy like I have already explained to you, even our
Russian post office has attention papers:
"Do not sending money and expensive things via post".
Also it is not nesesary to send via any other system because
simply we do not have any others in our city really.
If you could make it today it will be very pleasant for me.
If not today please let me know when can you do it???
Hope for your money help today so I could pay money for registration
that will take about 2 weeks.
To prove to you that I really got passport I am going to attach you
a copy of my passport which I have made first thing.
Xxxxx, I want to be only yours.
I need you and I miss you.
Yours and only yours Anna Zhukova

I've noticed the subject does not readily respond to questions and obviously gone to great lengths to disguise it's true location.
by Chris Fuller Mon Apr 05, 2010 10:34 am
Thank you for contributing these emails!

You will notice in the headers:

X-Mailer: The Bat! (v3.0.1.33) Professional


This is a mass-mailer, frequently used by Russian scammers.

Regarding the IP address:

Received: from [192.168.105.177]


This is private IP address. According to Wikipedia:

These addresses are commonly used for home, office, and enterprise local area networks (LANs), when globally routable addresses are not mandatory, or are not available for the intended network applications .... Anyone may use these addresses without approval from a regional Internet registry (RIR). If such a private network needs to connect to the Internet, it must use either a network address translator (NAT) gateway, or a proxy server.
by Crispy Duck Mon Apr 05, 2010 1:00 pm
Received: from [192.168.105.177] (84-149.207-68.elmore.res.rr.com [68.207.149.84])


68.207.149.84 - Road Runner HoldCo LLC, Herndon, VA.

So she's using them as a Proxy server. :)
by jolly_roger Tue Apr 06, 2010 1:31 am
The latest letter from anna states that she will obtain the visa soon (without financial help)
I guess I'll be able to ask the subject, face to face in person?
Should be intersting!
by rasmiacalonto Tue Apr 06, 2010 2:37 am
She's just using her talent in using argumentum ad misercordiam or the argument of Pity.She must be a neophyte scammer.
by jolly_roger Wed May 05, 2010 10:40 am
The latest instalment.
Have been sent this same email four consecutive times.
Obviously 'anna' is becoming bored with "her" pretence or becoming frustrated!

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NQ==
X-Message-Status: n:0
X-SID-PRA: annazhuk <[email protected]>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpU0Lc3nyNKb+FqoNTNPUsHJ0mCMbazLlzHWnARoSQSyTIIzWUv6ECZF40Y/YzZUO2+qdlwjuJwMq60riG4npTNU
Received: from mi0.bluebottle.com ([206.188.25.15]) by COL0-MC1-F4.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 30 Apr 2010 21:25:17 -0700
Received: from fe0.bluebottle.com (internal.bluebottle.com [206.188.24.43])
by mi0.bluebottle.com (8.13.1/8.13.1) with ESMTP id o414PHfP032582
for <[email protected]>; Sat, 1 May 2010 04:25:17 GMT
Received: from [192.168.105.177] (unknown [97.82.23.44])
(Authenticated sender: [email protected])
by fe0.bluebottle.com (Postfix) with ESMTPA id 4BB405C554
for [email protected]>; Sat, 1 May 2010 04:25:15 +0000 (UTC)
Date: Sat, 1 May 2010 08:16:33 +0400
From: annazhuk <[email protected]>
X-Mailer: The Bat! (v3.0.1.33) Professional
Reply-To: annazhuk <[email protected]>
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: [email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: clamav-milter 0.95.3 at fe0
X-Virus-Status: Clean
Return-Path: [email protected]
X-OriginalArrivalTime: 01 May 2010 04:25:17.0456 (UTC) FILETIME=[4D8B0900:01CAE8E6]

Hi hoping to scam you!!!
I still do not have any comments from you about situation about my trip.
As I have written to you before I have ready documents to visit your
country and few money for tickets but still need in about 305 $ US money
help from you to have enough for my tickets. Please let me know how soon
can you help me with it??? Please understand right now I am in Moscow
and living in hotel and food are very expensive here I can not stay
here for a long time so I hope you will try to help me money for
tickets somehow faster.
Anna

Edited to remove email address - don't forget to remove your own address when posting - dotti

Who is online

Users browsing this forum: ClaudeBot and 18 guests