Scammer based in San Diego, USA - can someone explain?

*******

I have been looking for a flat to rent in London for several months now, and have come across the same scam very many times. Different names, but always the same outcome: the "landlord" is currently not in town, and I need to transfer money via Western Union to a friend to prove that I have the funds to pay the rent and deposit.Then they would travel to London to show me the flat.


Fortunately I didn't fall for the scam the first time, and am now able to spot it from the beginning.

I have googled this scam and found scamwarners, and everything I've read has led me to believe that these scammers are based in Nigeria.

Today I found out how to track an email's IP address, and found that the last scammer is based In San Diego, USA, not Africa.


Does that mean I can report them to the authorities in the US? If so, how?

How common is it to find this type of scam originating in the US? The style of the emails is definitely Nigerian.


I'm posting the IP address and a couple of emails "she" sent me, please let me know if I should post or send any more emails or the header.


This is their IP:

Header Analysis Quick Report
Originating IP: 209.216.244.83
Originating ISP: San Diego Teleproductions
City: San Diego
Country of Origin: United States
* For a complete report on this email header goto
ipTRACKERonline

Here are a couple of the emails "she" sent me:

from Valentina Aquaro [email protected]
reply-to Valentina Aquaro <[email protected]>
to m**** e***** <******@gmail.com>
date Mon, Nov 7, 2011 at 1:55 PM
subject Re: Me replied to your ad: ONE BEDROOM FLAT wanted
signed-by yahoo.co.uk


Hi ,


Good to read from you again. Tell me about yourself if interested.

- Yes the garden is private.
- The nearest tube station is Bethnal Green Tube.
- Yes there are shops in walking distance.
- Its available for you to move in immediately.
- There are no extra costs.
- The deposit is 900pounds


A lil about me : Am a 35years old fashion designer, very friendly.
I live in Birmingham. Reasons why we want to rent this place out is so that there will be an occupant in the flat. We just need life in the flat.


About the flat : The flat was once a family flat till my old parents acquired a new property in Spain and moved, so i have been left in charge of this flat and nobody occupies the flat at the moment.


Concerning viewing: I can only travel from Birmingham to attend to serious tenants that are ready to move in and can prove that they can pay for the first months rent and one months deposit, i don't do general viewing. I need to know that you are serious and have the money to pay before i can come down to London.


I have a tight working schedule caused by my upcoming fashion show week, which preparations are on for at the moment with my coordinators from New York. You can search the map for that area and what you see in the pictures are what the interior of the flat looks like.


If you feel comfortable with that let me know, if not don't bother to reply so that we won't waste each others time.


Thanks and warm regards,


Valentina

And Western Union shows up here:

from Valentina Aquaro [email protected]
reply-to Valentina Aquaro <[email protected]>
to m***** e**** <******@gmail.com>
date Tue, Nov 8, 2011 at 4:20 PM
subject Re: Me replied to your ad: ONE BEDROOM FLAT wanted
signed-by yahoo.co.uk




Hi ,


Let me know when you want to come and view my flat, so that i will plan my time here and make sure am there before you arrive.


The only thing is that i need double assurance, because i want to avoid traveling from Birmingham to London in vain, i can afford my fare, but i can't afford to waste my time.


My Lawyer will get a contract ready for you to sign if you like to take the flat after viewing and the keys will be handed over to you immediately after contract has been signed.


Also, receipt of payment will be issued to you after which you'll have to sign the lease agreement form.


I was discussing with my Lawyer about the idea on how i will be so sure that i will not just waste my time to London without achieving my the aim and she advised that we can work out something via Western Union Money Transfer.


She said that Western Union Money Transfer can actually hold the money as an evidence and surety that her tenant will pay her at least for the first month and deposit. She gave me an option on what we can do since you have the funds at hand which will be explained below:


PROCEDURE:


1) Transfer the amount £1800 (1 month rent and security deposit) to any of your family members (wife, dad, mum, siblings) or your friend.


Your Name (as Sender) to any of your family members (wife, dad, mum, siblings) or your friend (as Receiver) in United Kingdom.


2) Scan & Send a copy of the Western Union transaction receipt as a proof of the transaction or mail me the transaction details. (The money is safe as it is only you that can withdraw since you need a national ID card or International passport)


3) Then, we will meet for viewing.


4) If you decide to take the flat, we will go to any local Western Union Money Transfer office for you to pick up the money and pay me. (You don't need to come with cash to view, after viewing we will go together, you will cancel the transfer and withdraw the money to pay me).


5) Keys will be handed over to you after signing the contracts.


I am pretty sure that the transaction at Western Union office will require some charges, i will definitely refund the transaction charges back to you upon viewing and if you don't see what i sent as pictures of my flat to you, you are free to leave without paying me anything.


I only want to be sure that i am not going to waste my time this time around and i think with this condition, both of us can be sure we are not wasting our time.


I will only rely on your honesty that you have made the transaction so that i can reserve the flat for you.


Let me know if you are okay with this so that we can proceed. Thanks so much while i will be waiting to read from you and i am looking forward to meet you and be great friends eventually.


NB: PLS DO NOT MAKE PAYMENT TO ME OR IN MY NAME, WHAT I NEED IS JUST AN EVIDENCE THAT YOU HAVE THE CASH TO PAY ONCE YOU HAVE VIEWED.


My contact number is 07572313367 i do have network problems with my phone at the moment but can receive text messages and then i can call you back at my spare time.


I am sorry for the lengthy mail, i only want to explain myself better.


Warm regards and have a nice day.


Valentina

Hi ariella. Sometimes the email headers are forged. That will give a false originating IP when checking.
For instance a scammer claiming to be in one country, could easily have sent an email showing as an entirely different location. Some russian scammers for example, sometimes have an IP address originating out of Europe or the US. Yes it is confusing! But such are their devious ways I'm afraid.
Are you able to post the e-mail header from the message?
Thankyou for the report because it will alert others when conducting a search.

209.216.244.83 is a proxy server - the scammer could be anywhere.

iP: 209.216.244.83
Decimal: 3520656467
Hostname: 209.216.244.83
ISP: American Internet Services, LLC.
Organization: San Diego Teleproductions
Services: Confirmed proxy server
Type: Corporate
Assignment: Static IP

Thanks for your replies, Michelle and jolly rodger!
Hm... why would "she" pretend to be in the USA when she told me she lives in Birmingham, UK?!

I was wondering about how the scammers choose their names, and I have a suspicion that they may take them from other people they've tried to scam recently. Why all the Italian names?
The name "Valentina Aquaro" came up with no hits on google, but the phone number "she" uses (07572313367) comes back with lots of results, all on scam reporting forums, always with a different name.
Other identities of this scammer contacting me with the same script are:
Malvina Ferrandini - [email protected]
Gary Miller - [email protected]
Clifford Moses - [email protected]
I think they change email addresses and names so frequently now this may not prevent someone else from getting scammed, but I'm posting them here just in case.
I have reported them all to gumtree too, through which they contacted me.

jolly roger, I will try to PM the header to you, as it includes my real name and email address I do not want to post it in the forum.

Hm... why would "she" pretend to be in the USA when she told me she lives in Birmingham, UK?!

The scammer himself may not be the one who chose to use the proxy. Many American and European businesses and websites have blocked people in certain African countries due to the high fraud rates. For example, some dating sites have simply blocked IP ranges entirely from signing up, and many retail sites will not ship to or accept orders from certain African countries. Paypal does not allow Nigerian-based accounts (or they didn't last time I checked--I believe that is still the case. As a result, some internet cafes, particularly those that cater to scammers, may have their computers set up to run through proxies to get around this.

In addition, many scammers don't bother with proxies when sending scam emails, as they expect their victims will not be aware enough to actually check their locations. But if they need to use a proxy for another reason (for example, to open new dating site accounts), they may simply remain logged in under the proxy when they go back to their other business (and that is what their romance scams are--a business).

As for names, some use real names and even identification sent by other victims, while others simply choose names from online directories. Others will create their own names from names they find on the internet. But many African scammers do not know the difference between a first and last name, which is why you see many characters with names that are composed of two first names --e.g. James Erik, Mark David, etc.

How often they change names depends on the scammer, and on whether they have active scams going under a specific name. But that is why we ask people to post early emails from the scammers as well as their names and addresses--often scammers continue to use the same scripted emails even after they have changed their names.

Thanks for your insight Dotti, very informative and much appreciated.

I will post my first emails from "Valentina Aquaro" here as per your advice. The ones from "Malvina Ferrandini" are exactly the same script, except for the name and email address, and the address of the flat they were advertising.
"Malvina" appears on scamwarners already http://www.scamwarners.com/forum/viewtopic.php?f=26&t=20931, on the "Sarah Smith" post, in regards to a flat at 76, Mildmay Grove South, Islington, London, Greater London, N1 4PJ.

The other two, Clifford Moses and Gary Miller, I never replied to after receiving their first messages via gumtree, which were:

You have received a reply to your ad: ONE BEDROOM FLAT wanted
Respond back to me directly on cliffordmoses16(at)yahoo dot com for the pictures of the property and all the details of the property.
Clifford.

From: clifford

and, hilariously:

You have received a reply to your ad: ONE BEDROOM FLAT wanted
The best thing and lovable situation for you to really contact or get to me regarding my cherishable and very neat and tidy property that i have for you and which you are going to love very well and very much,contact me now on garymiller7235 at yahoo dot com

From: gary miller

Here's "Valentina"'s first email, sent through gumtree, regarding a flat at 17, Oriel Road, Hackney, London, Greater London, E9 5SG:
(funny how someone looking for a flat in London needs to be told that London is in the Greater London area - nobody in London writes addresses down like this!)

You have received a reply to your ad: ONE BEDROOM FLAT wanted
Hi,
Have you found a place yet. Let me know please, i have a 1 bedroom flat that goes for £900 per month including all bills and well furnished with garden. I'll expect to hear from you.
You can reach me directly on (valentinaaquaro at yahoo co uk) with your AD number for me to email you the photos.
Valentina

From: Me

And the next one, sent to me directly:

Hi,

It is located in 17, Oriel Road, Hackney, London, Greater London, E9 5SG, there is a High speed wireless internet connection, TV, Sky, Heater, En-suite bath, Central Heating System, Washing/Dryer machine, Car parking space and Garden.

I have attached photos of the flat so you can have an idea of what you would be renting.

So do let me know if you are ready to rent the place and also get back to me with details about yourself.

Thanks

Valentina

The one after that I already quoted on my first post above, then came this one:

Hi ,

I have just tried calling you but you aint picking your phone so will explain everything via email. My lawyer is presently on her honeymoon so is presently unreachable but i can answer whatever questions you need answers to about the western union money transfer.

All you need to do is just take the cash to any western union money transfer outlet because they only accept cash and make the transfer to any name apart from your as the receiver in United Kingdom and email me a copy of the transfer receipt as proof after its done. Do note that the money is only to be withdrawn after the viewing when we meet because i do need to verify the transaction on the western union website to be certain that the money is available in their system before we can meet for viewing.

If you can have the Western Union Money Transfer done today or tomorrow the latest and email me a copy of the transfer receipt as proof after its done, then we can meet for viewing on Saturday at 2pm.

Let me know.

Thanks

Valentina

Thanks ariella, I viewed your PM. Have just sent a reply. Cheers

Header from the email by Valentina

Received: by 10.180.102.98 with SMTP id fn2cs52862wib;
Sun, 6 Nov 2011 14:27:08 -0800 (PST)
Received: by 10.50.169.38 with SMTP id ab6mr37367672igc.26.1320618426187;
Sun, 06 Nov 2011 14:27:06 -0800 (PST)
Return-Path: <[email protected]>
Received: from nm9-vm0.bullet.mail.ird.yahoo.com (nm9-vm0.bullet.mail.ird.yahoo.com. [77.238.189.197])
by mx.google.com with SMTP id jk8si12738273pbc.131.2011.11.06.14.27.04;
Sun, 06 Nov 2011 14:27:06 -0800 (PST)
Received-SPF: neutral (google.com: 77.238.189.197 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=77.238.189.197;
Authentication-Results: mx.google.com; spf=neutral (google.com: 77.238.189.197 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]; dkim=pass (test mode) [email protected]
Received: from [77.238.189.55] by nm9.bullet.mail.ird.yahoo.com with NNFMP; 06 Nov 2011 22:27:02 -0000
Received: from [212.82.108.248] by tm8.bullet.mail.ird.yahoo.com with NNFMP; 06 Nov 2011 22:27:02 -0000
Received: from [127.0.0.1] by omp1013.mail.ird.yahoo.com with NNFMP; 06 Nov 2011 22:27:02 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 36370 invoked by uid 60001); 6 Nov 2011 22:27:02 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; s=s1024; t=1320618422; bh=wsmY/xUJ19YnMWppotKYEXp48N0+bngvWkCaye3/CXo=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=vhZ5BsqelMPdNV7qU21d/7vGaKAxvvCWNvfbubuiz9U/MlL7crTKT4x+aVlS1gOlLIJ81P7SaJhuBHQ125+0/lnEfCzk6culgLCTFEAqhgR0ulqGoz+dYLvzGZk3lxo1L4W//Q1UkUud/JzcoIA0cpent3AF0Bls/VqNuz8MzTE=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.co.uk;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=s76x2coMCF5iXcPOELt3NUZKbVFNLIRiKErdJzqOH1RChwDB7SHePGtgHmFNWEfHdovW3I4v7hVFbFjR8wqlab7PSasSdOusgWCewtLHOR02Beqqp9Yfth9NYiBy7O0ztq+AgC1I8UdzpRhq6H7e2AGmbMZZg77zPPthuaARC7U=;
X-YMail-OSG: yKBXzuwVM1kAB_3_8d78.6KZieb3Epgxt8xQbGMgO1xH8Pi
sbTBV.8VM80t7QrmNTVAZiC.17M4DEgWFuXXsOxC_xp8iMW2pNwi.TVWmWpE
zGSVvYPv3hUs9k7W6BscEUinyo27bknckyCV_zD7lkrhz9ZMTjaJheLtJUyP
x5GHNGT2PJmyU.eFGNf8sYl8iFgR5hhFf6yOUl2tlxDhR7_.QzRUoh5kOdQf
fVkvQ2kKFuFhl.hLXBeKIMskZ2OTokZ_og0LhfKjm8tZDBz0CrXk4mv9otgR
5fS2WCok09uNPQEw5trnPqDAEC33PSktIwag9jrPFsyvoSas5jVs65HcVQcP
EYlt3y1wgHgODHD1HSfx2I1lsH7iO_B_NpCM9tF3GtJD0EukdSKGIKs5nq8I
v06aCT7t7G8ZfzJmp8iIrtyWoYROxpfiD2LRu.55O6ofgpd_CwbO_9lCl_Mk
b3ExsT_f2FycP33imlJ9K944kfMXbrfKadbxsWA8tDLXioGqG5Uud9aUuW2_
rVxU-
Received: from [209.216.244.83] by web29905.mail.ird.yahoo.com via HTTP; Sun, 06 Nov 2011 22:27:02 GMT
X-Mailer: YahooMailWebService/0.8.115.325013
References: [email protected] <[email protected]>
Message-ID: <[email protected]>
Date: Sun, 6 Nov 2011 22:27:02 +0000 (GMT)
From: Valentina Aquaro <[email protected]>
Reply-To: Valentina Aquaro <[email protected]>
Subject: =?iso-8859-1?Q?Re=3A_Me_replied_to_your_ad=3A_ONE_BEDROOM_FLAT_wanted_up_?=
=?iso-8859-1?Q?to_=A3750_pcm_or_=A3900_pcm_inclusive?=
To:

I've just received another scam reply to my "Flat Wanted" ad on gumtree, from "Peter Cliford" ([email protected]):

You have received a reply to your ad: ONE BEDROOM FLAT urgently required
If you can take a good care of my property contact me directly on
petercliford23 at yahoo dot com and I will reply you back with all the details of the property.
peter.

From: peter

Why do they always spell their email addresses in words, "at yahoo dot com", rather than using "@" and "."?
At least that makes them easy to spot...

Many classified sites (and dating sites) that have messaging systems are set to automatically block/delete email addresses in messages. This is to prevent people from using their system to lure people off the site onto email.

Scammers will write out the email addresses like that so that automatic scanners don't recognize them and block or delete them.

Thanks Dotti!

Learning heaps about the world of scams here! Wish I didn't have to but I'm so glad this site exists to inform and help.

I've just received another hilarious reply to my gumtree ad, this time from "Wayne Park" ([email protected]):

You have received a reply to your ad: ONE BEDROOM FLAT wanted
The phrasest and very palatable way of you really getting in touch with me in order to get the very best lucrative and suitable property ever in the UK is for you be at your fastest way to contact me regarding my property now directly on my email address which is waynepark68 at yahoo dot com

From: wayne park

Three more scammers reply to my "Flat Wanted" ad on Gumtree:

- Vivien Dorsson ([email protected])

You have received a reply to your ad:
Hi,
Have you found a place yet. Let me know please, i have a 1 bedroom flat that goes for £900 per month including all bills and well furnished with garden. I'll expect to hear from you.
To receive photos reach me on [viviendorsson at yahoo co uk] with your Advert Number.
Vivien
From: Vivien

- Mark Garry ([email protected])

You have received a reply to your ad:
The property is in a very good condition,please contact me with your email direclty.Do not hesitate to contact me at
markgarry47 at yahoo dot com,I will reply you back with the info of the property.
mark.
From: mark

- and this guy "Michael" who doesn't give his email address but wants me to send him mine:

You have received a reply to your ad:
Hello,
I am extremely sure you will love my property, a standard and very clean property. It will be easy for me to send you the details and pictures if you send me your email address.
Regards
Michael
From: michael

I was 99% sure that this is a scam too, but as it's a slightly different format, I asked him to just send the details via Gumtree and got this reply:

Please kindly send me your email address so it will be very easy for me to send you the details and pictures.

So now I'm 100% sure.
And I still haven't found a place to live...