Multiple IP Addresses

I suspect I was a target of an East European dating scam. The young man assured me he was writing me from his home computer. But I logged at least 7 different IP Addresses. His email address was yahoo.de (yahoo in Germany). Is that confirmation that either he was using different computers such as in an Internet Cafe or there were several different scammers working together on different computers? On the other hand, if his address was yahoo.de, could a different IP Address show up with each email on the same computer?

Have gotten conflicting answers on the above and have spent many hours trying to get a clear and simple answer.

Would greatly appreciate someone's help in clearing up the matter.

THANKS FROM A NEWBIE!

Welcome to Scamwarners...

Could you please post the headers and email so we can have a look ?

Remove any personal info (your email addy etc)

http://www.abika.com/Reports/Samples/em ... rguide.htm

It is very possible to have multiple IP addresses from the same computer.

Here is the oversimplified version:
Most providers have a range of IP addresses. They may be providing internet service to hundreds or thousands of homes/businesses. Most customers are "sharing" those IP addresses, unless they are paying for a dedicated address, which would be very rare for a home user. When a customer connects, his computer is assigned an IP address in the range owned by the provider. When the customer disconnects, that IP address is "released" back into the pool of IP addresses. The next time the customer logs on, he will once again be assigned a random IP address in the range belonging to his provider--but it may not be the same IP address. Because of this, different IP addresses from one email to the next cannot be considered proof of a scam.

As Gateway said, we need to look at the emails themselves, and to look for other evidence that is more reliable.

As requested by Gateway, following are headers for three of the emails sent from the same yahoo.de address. I have removed my name and addy as well as the name of the sender on the slim chance that he was not a scammer replacing his address as [email protected]. He claimed he sent me all his emails from his home computer but you will see each email has a different IP Address although this might just be different IP Addresses of yahoo.de. Kindly clarify for me. Am not posting emails themselves as they are of a personal nature.

EMAIL NUMBER 1:

Return-Path: <[email protected]> Received: from mx-nebolish.atl.sa.earthlink.net ([207.69.195.21]) by mdl-increase.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1qHii25dF3Nl36Z0; Thu, 14 Jul 2011 05:33:02 -0400 (EDT) Received: from nm19-vm0.bullet.mail.ird.yahoo.com ([77.238.189.92]) by mx-nebolish.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1qHii15Bn3Nl3490 for ; Thu, 14 Jul 2011 05:33:01 -0400 (EDT) Received: from [77.238.189.56] by nm19.bullet.mail.ird.yahoo.com with NNFMP; 14 Jul 2011 09:30:08 -0000 Received: from [212.82.108.236] by tm9.bullet.mail.ird.yahoo.com with NNFMP; 14 Jul 2011 09:30:08 -0000 Received: from [127.0.0.1] by omp1001.mail.ird.yahoo.com with NNFMP; 14 Jul 2011 09:30:08 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: [email protected] Received: (qmail 23551 invoked by uid 60001); 14 Jul 2011 09:30:04 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.de; s=s1024; t=1310635804; bh=8VgI+kZ2AzxCvCO1IJQduOWyVhHGR2kPV4VhCLBm/XI=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=qhP7IM/ZKn7vgW9fPde5WGHl0TTvuWTYe5zIBAl0OLhJ42x47CseySp4G2cZO8n1ke0CE+YmghtKZnm6n/cY+Ar7Isa5grijDfHzPY6Q+sZC+gULNIWaQTsAQswIz35qr1q+7Ocy4TQ7MrwD/+4RFbrwBIvdtQdqeXnOyIBQbKE= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.de; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=h6bIy0fXVdpBZdDogscQ/MtwFAQFP3VHBcECUuUkY/04teXxqj3UZwetwUmlia2vcMenqflmXwtxOq1m/dWZz5R0UPgWBMf/M8oXZU7IYK5xZf3Hx3vq8nmyF8CfTXp8crk1kA+8kWfpuk64nCfAEut2ukltznOkrPMX3VYWbdU=; X-YMail-OSG: 1KU9zSgVM1kJqflVVXw4S1fYIT3VtnezeeEyIIJk8qAA4mx EHijz5MV.ZQ5pqiL7aeC0KDPP1ZQCAPCerXGvqclJEugoaJTwkStPhias0vm jB0v1bgfwRQN1lsijJ5gSNRtEDSfq0_j4zcx_be_7mqFL4a3fRCPrKScYL4A W3ym99NyEmqcuulU.3olEO4wNCM42uNkAWqKbgNh.uFKaW1JRLYc5W9BZLSs YO1rK3V4CMtyAyP8mK.L35fn3ZQbBabAzjndrMitN1fOh5FVttY6RlM8qbB5 hDAAcRmkQuqdnjAZihMmqq9GBCGtW57FlPt9UucDN20xf1d_2_jkkfxpgCQ- - Received: from [178.42.249.60] by web29018.mail.ird.yahoo.com via HTTP; Thu, 14 Jul 2011 10:30:04 BST X-Mailer: YahooMailRC/572 YahooMailWebService/0.8.112.307740 References: <30928769.1310630703575.JavaMail.root@wamui-cynical.atl.sa.earthlink.net> Message-ID: <[email protected]> Date: Thu, 14 Jul 2011 10:30:04 +0100 (BST) From: <[email protected]> Subject: AW: In-Reply-To: <30928769.1310630703575.JavaMail.root@wamui-cynical.atl.sa.earthlink.net> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-50712144-1310635804=:17243" X-ELNK-Received-Info: spv=0; X-ELNK-AV: 0 X-ELNK-Info: sbv=0; sbrc=.0; sbf=0b; sbw=000;

EMAIL NUMBER 2:

Return-Path: <[email protected]> Received: from mx-roseate.atl.sa.earthlink.net ([207.69.195.27]) by mdl-compact.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1qGEJG3mW3Nl37e1; Tue, 12 Jul 2011 11:18:56 -0400 (EDT) Received: from nm6-vm1.bullet.mail.ird.yahoo.com ([77.238.189.220]) by mx-roseate.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1qGEJn3TM3Nl34f0 for ; Tue, 12 Jul 2011 11:18:37 -0400 (EDT) Received: from [77.238.189.50] by nm6.bullet.mail.ird.yahoo.com with NNFMP; 12 Jul 2011 15:18:28 -0000 Received: from [212.82.108.249] by tm3.bullet.mail.ird.yahoo.com with NNFMP; 12 Jul 2011 15:18:28 -0000 Received: from [127.0.0.1] by omp1014.mail.ird.yahoo.com with NNFMP; 12 Jul 2011 15:18:28 -0000 X-Yahoo-Newman-Property: ymail-5 X-Yahoo-Newman-Id: [email protected] Received: (qmail 54031 invoked by uid 60001); 12 Jul 2011 15:18:28 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.de; s=s1024; t=1310483908; bh=AaHOkwak6c3whfbPwthQvdxCtQdR2DmePfZ89bcFfnM=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=Cwff/uc7pdi0ADy5OjlxS4FJCnASO/RaDpTRpcO/rOpchU/cszGnrI1NVRvww260/Lc1oiouCOmWEheB0IqNqFjtpIJriZW59b9eRxdJGJTMmJZ3kR/a3L+QKhHMbpWVikf4rNVPmPWaPr5+7CkMOUO8VRgkzG9KOpiL6SYQwtY= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.de; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=sYTUmGJNp9hPeuOhFf7I2R9eIsrOfY2cfyXF25o+RhHH3O8/d4BgLnHsePNLZ5wCQKfzawORVwGSGDxz3PqRUfe4TDxopJPjsu0ePhoEbsGCsGtiK7GZnzGMHU9RsUyh8rXvCbxhKJAatjeFYf8bA/OzV0hTAm2jaYtV/3ZcZf4=; X-YMail-OSG: RC4xwWgVM1k8lN1qtfGN6VKoXOJjKNKSf2A3wAGj6NV6ZWV URoyyVgmUOWYF276Moq1KxVUnJE9FPVz0rxv7oArboBBpVr.LOXCuavw6I9L Fi3Ia_Rf7o0Z0MPs8FV8kKafUrOJD2sa7Rt0olXGtErSTKTT5YBooRemij8q yt5JtfbzjbWmImK0pSf.EQBnhschgf5zd3FydEaVdCJOdlqPJ5knzHwIzckl 8G7hR9fRNq2.rpKTum_ENGfVribmazGNMs7wL9KE.Mh5VYTTl8kRS5gTBFaG bh4OY6Yn1A.eRII8iGSr.N2LVeTiJvjvjgq1eexfOks4NK_Pn08eB0KQLqQ- - Received: from [95.49.200.86] by web29018.mail.ird.yahoo.com via HTTP; Tue, 12 Jul 2011 16:18:28 BST X-Mailer: YahooMailRC/572 YahooMailWebService/0.8.112.307740 References: <20001025.1310410622758.JavaMail.root@wamui-hunyo.atl.sa.earthlink.net> Message-ID: <[email protected]> Date: Tue, 12 Jul 2011 16:18:28 +0100 (BST) From: <[email protected]> Subject: Re: ! To: In-Reply-To: <20001025.1310410622758.JavaMail.root@wamui-hunyo.atl.sa.earthlink.net> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1328648303-1310483908=:50967" X-ELNK-Received-Info: spv=0; X-ELNK-AV: 0 X-ELNK-Info: sbv=0; sbrc=.0; sbf=0b; sbw=000;

EMAIL NUMBER 3:

Return-Path: <[email protected]> Received: from mx-austrian.atl.sa.earthlink.net ([207.69.195.31]) by mdl-journey.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1qFBBdym3Nl3700; Sat, 9 Jul 2011 13:45:51 -0400 (EDT) Received: from nm5.bullet.mail.ird.yahoo.com ([77.238.189.62]) by mx-austrian.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1qFBBc5hy3Nl34j1 for ; Sat, 9 Jul 2011 13:45:50 -0400 (EDT) Received: from [77.238.189.230] by nm5.bullet.mail.ird.yahoo.com with NNFMP; 09 Jul 2011 17:45:50 -0000 Received: from [212.82.108.244] by tm11.bullet.mail.ird.yahoo.com with NNFMP; 09 Jul 2011 17:45:50 -0000 Received: from [127.0.0.1] by omp1009.mail.ird.yahoo.com with NNFMP; 09 Jul 2011 17:45:50 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: [email protected] Received: (qmail 11715 invoked by uid 60001); 9 Jul 2011 17:45:50 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.de; s=s1024; t=1310233549; bh=Jv/6TqyDUzCwwZ4VpEAuClMg4Bi0YkD8GqB7adEhDhA=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=jr+GgH0K9GrnESYpQXXyxdofmmH58kC1ZXjhFmUToiFSCXY3LPO3lYjitlhueOI+nxgp8rSLqI3bALz6V1l0unNXDUI8mNx/kkE/ZaChYErhrwE3Yl8D6k72Ip9VRexuT1NLw3ctRvx7gVGNGYSTkWhPLHgF2h4DfBDJvbxoYPg= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.de; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=j/7vGo4BXpk847SF+MAvU6SCzUezmVn0GhqJ2FCmgpApW0R61AW9qvGCvVIUpI+N7VcvY0rJDNSjTYVwiG6JKtme7MDg7uUjyg6PB1QhCisloiTMr2YczXCdASW4OwhebrWckV+hVYJ8Phr2C4LQKLeKkRvuXz6pPrW5nvURwUI=; X-YMail-OSG: N_4dQfcVM1kIOt0x_HEKNoC3OpPwO86_DiT9bckflBjqNk6 PIQBG3_Xh0W4kPBDJuazYcJbPFoUMBK.KvbapsEM38ZKJY3N1H47NkVV1hoc hP9Siy534dUFuVzMZh5zWpiEC7KM6KDKe3rWReUWHVGPS6dP6wrMqque_yGw R94wblh55WeOfXIFLjR8HRmSMAI6POGnTCBAOBR2QeuP_uvdb8dEXvgu7XFU GjGrcs4GVlIBTt1u0s2wcA7rFiKksTohzA8rYobp96ubJ1JgB7t_68ji15ho 5D1r4l3g3P3k08ogqCNjKDw-- Received: from [95.49.166.42] by web29017.mail.ird.yahoo.com via HTTP; Sat, 09 Jul 2011 18:45:49 BST X-Mailer: YahooMailRC/572 YahooMailWebService/0.8.112.307740 References: <32253830.1310157588610.JavaMail.root@wamui-bucket.atl.sa.earthlink.net> Message-ID: <[email protected]> Date: Sat, 9 Jul 2011 18:45:49 +0100 (BST) From: <[email protected]> Subject: To: In-Reply-To: <32253830.1310157588610.JavaMail.root@wamui-bucket.atl.sa.earthlink.net> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1705163508-1310233549=:10677" X-ELNK-Received-Info: spv=0; X-ELNK-AV: 0 X-ELNK-Info: sbv=0; sbrc=.0; sbf=0b; sbw=000;

All three IP addresses resolve to Poland. Same ISP so I would say Dotti's explanation is correct. If you post some of the scammers emails we will be able to tell you for sure if it is a scam.

Hi,
I wish so badly that I had encountered this site early on and made some drastically different decisions. I was fortunate to have been contacted by someone with very same situation while we were still both going through the crises and such, but we had absolutely no information or anything to defend in the situation. Sadly, I'm in a real bad state but still I cannot say just yet who the person who supposedly has had a relationship with me for almost a year now is real or not. I'm posting here first to get clarity on these multiple IP addresses. Is it possible to have the service provider route to a location that is far away from the user's actual location? Or somehow there's another factor that could cause the email to show IP address from elsewhere, like maybe a decoy routing system or something or is affected by an email thread? I just want to eliminate all possibilities.
Since I've learned that you can actually trace roughly where they were emailed from through this site, I've spent a good amount of time sifting through my logs of emails. But I get conflicting locations depending on what kind of program I use, so I want to see what someone here detects. I also am removing the actual emails until I figure things out for sure.
Here are several headers with 2 emails he uses with me:

Email 1: supposed to be in England
Return-Path: <[email protected]>
Received-SPF: pass (mta167.mail.sp2.yahoo.com: domain of [email protected] designates 65.54.61.82 as permitted sender)
X-YMailISG: tXd9NJEcZAr_tMqdRP54WmGymDaQ8jsC1Qai._5hDiekrIal
cQle1yF8FRHvyL38r1.S_zpiwibvrbYp._dDLR6kRldVRzojbpLfwpaUapNP
aAVJtnLursKDhAFFxl9_EWfFWC7lhflab0uY7feuTBEkva73itKKDJv8MRPa
4vVo7JC0vpIZXea7vlkdxi2..rEzaBeSDFlPHoDVBR9BTDEJnTQp_NbMVJOZ
j1zw2EVDYF5RAXSV9QfgQXpDw2p2YZh_rY8WrKsC_FOw2puevf.YyQbxc4HG
8dz9BKCRO6S3VUwgle_sMPdWDvEeA9U9vc_hF4FT75F4eXuJheg7G1QLM1IM
PC8BaQU0cJ32YqVCKeZfAlLSaGG8nMTw8XPF.8xX3EbltTEJrtbWKvK_0zBr
7jk30Bx9uuJGigP2K7mVFLQkXn.1t6jlgRgnTL1RNvwFAvmAqtgmLvkuX5wK
aw6XUteDl8PVDXvRjfFHlcsOoqakpwFcuNxAZg_DoPCK7Dl2kNNncgcempX4
gvBqLqlFwmwi1dZDJmwyRYHRh7nC48yEk2F0Ln27tq01ald6wmRmb8YeeSIo
3gZ.g2YZZUzky1XN0j1HoCcA9B.b8xfpG5RLwhsIwehltLEEkxO0krPr2OjV
ZZmNOhSU0uP4wXm6HdjdWjfy6fXe6JHZYYzmpHAetmMlbO1GW5ajUGWpC5nS
UzcAMSzn_DbHfDuemVFL4apHrP294JwoD67DZTxO54teXbK90Fs6uKI_Pxnp
L_ZvjG8fh4X07THM.ZkG8pVudhf4p38rbUs0ph_BAc4SN4cGKqBbmRNMukeF
Ql1lBpkw
X-Originating-IP: [65.54.61.82]
Authentication-Results: mta167.mail.sp2.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO snt0-omc1-s45.snt0.hotmail.com) (65.54.61.82)
by mta167.mail.sp2.yahoo.com with SMTP; Thu, 26 Aug 2010 23:57:37 -0700
Received: from SNT137-W18 ([65.55.90.8]) by snt0-omc1-s45.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 26 Aug 2010 23:56:36 -0700
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/mixed;
boundary="_63cdf997-6ea8-4eec-9e83-7e6969e12623_"
X-Originating-IP: [118.100.250.105]
From:
To:
Subject: RE: Another pic frm me
Date: Fri, 27 Aug 2010 07:56:35 +0100
Importance: Normal
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 27 Aug 2010 06:56:36.0240 (UTC) FILETIME=[FDAA0900:01CB45B4]
Content-Length: 170785

Email 2: Supposed to be in Dubai
Return-Path: <[email protected]>
X-YahooFilteredBulk: 98.138.91.10
Received-SPF: none (mta119.mail.ac4.yahoo.com: domain of [email protected] does not designate permitted sender hosts)
X-YMailISG: zitZsAUcZAog_YPtQdM1VYaZrDFXYO9EUhOXWVhTCemD9Vn4
V.fHPCvijdvLb5OgoVtVJxK4Ao7_TI3_4KDXuM_Yn57WCQUZPzNh3c_SHnuu
Qib0csu1jsjkIIor7N3i_zKniNHl7GqNS91EwXQXhP1pGXsnqJCcUI9W4WLj
_5j4aIa5tbarDIwXKyXI1vNxIeoB0cwpGJClQvFAz_bkeI_F.HpKao_LDkzZ
bJUnoG9nyX_jyd1WswGs9_Km8Mxi19a8S1cUFRAs6NsgLJjhLI9moIfrRn.s
IsUuFChsEeXs.4vgncF6cao0.UZZTnHGa_fgrWiZpowYlDdNhlSj.VDI.C70
6o.r6r4JgNl4CrDwzAeo49nKrKioh.0EoPmoQ0wOXIEkSJh44ZCbtHXbNyCl
8.jCGJpB3okq0fbFh2cLEG7SXhVnc5F7gNuoZpzI7DScU6YX6T48ErZMsH.0
Eyo9c61CXxGG077kSrqNZC5KjKbGmB0ZVI4PdvVsHFRulnZidB04qKF.yojf
I96OyIo4PURxsisFXA0oKKdw61USfX68u5W1sKgN81cNPzmuc9YBtkx.jNym
.JbSydOzMyBjIoRwpBzQpU76o63FB7nnZwrz74ne8stPPWUlWbJP5V8jYsIm
6fBf21.AYKGLNluStqAny4LHdCRBQTs72gSk30Cou2pwoix0qImuFYXd0Be4
zEPZGgpqwknWcuZPPOfhsmqqJSJMADF5dzRwN7YgYqGIza1JccvCqzw_uwrX
kKlPOHDhFK7bfnHJJ_NjmAOMzKvArf65PU1Lm5vhOctpB146zfG5zV904KSL
mc.vF65K4XRDN_Wefwu875f9jnwn2oiX7Up_kbbJC.bqYWsFZbq6RNnET8S9
Qk5pxLb1cdO0gETQHlE7wCVL_OTmYjJeYumuFE4KvNu3FHAa3NzhL941TvRl
4iF8pkpM4oLw_pZfrlPOvTO6IBf9.6j.HUtQP5LCNTdhS2Hh8B6xfRWIsks1
da0D14wzzSIDumLcHOH8ktwFHpcHt9ggxwR3zuNh7Y.jsShHe0BJVXx46wgL
JUpup1J97.uLevIBqMtw8GGYAgnk7j.w.OgyhGzP0WFZhWrB9vabP4BgljS_
S5Y.WQ8hduHy..tIOnlkhyB.uSeuAm58Ie13H4HcuUzIOls0PY3WvC5XCkrF
258D7fuJYJuYswWb9xU4rBtA83O06zKS5BGdwYNakAyeh.obDByHnsT1mxqf
4BxvaPsXLmuZrgFtOnhW2PoeWDHwNUuqH1u679LkkFeuRpaLG5f4SfhG6UxF
PeFtZl_.ggzqN8Q7gLGVWD8zMamstKOfAedtIHDaKP2KOwBF8uDaJDrQ7kKR
gKwnAVqgbWM37nA.uCeWWz5qjfWafy.kd5WchJPAQlSuj4wvpu3DtOsJi9rn
COmx6_YpIA--
X-Originating-IP: [98.138.91.10]
Authentication-Results: mta119.mail.ac4.yahoo.com from=rocketmail.com; domainkeys=pass (ok); from=rocketmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO web121210.mail.ne1.yahoo.com) (98.138.91.10)
by mta119.mail.ac4.yahoo.com with SMTP; Sun, 19 Dec 2010 02:32:48 -0800
Received: (qmail 60222 invoked by uid 60001); 19 Dec 2010 10:32:47 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; s=s1024; t=1292754767; bh=IDmv9f57yFtvnxwIYmEkGCfIaIt7hDLfZPWpSgecu4Y=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=YitfEeFzfcggaZYQ5dEH19a8rj5E64WqwclZ6ISKv2FgfcIKmDRinCq1sOgs8nlDoKKLUrNkmpSQa/AD01Qnn7IeJWtVFpT292sku38vKUcC+mNDA5VC7zTh2ooG5Q6u9dzeZRkX56huq8OVcnntlxtKMGANFG9Go10CGsHjFyU=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=rocketmail.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=PdvDg2xfrRDvE4GKKQCGHjXjZUDyTuzLQ8dtwmgMQfZ5YU0ALNu6+nm9tz92r+jFozAuXkrt7wbcO9oWqr8X3tc+7Uj0B6Xj77kV7MgxtvZtdKBsXASOtQNkLay0FOS+D1cRAjQ6g55G2SzxVboodEOuShTbgXZpZlNlJeZBMkg=;
Message-ID: <[email protected]>
X-YMail-OSG: mdJQD34VM1nqkA52IVZFYyHcErtEDMcxh.7E8xqfk96otQF
2Lx0Pb0qXr4szuqn4Ugvl4dDblhxWRV.kDWwN54r_SALO77XtRCBecpPoh5E
C.YgpRiDhl_s7I02haPvJ.52vDzQa9phkaqgL2AmyFkLX5UIoeAEgd_q3EEW
jhO1qb54.xpU58fyMeAJfMFUBZH9tRQaXORufEjpDa0Y2wzoidCF8y8cQ3ou
zNve4D9KYtEI5evYCzxxi3Wed4Q--
Received: from [41.155.42.13] by web121210.mail.ne1.yahoo.com via HTTP; Sun, 19 Dec 2010 02:32:47 PST
X-Mailer: YahooMailRC/553 YahooMailWebService/0.8.107.285259
References: <[email protected]>
Date: Sun, 19 Dec 2010 02:32:47 -0800 (PST)
From:
Subject: Re: Please answer me
To:
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-128810859-1292754767=:60013"
Content-Length: 5183

Babe,

how are you doing? I hope you are doing great. I just want to inform you that i arrived dubai but my luggage was robbed including my passport but i have reported to the nearest embassy where i would be issued a new passport in one week time. i am really sorry for keeping you on suspense.
I love you babe and will talk to you soon. I am so devastated at the moment.
**End of email**

These last couple of emails puzzle me, because the first is from UK which I expect, but then the second one is from Malaysia, so how would he get over there so quick in a couple days time? He was previously in Malaysia for long period and of course all those emails point there. Then does this mean for sure there are multiple people involved? I have traces from Malaysia and as probably above will show Nigeria. However, I've talked to him on the phone just about everyday for the majority of the relationship, and for a good hour or more, so I don't know how that would work into things. When we chat at times, I would call him during chatting as well, and obviously it was same person, never had someone different on the phone. He grew up in South Africa but is from England so his accent seemed to be aligned with that combination.
I've emailed him using the other email to see where it will originate from and starting a new message, although he may rarely check that one.

Email 3: Supposed to be in UK
Return-Path: <[email protected]>
Received-SPF: none (domain of rocketmail.com does not designate permitted sender hosts)
X-YMailISG: M8745SQWLDuyaOOodakS9UVW39HB9bkF.qLQvjnioW3uaEeb
OKZptxAoIi__Prd5lCyCNz05u462qkMbWBWTnTELJHB8roAAQXNjS.HIxVP9
fHFdEb49sHEBOhkUn0PUvp_CwptVMMLEzmLjYT3BFc8wfh_0HATuCwXSM6JC
tdsLKd72PaTZ.QKrfu1nnzuI04a8bwBaCp7nxEQV9b4J1_uG.RHYHAoZC0OB
S6jKFEEdEsiH36RUmKZNoPaevsxkBrPm5U6CXF_M3VfLa2ztMwIMMCPMG.If
gMGc3uY_MYNtnE.QxY95TeAEASotRxRPBXZL0s1F4n6JH7K3_bNIRv3D6h3x
36PP0AtwJBG3tNpTV0NQwfIeF8wzf584UUK.9mAQJ_UXr96F6CmL7BBsWFr8
omMD3OY6D3T59insfel_MaTdAyDAj3pdX5QHfAIFTvPTZZyj_.MECehg3EJG
WNlvfG0kHefjQsydPB1mIarpWmQLRTCtDAXz84nTkZf42ABxLtovP7wZYzCS
uDd8Q39mN8g8qc6alo6r4CDqno.Jxp_UjpbMMvAzK5SqOPfmEdmhBWzZ7AbK
1rZxR9fjfGFnwozxzm0ZpFNB60xYJ.MFwizri9_kGYaHweR.HiaAC5aexvad
2Fo3cCQ3lMOgjMf.Fr1hHOJdi7Bcc2LVMdVu0rZpr6.k7o5pmgc0A3VCWmms
GNmsBZPex6BycL3y8ot1_Lpsrm7NG2zwWnzhIu_.YZmnttYvTCZ_eHPmxiuB
g3ic5QI9_INPU8O23mu9jWz6nNUqPD5.bch5UNwbQtppTfWxTWiNYiFzDjAb
bRihS1Xr4AsbTm3KJtbiXhpLrxUMi5Aj8pt_rhiRjSN5oPRv3Kxsx_8M9Cf1
usbvleZIfah3lh4tD8bP1pcykbiHVE65ZLJUsCmTgIh38Tle4U6ptGdmWwEP
aYU724m2IQ2ukyC5ESykcyTxQA7ZemEznpWHtQN0Ozmp717xkwQh5yqeeJZ3
ESffXCDASjAEO70CppstNDJkpsw8vaPGrgEA4aibs4tJmSo8GVEzi.X7.UJz
4FO27WctIguG7tCiqFqKmAolmxGpqzN07mA33ovAjGtJ91Z0V1Q66IVnxZ3S
hya5NXTjtJacT6Q62jqBdUoTpE9dfnQ4imtvvUz0ybeooOErQq87QU..7kVQ
W4DSzTt5UP0_GVqT
X-Originating-IP: [98.138.91.174]
Authentication-Results: mta1139.mail.bf1.yahoo.com from=rocketmail.com; domainkeys=pass (ok); from=rocketmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm14-vm4.bullet.mail.ne1.yahoo.com) (98.138.91.174)
by mta1139.mail.bf1.yahoo.com with SMTP; Tue, 19 Jul 2011 03:21:26 -0700
Received: from [98.138.90.55] by nm14.bullet.mail.ne1.yahoo.com with NNFMP; 19 Jul 2011 10:21:25 -0000
Received: from [98.138.89.249] by tm8.bullet.mail.ne1.yahoo.com with NNFMP; 19 Jul 2011 10:21:25 -0000
Received: from [127.0.0.1] by omp1041.mail.ne1.yahoo.com with NNFMP; 19 Jul 2011 10:21:25 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 94230 invoked by uid 60001); 19 Jul 2011 10:21:25 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; s=s1024; t=1311070885; bh=EexjoqF+GcgSjStTUiPlr+vrkgJMgl0GEyfiWfHDVrg=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=FAvoaEPfJqs5ud/IZ5YnJGXNdnogWJ8fCVcj7XovJnnzaYluLUxOdOOar/ggNECkeOLPWcl8OOpBxf2gwlOJMVIPRy7vbLktQ+QSIxnIXmEQGa+V5RITZMfOaccuU5rqHNmokwSMl6QBDAtsij/zNEKVJjULr3XuxrFbjTP/SbY=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=rocketmail.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=ia++JBqMEl0wcLa/JmNn0cLd9Myu4kKqvJnudi3Ntcnwp7yj7zxvAXe6sWIc4wNA+lcQxCy5Wk8vL2p2nz7Fy60KInrqcEtqUkHXN4oea8T4dosmOklum5KRKCWU7d55y5ZqPJuK9aFEJ3yEbn/+VuGXX0M76QOlsZ3WZ0GFAuk=;
X-YMail-OSG: 0.D_sEAVM1nu0k7Rn5rVBOVIsydtPlPPZdS_iglyFzZRj1M
zweZtkHVuhUy9p5dMbwd10rsIQZCBI.kPUjyciGkNu099z4clL65v8Qc2TKq
Z7ouSGrv4iA0d3l5n55_Tj__KAvmCPAu8Ov.KrdlE164AFwrpxYR3hqKgRaT
ngzVDcCCYO.oqSjElzMRceX.UfXNkHDpSxLckM6yQWuqggP.EtNFk6suTqMt
adojC4N25jMoZ8DI6R4PTaxDYVU3PXu.TB6rmabdPXQGQ5bvnsQ_xJedogbb
bRkMBRbFajqs.Rjjtkq0hoedbmihPiVAjU3afYKIfPSkN1qec.Alx5hXCVw-
-
Received: from [91.228.1.227] by web121208.mail.ne1.yahoo.com via HTTP; Tue, 19 Jul 2011 03:21:25 PDT
X-Mailer: YahooMailWebService/0.8.112.307740
References: <[email protected]>
Message-ID: <[email protected]>
Date: Tue, 19 Jul 2011 03:21:25 -0700 (PDT)
From:
Reply-To:
Subject: Re: Where are you?
To:
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-877430929-1311070885=:86090"
Content-Length: 2540

hey babe had send you this email now. I have arrived UK but detained by security for investigation. I will get back to you when i get done.
I hope you have a great day! love you forever and a day!
**End email**

Email 4: In about a day's time, now it's coming from Malaysia again
Return-Path: <[email protected]>
Received-SPF: none (domain of rocketmail.com does not designate permitted sender hosts)
X-YMailISG: FnvHU6IWLDtVy8wFxVdx4ZhtslobG7rVRhJaiVUXXRIvtS8e
05dx6cX7sBrHhG6o.lm5K88kFdO8mNNhwsshsjTOUNPs9HB._WITFbbCrJPN
OGwCb6kJI4qYJJH7j_.fAP5BEz1uYwz3XD1cgXGBy_MifhTLv3YErxJ2sP.3
vEQqx2Vke.o5HL49xx7vRbN18ulzznUuz1Ke0H2GuD4P6ofcZ7Hz0.5Ogj1A
9dY_MhEyRmhDSjgnKO_LIzZ2qsI182cItinX2NK1UWq5.f6LIIfJlw8e_dOh
2Q.EqUvaL69cSJjFS4EkjF0Z9AubNk7TY._hb_bbxfN0454PFHHtsWOLzRD.
xwQCRL.E_kTqxippgX2UUjX5ogR6W1SLMeKjcO2pVYIFePhcnW6Zbp6NQ8.C
Af.up35SMvpxosiUbJKjva.1eSHaTEDt3gY5f_7KIepMJathnEHTvqWXtN1l
5cZxifYA7_LWYofTaQad6lejIwHwWg9ntKem_zB8cN_1uQWRqdAoJz081ZCm
S6ZJ415U0oNNUWObnitBuv8qCHAu41n4PQADlW_O7kwWgo11QswEJqjqMAJY
qmcUo0ziaHczIPgJWdUnLERyV1zo1BqnqGW6e0lRjV7WTJyra_63k9PCcOkA
dKiq9MC_dnsL27bNDpqHpsk0jWr.MtCSIgqoUpK5uhS3wsI216E_77vUm9tq
0AkPiZClCOfHoDNOM0DhL7veZL9oyftKWQ6Y7afKFxXuQFcLoH97.05ueaKs
TlKRVw0d8dc4MkQ8ubiBlLxzhumrm.FH3Y7QgzotIaybFVjpJf_TWPgYXDWI
X40sk_3BMBr.Y206.x69X4GORpg2UPw1KyKZHrIVtly0R1esWX2Zoktkz1IY
hUJYrOtfQ3pgyBPwkN3Jhc7rmVAXNth9pSJJLuqsfm8cCl08YjBXZ0C1Mzyn
3tFE36lgAmii47gHybTtq87HtdrZxnr7A.kbBBL31Ov_9N6fcGHphb.dO3.z
KB.AJ_7pu0PM69MQeyDXgkulJALD5U.pU6GAVkkli4l0aFVdPLq12q_8564S
pkqDdCs_WYUXEwEtr_8elpG7S0UWjmOdZXQafHZe5yKcsT8FKku740TFWZ3S
haMc9rhfDjtjTM_Il5QXHfV8K2vV4mS6ACRn5hCXRV0UC63YX2lf.DoRCUmx
ivsA8hVwRs2D_hVd
X-Originating-IP: [98.138.91.180]
Authentication-Results: mta1053.mail.bf1.yahoo.com from=rocketmail.com; domainkeys=pass (ok); from=rocketmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm20-vm4.bullet.mail.ne1.yahoo.com) (98.138.91.180)
by mta1053.mail.bf1.yahoo.com with SMTP; Wed, 20 Jul 2011 05:21:37 -0700
Received: from [98.138.90.57] by nm20.bullet.mail.ne1.yahoo.com with NNFMP; 20 Jul 2011 12:21:36 -0000
Received: from [98.138.89.167] by tm10.bullet.mail.ne1.yahoo.com with NNFMP; 20 Jul 2011 12:21:36 -0000
Received: from [127.0.0.1] by omp1023.mail.ne1.yahoo.com with NNFMP; 20 Jul 2011 12:21:36 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 44667 invoked by uid 60001); 20 Jul 2011 12:21:36 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; s=s1024; t=1311164496; bh=0QFrq03EIl3p8T9vF50wT6/nEJgdo5j+VydI/TstfcI=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=C0aKlVDws2bej2IPdbERCmVV6cvtk4Sy6Eyw32bXyPtAkiycDRGxcPgo098TuWSU7eoPsdKKYCoSkTRor5TBoDniab92CWSN66MrC093MGaLfRaiZFm5ycg8g52bK31BfBYlO2pZg0OvvhhUb9fGlAl7fjH7EAKTSs6xqT+GQac=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=rocketmail.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=y0UTYL3rW00m8v2+1DkDHiGriNoXDtPEgSDPgZFdbMu5JYuwJvy7unssNCu3OLQcQ86yO7XmfGNEE1GjB8kzdKF3RftRMCIfVW449Ls7bP3vwlX8hSidStTwK99A3UOYY4xFdF3S6T4raLXdfdUzTkoYK1FpSqRynVFu8przXg4=;
X-YMail-OSG: VImTZOMVM1nwoAYYE63KEDGuxh_NXBi8_mc0xfTwsqIpOV2
XPXIeB.W1zapDwSeW2YiAQO25BmVN3A8zzOCg8TxIAvAw.sBCO12Euxns.fI
o_aCg21aMotRJ57CkdZ7R9uLrQj5phtS39ynPdB6UOOdXn4H1ta3kzToHQI0
qqbxt0YOOcWkWUdM3ZS3_6fijKIBv2A8BV4yDUa2hs26rrHBKfYu9ByLCJzC
JqdLD6N68hSpsv0EVU9f_YONKSyKLPRob8o5IkFz2LbVCu4xPsQ0CMxymAjr
90vlYywsxQnOFYJXzKb_jB1l2LR5dWIfmrbhg627x.8Kh_MzJ6ht7NPxP5A-
-
Received: from [175.140.51.104] by web121214.mail.ne1.yahoo.com via HTTP; Wed, 20 Jul 2011 05:21:35 PDT
X-Mailer: YahooMailWebService/0.8.112.307740
References: <[email protected]> <[email protected]> <[email protected]>
Message-ID: <[email protected]>
Date: Wed, 20 Jul 2011 05:21:35 -0700 (PDT)
From:
Reply-To:
Subject: Re: Where are you?
To:
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-250088106-1311164495=:43224"
Content-Length: 6265


Hey baby, sorry i have not been able to speak to you. It is critical with me here right now been detained already since my arrival at the royal police office and investigated ****** this and all the *****. I have requested for a lawyer, hopefully i will be able to speak to you soon.
I am writing you this by the help of a police officer. This saga is almost over and i will come out victorious. I love you forever and a day!

Regards
**End email**

I omitted some info. Like I mentioned, I'm just want to make sure a couple more things before I can really decide if he's real or not.
Just so distraught that I cannot even function right now...

I'm sorry to have to tell you this, but there is absolutely no doubt you are dealing with an African scammer. I can also tell you he is not South African.

I will follow up with another post, and a response to your other question, but want to make sure you know the answer first.

Normally I wouldn't double post, but I want to get into some more detail.

I also get a Malaysia location for the first email, not UK.

He is a scammer, and he is African--most likely Nigerian. I say that, because the English is consistent with western Africa, and there is a large cell of Nigerian scammers operating in Malaysia. The English of South Africans is typically better than that of western Africans--even the small amount you posted very clearly tells me western African scammer, both due to the English and the storyline.

The storyline (I got robbed in a strange country) is textbook scammer. The overuse of terms of endearment (in this case, using "babe/baby" all the time) is also textbook--sadly, the scammer does this partly so he can just reuse the letters without changing the name. The "leading you to believe you will be meeting any time" is also typical scammer.

Here are the results of the headers. One thing I can say is I am 100% sure your are in communication with a romance scammer.

Basically there are three different results below. Malaysia, Nigeria and the UK. I would suspect the UK IP is when the scammer is sending mail from his cell phone. It is possible you are talking to two different scammers one from Malaysia and one from Nigeria. It is also common for Nigerian scammers to go to school in Malaysia so he could travel between both locations. Both are hotspots for scammers.

I'm sorry to be the one giving you the bad news but I think you were suspicious and that is what brought you to this site. Please stop communicating with them. If you ignore them they will go away.

Header Analysis Quick Report
Originating IP: 118.100.250.105
Originating ISP: Telekom Malaysia Berhad
City: Port Dickson
Country of Origin: Malaysia
* For a complete report on this email header goto ipTRACKERonline

Header Analysis Quick Report
Originating IP: 41.155.42.13
Originating ISP: Starcomms Limited
City: Lagos
Country of Origin: Nigeria
* For a complete report on this email header goto ipTRACKERonline

Header Analysis Quick Report
Originating IP: 91.228.1.227
Originating ISP: Netco Solutions
City: n/a
Country of Origin: United Kingdom
* For a complete report on this email header goto ipTRACKERonline

Header Analysis Quick Report
Originating IP: 175.140.51.104
Originating ISP: Telekom Malaysia Berhad
City: Kuala Lumpur
Country of Origin: Malaysia
* For a complete report on this email header goto ipTRACKERonline

Edit Dotti beat me to the punch.

As for the UK IP?

Checking out Netco Solutions leads me here:

http://hma-vpn-tunnel-internet-encrypti ... nload.net/

And this pretty much says it all.

HMA! Pro VPN Tunnel is an advanced yet simple to use application which anonymously encrypts your entire internet connection (by using a VPN - virtual private network system). Our software automatically works with any application or protocol - whether this be web browsing, p2p/bit-torrent, instant-messenging/IRC, online games, Skype, and so on; simply put, any application which requires an internet connection will be encrypted and your IP address (and in some cases your country) will be virtually changed with just a click of a button. We currently have servers located within: USA UK Netherlands Sweden Canada Our easy to use client enables you to easily change country and IP address with ease. No advanced setup is required, simply install and connect. Read more at http://hidemyass.com/pro/

Thank you so much for your responses and the added information is more eye-opening, it just seemed confusing that there were 2 different locations since I thought each country operated independently. And wow, on the UK one. Like I mentioned, I only was talking to one person for sure, so I'm still confused how they would coordinate with each other?

At this point, I just want to at least try to get him to do a video conference with me, the worst that can happen is he refuses and disconnects from me completely. Because without that, I only see he is "exiting" now based on the latest circumstances regardless, or will continue to try to ask me for more help. Given your replies, I will then have to just not to do it, so either way he will end up disconnecting. I've just poured all my life savings, a substantial amount, and I want to at least have a little peace to look at the soulless monster that would go as far as cry so heartfelt and reduced to a little baby and say just about anything to drain me of all my money for almost a whole year now, talking everyday. That has been my main torment since I first parted with my money was hoping all this time before your site, that there was a slim chance it was real and he would indeed return my money after getting him through so many incidents, back to the point where he's able to.

Many Nigerian scammers enter Malaysia on a student visa. These scammers may travel back and forth between Nigeria and Malaysia. It is very possible the scammer did email you from both of those places. As I already pointed out, the UK address is faked. I have dealt with thousands of romance scammers over the years, and there is absolutely no doubt he is one of them.

This is my response to your other question.

If a scammer has managed to get a large amount of money from you, and he knows you still believe in him, he will continue to play his role, even if you have told him that you are bankrupt and have refused to send money. Why? Because you may be telling him you have nothing left, but he is not convinced he can't get more out of you. Other victims have told him "no more" and he has managed to get more.

Do you have a house? Credit cards? A car? A job? An entertainment system? Anything else of value? If you have anything at all, he believes you can get more money. He will play the role of the charming, romantic suitor for a while, until he thinks you are so hooked into his lies that you will do anything for him. His recent emails that you posted are in fact the setup for the next money request. He will soon need money to pay his lawyer or to get out of jail. Don't have the cash? He won't hesitate to tell you to mortgage the house, sell your property, or get a loan (even a payday loan) to get the money (many of these scammers do seem to believe that all Americans have easy access to more money if they want it). He will promise you that it will be fine, because once he gets to you, he will pay you back and make everything better. If you say no, he will lay the guilt on so thick you can barely think. If he can't get cash from you, he may go for a new approach. He will have a check from a friend that needs to be cashed; or a "friend" (really another victim) will wire the money to you, because you can't send it to him right now. He may even give you a credit card number, and ask you to buy something and forward it (making you a shipping mule, and putting your freedom on the line if the real owner of the credit card tracks the purchases to you.)

He will keep playing the role (some days with more attention than others) until one of the following happens:
1. He is truly convinced that he has gotten everything he can from you
2. He has found better-paying victims, and he wants to dedicate his time to them.
3. You cut off all contact and don't allow him access to you (which is what you need to do now).

I hate to be harsh here, but you are now holding onto dangerous false hope. It will not do you or anyone else any good. He is not real. He is a lying thief who will say whatever is necessary to get money from you--but he does not now, and has never cared about you or any of the other women he tells the same exact lies to. He will continue to lie to you as long as he thinks he can use you. No matter what lies he tells you, he will not return any of your money. The only thing he will do is attempt to steal more.

At this point, as difficult as it is, you need to DROP ALL CONTACT immediately. Do not attempt videoconferences (which can be faked), do not attempt to get explanations (there is no limit to the lies a scammer will tell to get what he wants.) Drop him without explanation, without question. There is a link in my signature line with information for victims of romance scams. Please read that information, as some of it will help.

There is almost zero chance he will get on a video call with you. Everything he has told you and the pictures of himself I'm sure he has sent you is a lie. Getting on a video call would only prove that and he will not do that. I can also tell you he will not just give up. It has to be you that stops the communication. I know it is very difficult because he has not only stollen your money but also your love. He created a story to gain your trust long enough to steal your money and will maintain that story. The only way to end it is to imeadiatly stop communicating with him. I hope you will post his details like his name, email address and phone number here so others may avoid the pain you have gone through.

I know this is not what you wanted to hear but please listen to the proof and advice myself and Dotti gave you. We see your exact situation daily.

I wish you the best of luck and I am very glad you found this site before you lost anything else.

Justin