Antiscam.Net

Hello, I was checking my bleak results on yahoo personals when appeared a message from a nice Russian hairdresser saying basically that she saw me on her friends "yahoo personals" account, was interested, and to please e-mail her at another address. For two weeks, er and I have exchanged daily e-mails. Now her plan is for me to send $340 so that she can travel to U.S. on tourist visa.
My Question is: is it possible for her to come, then get K-2 here? And can she send proof this is legit first?

This is the standard 'please send me money so I can come and visit you' scam. Avoid at all costs.

Yeah, as the man says. This is a scam. There is no way she's going to get a tourist visa to come to you.

I'm sure you meant a K1 visa? a K2 is for the child/children of a person who is already in the states on a K1 fiance visa.

Her plan is for you to send her $340 ? Here's a better plan. Tell her to get $100 together and apply for the visa. Once she has it she can send you a scan of the visa. Then you can check with the embassy if it's genuine. Much better plan I think ?

Hi All
I received an email from a Russian girl and keep getting emails. We have exchanged photos and spoke about lives in general, but the person has asked nothing from me.

Is it just the case that I will not know if it is a scam until they ask for some money ?

I cant see any pictures of this girl on the black lists but she may be new.

Being a bit of a nerd, I did a search on the origin of the IP address from where the emails are coming from. They appear to be coming from an ISP approx 300 miles from where she lives which is unusual if this was the UK, but the internet may work differently in Russia as there may be less static IP's.
I am a believer that if it is too good to be true then it is.
Has anyone got any advise for me ?
Am I discussing this in the correct forum ?

Many thanks in advance
Mart

Hi Mart

It's often the case that there are some tell tale signs in the emails you receive as to whether this will turn into a scam or not. Often they don't come out directly with requests for money but rather slowly build up a sob story and play on your feelings of chivalry....you know, rescuing the damsel in distress and all that?

Having said that, there are still a lot of genuine women out there. Often you can get the impression that the world is full of scammers but actually that is not the case. The majority of people are still open and honest and you can indeed find your perfect partner online. I know many people who are happily married ten years on after finding a partner through dating sites

Thing is, you have to keep an open mind. Go with it like she is not a scammer but keep caution as your best friend, and let's face it, you have not met this person yet so being cautious is a perfectly sensible approach.

Number one thing though is keep a very tight hand on your wallet! Do Not Send Money! If this woman is serious she won't even think of asking you for money. Genuine women have a sense of pride and would not want you to think she needs help all the time.

If in doubt just ask here or email me

Hi Saul

Firstly, may I thank the admin and owners of this site for offering a great unselfish service to the UK.

Thanks for your reply and advise has been taken. I do suspect this is a scam and if I confirm I will let you know.
Whet is the best course of action if I have confirmed that she / they are scammers ?
KR
Mart

Is she associated with a dating agency or did you just receive a private email out of the blue? Also do you have your profile listed somewhere....don't say where of course and if so did she say in the email where she found you ?

If she does turn out to be a scammer then of course let us know first because we can get that info out there very fast and hopefully you will then have saved a few other people from losing money.

Hi again,
This was from an email out of the blue which looked like an agency, but in the description was a different contact email address. To be honest, I wasnt looking for anyone, and I saw this email come through and for a laugh I replied "If only you were real" and I was very shocked when I got a reply. She looked real, whereas most of them just look like a model paid to scam someone.
As far as I know, I am not listed on a site but I have made some enquires around this topic many years ago and have had the same email address for some time so I think I may be on a mailing list. I think I my profile was found on one of the popular global sites. I looked into the email header and saw the mail client being used was some software know as "The Bat V3.0" . She said she sends me messages from and Internet Cafe and when I looked at this software I cant think for one moment why they would use it on a public PC, and to be honest it is more suited to someone who has multilple email accounts.
As I was curious, I asked her to send me a photo with a personal message and the next day I got one with her holding some paper with a message to me. I looked into the details of the photo and it is a recent photo unless someone has found a way to edit the hidden "date taken" details.
I received an email on Sunday morning with normal chit chat about life, and I am waiting for another reply. I checked the origin of the IP address from the mail header and whilst it is from Russia, it is a number of miles from where she says she is from.
My concerns are the same as yours as someone who is less of a "IT NERD" than me could be totally sucked in.

Well The Bat, as you may know already is a lot more popular in the east than here in the west and as you rightly said, it is more often used by people with multiple email accounts and in particular to send out large amounts of mail at one time. It's often said that it's a sure sign of a scammer but of course there are plenty of legitimate users of The Bat so it's not an indication on it's own.

The ip address thing is of more concern especially if she's not using a free mail account. A distance of 300 miles from where she's supposed to be sending from is a pretty good indicator that she is indeed not where she says she is.

Also given that this was an unsolicited email is not a good thing. Of course as you say, your profile may still be out there somewhere but she gave no indication of where exactly she found your email address? I would have thought that would have been one of the first things she mentioned.

All in all I think there is a pretty high probability this is a scam waiting to happen. I have no doubt that sooner or later the subject of her coming to see you will crop up along with the associated request for help with tickets and visa etc.

Ask her directly where exactly she found your profile. She should be able to remember that I think.

HI Saul,
I have asked the question twice of where she found my profile and both times she has avoided to answer so its not sounding good. The email came from a Yahoo.com but in the header there was an originating IP address which I tracked down to approx 300 miles from where she said she was from. I was concerned as when I do a track on email from me, the closest I can get is around 30 miles from where I live when sending from home. What I wasnt sure of was that in Russia, whether the internet nodes were much more spread out across the country

If she's avoiding the question I would press the matter and leave no doubt that you either get a straight answer or you walk away.

As for the nodes in Russia, yes they are quite far apart but I don't think they are 300 miles apart! There is something very wrong with that picture.

Hi Saul
I have another nice letter today. Still not asking for anything but the source code is as below.

From: Kseniya <** deleted by martin **>
Subject: Hello!!!
Date: 19 January 2010 20:13:30 GMT
To: ** deleted by martin **
Reply-To: Kseniya <** deleted by martin **>
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtTQ0w9MA==
X-Message-Status: n:0
X-Sid-Pra: Kseniya <** deleted by martin **>
X-Auth-Result: NONE
X-Message-Info: JGTYoYF78jFhixYRjcETUD5qHByTFXQWKWpmeRf1KdaslqPBbDH7qi93CYeBaDRMRF+
QpKTOtAzv34SYb83lDi5M1rv6s9kZ
Received: from smtp103.plus.mail.re1.yahoo.com ([69.147.102.66]) by bay0-mc4-f23.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 19 Jan 2010 13:13:57 -0800
Received: (qmail 44526 invoked from network); 19 Jan 2010 21:13:55 -0000
Received: from 105.29.pppoe.mari-el.ru (kseniyaonlyyours@77.40.29.105 with plain) by smtp103.plus.mail.re1.yahoo.com with SMTP; 19 Jan 2010 13:13:49 -0800 PST
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Received:X-Yahoo-SMTP:X-YMail-OSG:X-Yahoo-Newman-Property:Date:From:X-Mailer:Reply-To:X-Priority:Message-ID:To:Subject:In-Reply-To:References:MIME-Version:Content-Type; b=JwdiVS2rQ3e9k1IlHs6XIWud9y1JQBOwoPVmceH45ZEswp+ju3RKchUKJsL+R7Q9/
3g2euB72fz/P6NcgxD8lwtJg8jexgkBcSvFxvMdYl8ANTDTLm4fcXjzhihnaHZLCelj+ey
F1+mT4Cn+5WSbgAYBUiFfFQhojI3Ys8qGdQ= ;
X-Yahoo-Smtp: 82kJBq.swBB_5qTvRdGZ6D.Z2rTtIxiyz8iumAo-
X-Ymail-Osg: 1ae7FLUVM1nCjUKibYLqVNzPfNBRnDT7hMURhlkTUjT8mPf5C5nbDNWDoSga7VJqeRIA
1crFWF2it4VliAUMTOxVoqcjgq2jUQzuwFbi_hLShrIYX.usT78BrWs.6rZMRusBOABotdy
lUMyHyeA1lWu8SEkgZ2WyidVP1h5lYvjeaLVAylWtpAINJN1HbM_HHd5gFqp8VsMz7Q
YiaObDhQfKLiAGmQqmQWprksXrGJogTuHgqpT.mTBClJG.XuFjZbVrri1ODcBtfiDBEhf7
xoejTVjzHpqnLxTghJc4i3kYVn0zDgi0E54BFsQaqEO48NQBx8DhYZDV73cZIbPybzWK
OPWGexv2rfn11i_sP31UK.13sTggBMw0mx124FU9JZAM9TXNF6XIQ2BzZ3oeofGe
X-Yahoo-Newman-Property: ymail-3
X-Mailer: The Bat! (v3.0) Professional
X-Priority: 3 (Normal)
Message-Id: <435104437.20100119231330@yahoo.com>
In-Reply-To: <BLU0-SMTP60901304E8F1C4D3F111D8CA660@phx.gbl>
References: <01ca8cd7$9c344910$78218d3a@alysonn>,<BLU0-SMTP101D88E607BD4CE35E1F262CA750@phx.gbl>,<1098183203.20100107232527@yahoo.com>,<BLU0-SMTP22E5570D768F99DB66355BCA700@phx.gbl>,<375180705.20100109192523@yahoo.com>,<BLU0-SMTP173F63801C98CBAB7EBF6ACA6C0@phx.gbl>,<713673049.20100113222135@yahoo.com> <SNT114-W1543E918DE650EC1EEE1D2CA6A0@phx.gbl> <2910416164.20100115234309@yahoo.com> <BLU0-SMTP60901304E8F1C4D3F111D8CA660@phx.gbl>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="----------421881233AD6353F"
Return-Path: ** deleted by martin **@yahoo.com
X-Originalarrivaltime: 19 Jan 2010 21:13:57.0162 (UTC) FILETIME=[4FF6D0A0:01CA994C]


If you look in the code, you can see the mailer is "The Bat"
IP address is 77.40.29.105 which is Yoshkar-Ola Russia (Scamming capital)
The postal address given to me today is in Samara - I have got a friend checking to see if this is genuine. An anti-scam site in Germany is also suspecting this girl as a scammer.
Hope no one gets caught out.

Well if she's using 'The Bat' mail client I don't think she's sending from an Internet Cafe. I have never heard of an Internet Cafe using a standalone mail client. They work on the principal that everyone uses web based mail so, that to me sounds like a lie straight off.

If her mailing address is Samara then that's approx where her ip address should resolve to. Samara is a big place, in fact one of the largest cities in Russia and has a very good internet infrastructure. So why would her ip address resolve to somewhere hundreds of miles from where she says she lives? Doesn't add up.

Totally agree, I have responded with a very nice reply with the following details.
I need to go and see some colleagues in Russia over the next few weeks so I have suggested that I make a trip to Samara to visit (not that anyone will be there). I have also said that I need to visit some customers in Yoshkar-Ola which is where the emails are coming from and asked of she knew where that was (HA HA)

Should be interested to see what if any response comes from it.

I also added in very small text at the bottom, the words "Your IP address is XXX"

ITS ALL GOOD FUN !

Excellent! Will be very interesting to see what comes back. They are a slippery bunch these scammers and will often go to great lengths to keep you on the hook if they think there is a pay out coming their way.

Keep her/him/them on the hook as long as you can. Lets see how it plays out