Information on romance scams and scammers.
#144150 by fedamore666 Thu Jan 10, 2013 9:44 am
Hello Anthony Here

Hi I have been emailing with the folowing person claiming to be from russia . I detect that she is a scammer can someone help me.

This is the header
From Nataly Thu Jan 10 05:46:58 2013
X-Apparently-To: Removed via 188.125.83.172; Thu, 10 Jan 2013 05:04:28 +0000
Return-Path: <[email protected]>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
b3VzIGJlY2F1c2Ugb2YgdGhlIGRpZmZpY3VsdGllcyB0aGF0IGhhZCBmb3Jn
b3R0ZW4gc2thenQgdGhhbmsgeW91IG15IGxvcmQsIGZvciB5b3VyIGJlYXV0
aWZ1bCBwb2V0cnkhIEknbSBzbyBnbGFkIHlvdSBhZ3JlZWQgdG8gaGVscCBt
ZSBhbmQgZXZlbiByZXR1cm4gaGVyIGpld2VsZXJ5IEthdHlhISBJdCBpcyBh
biBhY3Qgb2YgdGhpcyBnZW50bGVtYW4sIEknbSBwcm91ZCBvZgEwAQEBAQN0
ZXh0L3BsYWluAwMyAjE1LmpwZwNpbWFnZS9qcGVnAwM5MzA-
X-YMailISG: MpkfJr0WLDuEQOOSBVT31IrgdabJ6uFRacfLCGgI_354Y.zt
fhzQNqKFaajxX8tsnIa9mI._xHvY0bbskdZNgrOswkE4dWkCVJp1t2_.DIAs
WRaIuTTdfaClWyFMU67NyO3UDeQH8A3YH2MLRng4CG4f_rscuBxi5Eam3lWu
ElOwqllJQRt0g5t7UKMaMKW0AYtFHws2EsIAMAzXMKn6zeaBq4Gnd1iLM2fv
q6LS0hvd.PXYXnxr.AVzn9.d6L9bXj98e2E.hxx7eQOs88kBP0R5p8.YCD74
nDFG0W5_LoMlGlLxpuZskcpNyIMNVvsMStCgOLQ_LVeLeeUsW7NwSbrAhqV8
GeJZNNMODriUe1ZsPJxeV3t6VJIudn4443.XxSov1V4FAV4lOLf14dGJuISV
_OGBR7ZHCjjms.83vdnZgtRpULPG8WLZZlvbvUyYtA18xtoOdlKF4bR2okys
2shZh8RN5zUPhtncnPTLXOPEn_JcZ8bBn3Ydcj2cSJ8GVAV6iCgnfNrZsQly
V2WdSDlOWX1OGC_GYwcXY9CXHnGDE1ASb0GwgRSKcyKGHLGKP81jEUw.YX7j
fX2Y.RNEAJm4ioF_uliKaWRxZhAgpvbec56EZEDOhuzV4KnqiPfsCeU_gI2G
vob8glwj5tDQV8j_gzW.x_4UC2O2YC_TyEf23rD1VymhLLQ7zWzCbNdenLtI
gheMXYpsSKefz01BlcrJ1kCYSBZFhDRLj85jZFR2_zNxZKmd8nF.d0be2Rw5
NEnCuB8uV5JPwvE4eMWUuw_P.u11Kuo0PzILqILgCINz9tpw1xr3mmukGEjt
.pU1JPVsJHnxGMu3HWBqM6q_AbvlBzzzgoUNykYj.0u0CT00b6g6cE8HlCDf
5nIIfV1OtzEXE7u_LlBFCnfTDLYxaeLiL4Ixt4AePQyXyfcAWcg.0To3gOM_
O2XAhZUfLpYBKx3grv2RAgRTkjyyMaMdyJ4qjzpRlG56hT78snSCrnX6waOm
Q9DMyCGeeUvvtMka6aCoLtJKZHnOkmjcJVw2Qs..4RgbSF_2Lgjf9w_PgomT
D27eyFygoTTPtFvH8FYQbujznsG8mn22iYEl2YcXdxWtl7XT336Y_tLqJxU5
7oxucj98_u8Luxc0vKKEUqC2wBRF.wbdKodlDVixXL16ZRbre5B1OVYRhgBC
MdHeeAM_
X-Originating-IP: [77.238.189.68]
Authentication-Results: mta1077.mail.ird.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm15.bullet.mail.ird.yahoo.com) (77.238.189.68)
by mta1077.mail.ird.yahoo.com with SMTP; Thu, 10 Jan 2013 05:04:28 +0000
Received: from [77.238.189.49] by nm15.bullet.mail.ird.yahoo.com with NNFMP; 10 Jan 2013 05:04:28 -0000
Received: from [217.146.188.164] by tm2.bullet.mail.ird.yahoo.com with NNFMP; 10 Jan 2013 05:04:28 -0000
Received: from [127.0.0.1] by smtp132.mail.ird.yahoo.com with NNFMP; 10 Jan 2013 05:04:28 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1357794267; bh=Obr8zAnYCYHyAjF7Gc2sn4G2zAPXioCRiH+dbVYVCh8=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Date:From:X-Mailer:Reply-To:X-Priority:Message-ID:To:Subject:In-Reply-To:References:MIME-Version:Content-Type; b=0RL6IlXiARgEs0yVTR32xgT1tl9E5bg4xyLKdOb2y/6Nlku50v1ETkSQQSPTs183vJZIgI2oVuuT/Yad3wCcemoa1dxVquQ7jp7JWeVBDox6YEw+HT2vv1flPx5RuL9QyGg2jFr/vfUVU5vIpnOd2h3dGbdZigvxyG4eNGBoEDM=
X-Yahoo-Newman-Id: [email protected]
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: XxGcio8VM1mVSzSr4NG1yQcjefV5PXpKJmzu6nEttCsRuI0
3NfA94vyt4e0hFCSgddY5c2UC7Pp05lNCC63Uh2qNSwnmqBCcX78kNbBlKIg
qs4jMh5__yuY4Oj2hZYoRq6.9hPbb1yyC7G9h_lvDpGN49J4rHhDE65YTtS9
WZtJgbp4lSvo7sffV99jll.yY8RePRqnLmi8i..0liI5YU9ttjGYLdaEInbM
_n9Lf47sYgY3guG6qkd51mIA6BYUqIUoANHI4VciQ1R3Ot7hpz3aJ7lUrXo4
_lZrvmNxKN8vT6r9jz28KYyNxYfxCCdflZ44hFMks62nAnoZdSdmmUZ3T.vB
B3yZeke0nDHLcoc1xt.aMgR3R276JByalErB1as2dglEGMTeyAMk_wi3nMT_
lV97rW9FLwUPUvdt8g6aRXpgenBjqstIPnTo-
X-Yahoo-SMTP: NN._jumswBAKfPIpq3OkSGItCA74ww--
Received: from [188.187.143.18] ([email protected] with plain)
by smtp132.mail.ird.yahoo.com with SMTP; 09 Jan 2013 21:04:27 -0800 PST
Date: Thu, 10 Jan 2013 08:46:58 +0300
From: Nataly <[email protected]>
X-Mailer: The Bat! (v3.0.1.33) Professional
Reply-To: Nataly <[email protected]>
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: Anthony <Removed>
Subject: About our meeting!
In-Reply-To: <[email protected]>
References: <[email protected]>
<[email protected]>
<[email protected]>
MIME-Version: 1.0


Content-Type: multipart/mixed;
boundary="----------73F75619CABAD0"
Content-Length: 953930

Her EmailAddress [email protected]

This is the message

Hello my dear.
Yesterday, I was so nervous because of the difficulties that had forgotten skazt thank you my lord, for your beautiful poetry!
I'm so glad you agreed to help me and even return her jewelery Katya!
It is an act of this gentleman, I'm proud of her man Anthony!!!
Unfortunaly I do not have many photos, but the original, real sexy, I will show you when we meet!!
I need you so much I can't be without you!!!!! Anthony each minute I think only about you. I think of our meeting!!!!!!!!!!!
Anthony I want only to be with you and I'd like to confess myself to you fully.
Each morning, each dinner and each evening I want to be with you, With YOU MY Dear Anthony!!!!!!
I want to see you so much, my love!!!I want, that when I opened eyes in the morning you was always beside to me!!! I expect the day when
I will see you, my dear Anthony!!! I want to take a walk with you during this fine weather.
I WANT THAT WE WERE ALWAYS TOGETHER, MY dear Anthony!!! I BELONG to YOU. Remember, that I Adore you, my charm.
I adore you and miss you!!!! How do you feel yourself my lovely???
As for me each day I think only about you and can not sleep because I want to be near you,
I am very strong and I adore you. Each day, each hour, each minute and second I think and I dream only of you.
At last let's meet and we will kiss each other, also we will do each other pleasure and pleasure in our new life, I want you!!!!! I adore you!!!
Nataly!!!

Mod edit: Removed poster's email address - CW
Advertisement

#144172 by began steele Thu Jan 10, 2013 12:29 pm
Yes scammer and the use of "The Bat" shows this is a mass mailer. I found a Kar Nataly on Myspace but don't know if it is him or not.

We sleep safe in our beds because rough men stand ready in the night to visit violence on those who would do us harm. ~~ George Orwell.
#159867 by began steele Sun Mar 31, 2013 5:35 am
Here is part of the email header. I respond due to a PM sent today.

From: Nataly <[email protected]>
X-Mailer: The Bat! (v3.0.1.33) Professional
Reply-To: Nataly <[email protected]>
X-Priority: 3 (Normal)
Message-ID: <[email protected]>

Normal people do not use it. It is a mass mailing program, popular with E.European scammers . It has one purpose only to ensure all victims are emailed
http://en.wikipedia.org/wiki/The_Bat!
The Bat! is a shareware e-mail client for the Microsoft Windows operating system, developed by RITLabs, a company based in Chi?in?u, Moldova.
The Bat! has been regarded as an alternative e-mail client for advanced e-mail users.[1][2][3][4] It is often praised for its focus on security,[5][6][7] as well as user interface customization and filtering capabilities.[8][9]

Forged headers
The client's name was included as a preset for forging the X-Mailer software user agent identification header in a popular mass-mailing tool. Due to the client's relative obscurity, this has led some parties to proclaim that The Bat! itself is a spamming tool, and advocate blocking all messages marked as created by The Bat!.[12] SpamAssassin rules now include detection for such forged headers.[13]

It is only used in this context by a SCAMMER

We sleep safe in our beds because rough men stand ready in the night to visit violence on those who would do us harm. ~~ George Orwell.

Who is online

Users browsing this forum: No registered users and 94 guests