I'm putting this here instead of in the Romance scam forum because as you can see, her first email was very vague, but her second email (although she sent flowers) is leading into the orphaned refugee scam, not a romance scam.
I am Lilian.nice to meet you
How is your day today? My name is Miss Lillian Wilson, 25 years of age, I am the only child of Late Dr Frank Wilson of South Sudan. My father was a successful business man. My purpose for contacting you is first, I want to know more about you so that I will know the areas of which you will be of assistance to my needs.
Although I don't know you personally; but your assurance can motivate me to tell you everything about me. As soon as I receive your response we will decide on the next line of action. You will know me more as we communicate along and I will also send more of my pictures. I attach my picture to enable you know who you are communicating with.
Thanks for your understanding, hoping to hear from you soon.
Yours sincerely,
Miss Lillian.
ipTRACKERonline.com wrote:Header Analysis Quick Report
Originating IP: 106.10.196.95
Originating ISP: Internet Content Provider
City: n/a
Country of Origin: Singapore
* For a complete report on this email header goto ipTRACKERonline
Delivered-To: <snipped>
Received: by 10.107.9.195 with SMTP id 64csp3807005ioj;
Wed, 26 Aug 2015 05:22:25 -0700 (PDT)
X-Received: by 10.107.15.209 with SMTP id 78mr3138295iop.51.1440591745006;
Wed, 26 Aug 2015 05:22:25 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm47-vm9.bullet.mail.ne1.yahoo.com (nm47-vm9.bullet.mail.ne1.yahoo.com. [98.138.121.105])
by mx.google.com with ESMTPS id oo7si3326043igb.18.2015.08.26.05.22.24
for <<snipped>>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Wed, 26 Aug 2015 05:22:24 -0700 (PDT)
Received-SPF: neutral (google.com: 98.138.121.105 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=98.138.121.105;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 98.138.121.105 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected];
dkim=pass [email protected];
dmarc=fail (p=NONE dis=NONE) header.from=gmail.com
DKIM-Signature: <snipped>
Received: from [127.0.0.1] by nm47.bullet.mail.ne1.yahoo.com with NNFMP; 26 Aug 2015 12:22:24 -0000
Received: from [98.138.226.176] by nm47.bullet.mail.ne1.yahoo.com with NNFMP; 26 Aug 2015 12:19:43 -0000
Received: from [106.10.166.63] by tm11.bullet.mail.ne1.yahoo.com with NNFMP; 26 Aug 2015 12:19:43 -0000
Received: from [106.10.151.15] by tm20.bullet.mail.sg3.yahoo.com with NNFMP; 26 Aug 2015 12:19:43 -0000
Received: from [127.0.0.1] by omp1020.mail.sg3.yahoo.com with NNFMP; 26 Aug 2015 12:19:42 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
X-YMail-OSG: <snipped>
Received: by 106.10.196.95; Wed, 26 Aug 2015 12:19:42 +0000
Date: Wed, 26 Aug 2015 12:19:42 +0000 (UTC)
From: <[email protected]>
Reply-To: <[email protected]>
Message-ID: <[email protected]>
Subject: Hi
MIME-Version: 1.0
I am Lilian.nice to meet you
Delivered-To: <snipped>
Received: by 10.107.9.195 with SMTP id 64csp4377689ioj;
Wed, 26 Aug 2015 23:33:39 -0700 (PDT)
X-Received: by 10.112.130.97 with SMTP id od1mr1313895lbb.37.1440657219208;
Wed, 26 Aug 2015 23:33:39 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-la0-x22d.google.com (mail-la0-x22d.google.com. [2a00:1450:4010:c03::22d])
by mx.google.com with ESMTPS id z1si805201lbw.159.2015.08.26.23.33.38
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 26 Aug 2015 23:33:39 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a00:1450:4010:c03::22d as permitted sender) client-ip=2a00:1450:4010:c03::22d;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:4010:c03::22d as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-la0-x22d.google.com with SMTP id a3so4374571lab.1
for <<snipped>>; Wed, 26 Aug 2015 23:33:38 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.152.5.40 with SMTP id p8mr1672230lap.10.1440657218173; Wed,
26 Aug 2015 23:33:38 -0700 (PDT)
Received: by 10.114.161.228 with HTTP; Wed, 26 Aug 2015 23:33:37 -0700 (PDT)
Date: Thu, 27 Aug 2015 07:33:37 +0100
Message-ID: <CAPtmSRsAXqarutq=ibjKY373Ot36rjTFAjQ=tUH3YcGM8YJEwQ@mail.gmail.com>
Subject: Re: Hi
From: Lillian Wilson <[email protected]>
To: <<snipped>>
How is your day today? My name is Miss Lillian Wilson, 25 years of age, I am the only child of Late Dr Frank Wilson of South Sudan. My father was a successful business man. My purpose for contacting you is first, I want to know more about you so that I will know the areas of which you will be of assistance to my needs.
Although I don't know you personally; but your assurance can motivate me to tell you everything about me. As soon as I receive your response we will decide on the next line of action. You will know me more as we communicate along and I will also send more of my pictures. I attach my picture to enable you know who you are communicating with.
Thanks for your understanding, hoping to hear from you soon.
Yours sincerely,
Miss Lillian.
====================================
PLEASE DO NOT TELL A SCAMMER HE IS REPORTED HERE!
Learn what a scam is and how to protect yourself
https://www.scamwarners.com/forum/viewtopic.php?f=3&t=5
PLEASE DO NOT TELL A SCAMMER HE IS REPORTED HERE!
Learn what a scam is and how to protect yourself
https://www.scamwarners.com/forum/viewtopic.php?f=3&t=5