DelphiFAQ Home Search:

Dating scammer Nadezhda Linkova

 

comments582 comments. Current rating: 5 stars (7 votes). Leave comments and/ or rate it.

Name: Nadezhda Linkova


Email: Lyamurl@rambler.ru


Address:
Kazan, but reported at one blacklist as an ordinary Mari-El-scam.


Other Comments:
I proudly present: My Nadezhda!
Also known as Kseniya Gerasimova, Maximov St 26, Kazan.
She does not have any patience, but a nice digi-cam. If you write to her few and short sentences, she will even read your mail and answer you with fresh pictures!
First letter:
Hello! My name - Nadezhda.
I read your questionnaire, and I think, that you which that person I searched. If you will answer me, I shall be very pleased. And in the first letter I shall send you a photo.
I hope, that I shall love you, and I think that we shall find in the friend the friend the general. I very much want to correspond with you and to learn about you in the greatest possible degree.
I think, that you very interesting person, it will be very pleasant to contact for me you.
I shall be very much upset, if you will not write to me.
P.S. I write from the Internet - cafe, therefore I have inquiry to you.
Please write to me on my letter box: Lyamurl@rambler.ru


Content-type: text/html

Comments:

You are on page 12 of 39, other pages: 1 2 3 9 10 11 [12] 13 14 15 36 37 38 39
2007-07-30, 06:12:54   (updated: 2007-07-30, 06:13:33)
anonymous from Germany  
Sorry again, back to the theme:
'the one that interests is the one of reception'
Do you mean the first IP is the most important?
2007-07-30, 06:17:25
drod from United States  
Guys,

I use this one, copy/paste full header and it searches most of the IP's listed.

http://headertool.a..m/headers

It did not pick up the 192......

But did the other 2, here's what I got:




WHOIS - 207.226.45.246
Generated by www.DNSstuff.com
Location: United States [City: Herndon, Virginia]

Using 8 day old cached answer (or, you can get fresh results).
Hiding E-mail address (you can get results with the E-mail address).


OrgName: Beyond The Network America, Inc.
OrgID: BNA-42
Address: 520 Herndon Parkway
Address: Suite E
City: Herndon
StateProv: VA
PostalCode: 20170
Country: US

NetRange: 207.226.0.0 - 207.226.255.255
CIDR: 207.226.0.0/16
NetName: BTN-CIDR3
NetHandle: NET-207-226-0-0-1
Parent: NET-207-0-0-0-0
NetType: Direct Allocation
NameServer: NS.CAIS.COM
NameServer: NS2.CAIS.COM
Comment: Rwhois information on assignments from this block available from
Comment: rwhois.cais.net 4321
RegDate: 1996-10-16
Updated: 2004-11-12

OrgNOCHandle: NOC1582-ARIN
OrgNOCName: NOC
OrgNOCPhone: +1-703-621-1637
OrgNOCEmail: **************@btnaccess.com

OrgTechHandle: JKI101-ARIN
OrgTechName: Kim, Joon
OrgTechPhone: +1-703-621-3974
OrgTechEmail: ****@pccwglobal.com

# ARIN WHOIS database, last updated 2007-07-20 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.






WHOIS - 194.67.23.122
Generated by www.DNSstuff.com
Location: Russian Federation (high) [City: Moscow, Moskva]

ARIN says that this IP belongs to RIPE; I'm looking it up there.

% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net..ight.html

% Information related to '194.67.23.0 - 194.67.23.255'

inetnum: 194.67.23.0 - 194.67.23.255
netname: MAILRU-NET
descr: Mail.ru
descr: Pushechnaya st., 2/6
descr: 103012, Moscow
country: RU
tech-c: VG659-RIPE
admin-c: VG659-RIPE
status: ASSIGNED PA
notify: ***@sovam.com
mnt-by: AS3216-MNT
changed: ***@sovam.com 20040609
source: RIPE

person: Vladimir Gabrelyan
address: 2/6, Pushechaya str., Moscow, Russia
e-mail: *********@corp.mail.ru
remarks: fax-no: +7 095 7256357
fax-no: +7 495 7256357
remarks: phone: +7 095 7256357
phone: +7 495 7256357
nic-hdl: VG659-RIPE
changed: *********@corp.mail.ru 20040608
source: RIPE
remarks: modified for Russian phone area changes
changed: ********@ripe.net 20051216

% Information related to '194.67.0.0/18AS3216'

route: 194.67.0.0/18
descr: SOVAM DELEGATED BLOCK-1
origin: AS3216
notify: ******@sovam.com
mnt-by: AS3216-MNT
changed: ***@sovam.com 19960708
source: RIPE


[The following lines added by www.dnsstuff.com per requirement by RIPE]
This service is subject to the terms and conditions stated in the RIPE NCC Database Copyright Notice.
Contact dnsstuff.com's 'info2@' address to report problems regarding the functionality of the service.


............


hope this helps, and the header search is FREE.

good hunting...........drod
2007-07-30, 06:20:10
anonymous from Germany  
Ahh, thank you, Drod. To paste the full header is the easiest way.
2007-07-30, 06:25:23
drod from United States  
After you 'search', click the 'who is' link for each IP. It will give you the detailed results above.

good hunting and enjoy........drod
2007-07-30, 07:40:11   (updated: 2007-07-30, 07:59:19)
Eddie from Sweden  
anonymous from Germany

it's always the last IP in the header that's important, that's the originating IP.
The others IPs are the different servers it passes through on it way.
Here's a header from mail I wrote to myself:

Return-Path: <mickeymouse@comhem.se>
Received: from ch-mail03.sth.basefarm.net (10.7.4.102) by cpms03.sth.basefarm.net (7.3.121.2)
id 4649994200DA7EF7 for u00000407@pne.comhem.se; Mon, 30 Jul 2007 15:25:53 +0200
Received: from ch-smtp02.sth.basefarm.net ([80.76.149.213]:38618)
    by ch-mail03.sth.basefarm.net with esmtps (TLSv1:AES256-SHA:256)
    (Exim 4.66)
    (envelope-from <mickeymouse@comhem.se>)
    id 1IFVFn-00079N-AG
    for u00000407@pne.comhem.se; Mon, 30 Jul 2007 15:25:43 +0200
Received: from c213-200-170-105.bredband.comhem.se ([213.200.170.105]:2641 helo=DFH2TM1J)
    by ch-smtp02.sth.basefarm.net with smtp (Exim 4.66)
    (envelope-from <mickeymouse@comhem.se>)
    id 1IFVFm-0006p6-8x
    for mickeymouse@comhem.se; Mon, 30 Jul 2007 15:25:43 +0200
Message-ID: <001501c7d2ad$1e8e83e0$69aac8d5@DFH2TM1J>
From: 'Mickeymouse' <mickeymouse@comhem.se>
To: 'Mickeymouse' <mickeymouse@comhem.se>
Date: Mon, 30 Jul 2007 15:25:38 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary='----=_NextPart_000_0012_01C7D2BD.E1E08C70'
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138
X-Originating-IP: 213.200.170.105
X-Scan-Result: No virus found in message 1IFVFm-0006p6-8x.
X-Scan-Signature: ch-smtp02.sth.basefarm.net 1IFVFm-0006p6-8x ea378cf2ac39bf148df2e2e56a2a2b90
X-Scan-Result: No virus found in message 1IFVFn-00079N-AG.
X-Scan-Signature: ch-mail03.sth.basefarm.net 1IFVFn-00079N-AG 1b68a258d17a93cdeb9ecbb27138979c
X-Spam-Score: 3.0 (+++)
X-Spam-Report: Scanned by ch-mail03.sth.basefarm.net
    pts rule name description
    ---- ---------------------- -------------------------------------------
    0.0 HTML_MESSAGE BODY: HTML included in message
    3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99%
    [score: 0.9858]


****The last 'received: from' IP address is 213.200.170.105

Trace this IP in RIPE and you get:
inetnum: 213.200.128.0 - 213.200.190.255
netname: STOCKHOLM-CUSTOMER-CABLE
descr: Com Hem Stockholm customer broadband access
country: SE
admin-c: CH1252-RIPE
tech-c: CH1252-RIPE
status: ASSIGNED PA
remarks: Contact abuse@comhem.se concerning criminal
remarks: activities like spam, hacks, portscans
mnt-by: COMHEM-MNT
source: RIPE # Filtered
role: com hem LIR
address: Com Hem AB
Birger Jarlsgatan 57B
Box 191 50
Stockholm 104 32
SWEDEN
********************************
Abuse & intrusion reports should
be done online at:
http://www.comhem.s../begin.do
********************************
phone: +46 8 55363000
fax-no: +46 8 6601640
abuse-mailbox: abuse@comhem.com
org: ORG-chA1-RIPE
admin-c: NA1607-RIPE
tech-c: HL1251-RIPE
nic-hdl: CH1252-RIPE
mnt-by: COMHEM-MNT
source: RIPE # Filtered
% Information related to '213.200.128.0/18AS39651'
route: 213.200.128.0/18
descr: SE-CHELLO-20000330
origin: AS39651
mnt-by: COMHEM-MNT
source: RIPE # Filtered
% Information related to '213.200.160.0/19AS39651'
route: 213.200.160.0/19
descr: SE-CHELLO-20000330
origin: AS39651
mnt-by: COMHEM-MNT
source: RIPE # Filtered

which is exactly right, I have cable internet and I live in the stockholm area. Revealing my IP is no problem because it would still be very difficult to trace my address and details etc. Comhem is the major internet provider in Stockholm county an area with 2m people. Someone would have to hack into comhem's files to find my details and even then I could be using someone else's computer.

The point is if a sender claims to be in a certain location and the IP address says something different, then that is suspicious in itself.
2007-07-30, 08:13:06
Eddie from Sweden  
a scammer can also use 'IP address spoofing', ie create IP packets with a forged (spoofed) source IP address to conceal his location or impersonate another computing system.

I've seen forged IP addresses in scammer email headers

2007-07-30, 08:18:28
anonymous from Netherlands  
New picture



Keywords:
2007-07-30, 08:41:07   (updated: 2007-07-30, 08:43:19)
Peter from Germany  
Thx, Mickey. I've already tried to open an account on rambler.ru but failed.
To very anon from Holanda: Isn't that french at the blue sign??? I can't see it from here.
2007-07-30, 11:46:47   (updated: 2007-07-30, 11:54:13)
anonymous from Netherlands  
Nein, Peter!!!! Deutsch! Da steht doch wirklich: Schlecker. Oder soll ich mahl zum Artz?
Aber Hubsch ist dass Luder!!! (rechts) Bist du dass, in der Mitte, der versucht um das Schilt zu lehsen? Anon.D.


2007-07-30, 11:51:48
anonymous from Portugal  
Para: Pedro com>
Assunto: Hello Pedro

| | | Caixa de Entrada

MIME-Version: 1.0
Received: from smtp4.yandex.ru ([213.180.223.136]) by bay0-mc9-f16.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Mon, 23 Jul 2007 08:19:08 -0700
Received: from nat.spectrumsat.net ([207.226.45.254]:41455 'EHLO user-2' smtp-auth: 'Nades1978' TLS-CIPHER: <none> TLS-PEER-CN1: <none>) by mail.yandex.ru with ESMTP id S737691AbXGWPS7 (ORCPT <rfc822; >); Mon, 23 Jul 2007 19:18:59 +0400
X-Message-InfLsUYwwHHNt1ET/ VEx46cHR/vVpAfA6q682qKrQRu1zqCGe7MOQk6en/5BMy6cy6cjIC
X-Comment: RFC 2476 MSA function at smtp4.yandex.ru logged sender identity as: Nades1978
Return-Path: Nades1978@yandex.ru
X-OriginalArrivalTime: 23 Jul 2007 15:19:08.0519 (UTC) FILETIME=[D09F6F70:01C7CD3C]

Hi my darling I with the great pleasure read yours the letter. I am
very glad that your feelings to me such fine. I hasten to assure you
that wash feelings to you as much sincerely. I as well as you
represent an our meeting. I think that it will be fine. The first
minutes will be disturbing. In fact we we shall meet, we shall see
each other in a reality. But then we with you shall speak and speak. I
shall hold your hands, to look in your eyes. It will be the most
touching minutes. Hearts will jump out from my and your breast. I
shall love you as who another. I think that our representations about
a meeting coincide. I hope that you will be capable to present me
unforgettable love. Otherwise as we could find each other. I hope that
this letter will be completely understood by you, in fact I sincerely
tried to tell to you about my feelings to you my darling. Does not
pass also day that I did not think of you. Such person as you is a
limit of my dreams. But the most important advantage in you is your
love to me. My darling Pedro I shall try to call to you, my darling my
photos do not like you yes these are my photos, I do not know for what
you ask my address and why you doubt of me, I shall wait from you for
the letter. Your beloved Nadezhda.


Hi Nandezhda,
A good morning for you I received your letter and I were very cheerful.
Yes I like your pictures a lot you are a very beautiful woman!!
You in your pictures are very photogenic, you seem a model!
I only cost to believe me how it is that a girl such beautiful vein to my encounter!!
You are to see I didn't believe in Christmas!!!
You excuse that is only to play...
Yes you are a very beautiful WOMAN and you know albeit yes!!
I am very happy for knowing you, I hope we will be very good friends, if there is not anything in I contradict.
I wait for your phone call the 20.00 of Moscow.
I say good-bye with a very strong kiss for my LOVE!!
I WILL BE ALWAYS YOURS,
Pedro

My Pedro you didn't want to come to my birthday I had a lot of fun!!!
I was cheerful but I danced a lot...
PEDRO IS HERE THIS GAY TO LOOK A LOT FOR MY MY 'RABO'!! MY LOVE ME NO LONGER I AM TO LIKE ANYTHING OF THIS!!!
Reason that you didn't send your EUROS I could already be in Portugal!!!
Where is it THAT it is PORTUGAL? IS THAT IN AFRICA???




Keywords:
2007-07-30, 12:12:35
anonymous from Germany  
anon Netherlands, your german is very easy to read, just perfect, but every translating engine will become desperate of your spelling mistakes. No, I am not the one behind the windows and yes, she is glossy colubrid.
2007-07-30, 12:25:37   (updated: 2007-07-30, 12:31:12)
Eddie from Sweden  
this girls certainly gets around, Germany, the US, Puerto Rico?

funny how she seems to have a different mother in New York (column 4) than she does in Germany, or am I wrong there?
LOL

i'm also getting tired of her outfits, black dress, black top/grey slacks, black polkadot dress. YAWN
2007-07-30, 12:28:56
anonymous from Portugal  
Peter I was absent I didn't answer you to the that you asked.
You don't have difficulty in IPs... ?
2007-07-30, 13:10:39   (updated: 2007-07-30, 13:31:12)
Peter from Germany  
To Eddy: No, you are mixing things up. She was never in Germany - I would recall a german sign (But I see, you got along with D's german.). I once had this pic and I guess the blue sign is in english. Two pages before she was in India (?) and now maybe in the Caribean, that would fit to other pics with a tropical landscape... and everywhere she was only looking for one thing - a nice dutch cab driver (Sorry Pedro). Her victims are quite international too: Saudi-Arabia, Portugal, Germany, Netherlands.. But her mother is always the same.

To Pedro: Thank you for your attentiveness. No, I do not have problems with the IPs due to Drod's links and Eddy's explanations. To your longer posting: Yes, he is looking at her rabo, I would do to!
2007-07-30, 13:44:32
Eddie from Sweden  
OK Peter...but the guy is still checking out her booty, eller?
You are on page 12 of 39, other pages: 1 2 3 9 10 11 [12] 13 14 15 36 37 38 39

 

 

Are you being scammed and this is your first visit here?
Read the welcome page/ primer for newbies.
Thanks to Eddie for writing it up.

Please also read Miss Marple's article about recognizing male dating scammers.

NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.
 

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture:
Picture Search

You have received photos and wonder if these photos has been posted here before? Because you suspect this could be a dating scammer, but you do not want to post this picture? Try the Picture Search