DelphiFAQ Home Search:

Dating scammer Sveta

 

comments91 comments. Current rating: 5 stars (26 votes). Leave comments and/ or rate it.

Name: Sveta


Email: Svetakirov@rambler.ru; svetavirov2007@yahoo.com


Address:



Other Comments:


Content-type: text/html

Comments:

You are on page 2 of 7, other pages: 1 [2] 3 4 5 6 7
2007-10-10, 07:48:43
anonymous from United States  
So far I have not responded to previous letters and the letters continue coming.
Next time Boris is going to send a picture. I know that when she take the test she is going to pass it. They never say what is the name of the test, what organization is administering the test and if the test is in English or Russian.


Date : Wednesday , October 10, 2007

Letter#8

Sveta <Sun_loving_girl@yahoo.com>

Hi “ “!

It's Wednesday today and I have some free time. As I told you I will have the test tomorrow.
Yesterday I had preparing for it during all day till 11 p.m. and have tired very much after
it. So today I do not study and have some time for rest and 'freshen up' my brain (Smile).
Oh, how are you today? I hope that all is well with you and your relatives. I have my mom
visiting to me yesterday in evening. We have drink some tea and I have told to her about you,
“ “. She told me that it was not a surprise for her because she saw some different in my
mood and behaviour. She told that I have become more smiling and my eyes become shining since
I have started to correspond with you, “ “. It's her words! Imagine? It's a fact. Ok,
enough about it.
Just remember about the funny animation. Ice ages 2, and decide to tell with you about movies.
Do you like to watch movies? I like to it. For example, I like pseudo-historical movies: Troy,
King Arthur, Brave Heart, Kingdom Of Heaven; some fantastic movies: Artificial Intelligent,
Terminator 1-2; movies with suspense: Green Mile, Sixth Sense, Signs, Village; and of course
romantic movies: Sleepless in Seattle, City of Angels, Keith & Leo, Serendipity, A Walk to
Remember and others. What is your favorite actors and actresses? I like Al Pachino, Robert
De Niro, Russell Crow, Brad Pitt, Mel Gibson, Keanu Reaves, Johnny Depp, Charlize Theron,
Gwineth Peltrow, Sharon Stone. But Bruce Willis is my favorite. It seems to me that I told it
already. I think the American movies the best ones. Can you tell me about Hollywood? All that
you want to tell. I will glad to know something new about your country at all. Sometimes when
I watch the movie I have a wish that someone would sit close to me and hug me while we are
watching. I think it would be very nice time. I want to ask you some questions: do you like to hug?
Do you like to hold hands? To make woman smile? I like this things! Did I tell you that I am a
very romantic person! I don't like soap operas. We have a lot of it on TV, but I don't watch it
at all. I don't see any sense to waste my own time to watch this nonsense. What do you think
about soap operas? I want to let you know I like to watch intellectual, sport, different
entertainment programs on TV. When I was young I liked to watch cartoons 'Tom and Jerry' and
others. It was very funny. When I'd seen it I had much laughing and joy. A lot of children here
love this cartoons. What you can tell me about cartoons? What do kids like to watch more in your
country? I would like to know about it more. How often do you go to the cinema? I usually go to
the cinema one or two time per month. But sometimes I watch movies more often. Of course if movies
seem interesting for me. Ok, I have to do some things for my work. I hope that I will have a chance
to write you today in evening and send a picture.

Sveta
2007-10-11, 06:12:11
anonymous from United States  
Again I did not reply to the previous letter and she said she will have the test today , but she did not mentioned it at all. She said I am sorry I did not answer some of your questions. I did not asked anything.

Sveta Sun_loving_girl@yahoo.com

Thursday, October 11, 2007

Hi again, “ “!

I almost complete my work for today and write to you again before I will go home. I just
returned from outdoors about a 30 minutes ago. It's cold today. Just about +9 Celsius.
“ “, I want to ask you, what weather (season) do you like? I like summer and hot
weather! But I like snow winter too. You probably could see my clothes style on pictures
that I sent. But I would like to tell with you about it. Hope you don't mind (Smile)?
So, is it interesting for you to hear about clothes? I ask you because most of russian
mans like just to see on beauty and sexy dressed woman, but do not like to tell about it
and especially go to shops and stores with woman. Are american mans have such mind? Just a
curious... At the hot time of the year I like to wear short t-shirts, shorts if I am not at
work. To my work I wear soft jacket and pants or skirt at that season. In the winter I wear fur
coat cause it is quite cold, windy and snowy. I like when men wear classy jackets with tie,
good jeans and nice shirt. The main is that man looks like a man and have at least a little
style. I like jeans clothes too. Also I like to wear sexy stockings, short skirts and high heels
for my man. I have some lingerie and sexy underwear. Lately I have found Victoria Secret's web
site. Did you hear about this company? They make really nice and sexy lingerie. I would like to
buy some of it when I will be in America. So what clothes do you like the lady wear? It's interesting.
May be I'll buy some things before my trip and you could meet not just friend, but friend, dressed
as you like (Smile). Ok, will wait your thoughts about it.
Oh, “ “, also I want to ask you, do you like to read books? Do you read often? I like it very much!
It is very interesting to know new things and imagine yourself in another places or even worlds. As
far as I remember I read books all my life. Of course there always is a time when I don’t want to read
but it is just a short time periods (for a week or two). But after it I read another books with much
more interest! In my childhood I like to read about nature, animals and birds. Also about adventures
like Treasure Island by Stevenson, Robinson Crusoe by Defo, Mystery Island by Jule Vern. Then I had
read science fiction and fantasy like books by Harry Harrison Death World or Tolkien Lord Of The Rings.
I have read also detective stories like stories by Agatha Cristy of James Hadley Chase but not much of it.
Men usually suppose that women like to read love novels but It is not a rule. I read some of them
but the thing I like is just a French series of books about Angelica by Ann and Serg Golon. I like
it because of it describes old times Europe (17-18 centuries). Now I read books in many different
genres like alternative prose (Chuck Palahniuk), history novels (Zweig, Sabatini), horror (Steven
King), science fiction (Heinlein), fantasy (Sapkovski) and so on. Russian classics I read also but
not so often (Pushkin, Dostoyevskiy, Tolstoy). So do you have favorite book? What is your favorite
genre or genres may be? Oh, I think this letter will be long again. I am sorry if I will spend much
of you time when you will read this letter, but I have also about 5 minutes and want to ask you
last thing. I want you to tell me about cars a little. Did I tell you that I have a driver licence?
I am not very good driver, but I can do it. I get my licence about 1,5 years ago. As you can know, my
father dead 4 years ago. He had a car and in testament he gave this car to me. Car was stay
in garage about 2 years. Then I went to study for driver licence. I don't drive a lot. About 5-6
times in month. So I want to know, need I get new driver licence when I will go to america, or I
could use my one? I will try to get to know it in my agency, but may be you know about it? Also
could you tell me about types or models of cars which are popular or your country? Or may be you
have some peculiarity of you area which can affect on people's choice when they buy a car.
(I mean some peculiarity of relief or weather etc. For example we have very bad roads so if I would have
enough money for buying Ferrari, I will not buy it because this car just couldn't ride on our pits
(Smile). Also, “ “, what car do you have? May be you could show me a picture of? I have a russian car.
You probably don't know this type of cars, but I will try to find a picture tomorrow and send it that you
will have the idea about what car I drive. Oh, 5 minutes almost expire. I will go home to have some
rest before my test (Wow, I write my first poem in English! *rest-test* Ha ha! ).
“ “ I will wait your answer tomorrow!

Bye bye!

Your Sveta

P.S. I'm sorry that asked you so much questions and I understand that you may not have a time for
answer. So if you will not have a time, just little message will be enough. Also “ “ I'm sorry
if I didn't answer on some your questions. I hope you are not angry.
P.P.S. And my picture for you, “ “ as I promised you already. Hope that you like.

This image was also posted here:
Dating scammer Sveta



Keywords:
2007-10-12, 01:47:53
anonymous from United States  
I wrote this article to help you on how to determine if the person you are communicating with is in the country they said they are.
I see that the scammer use the BAT as the e-mail client to send their e-mail.

Here is some information about the BAT.
The Bat Description: X-Mailer: The Bat! (v3.80.06) This is their prefered e-mail client.
The Bat is an e-mail application that supports multiple POP3 accounts, multithreading, MIME and UUencode standards, multimedia, APOP authorization, and PGP. You also will find a fast and comfortable message editor with text highlighting, as well as a mail dispatcher for managing messages on servers. English, Russian, German, Dutch, Polish, Swedish, Italian, Lithuanian, and Romanian interfaces are built in, as is a multilingual spelling checker.

The application's other features include automatic dial-up networking (configurable for multiple accounts) and the option to include a photo with each address-book entry. There also are enhancements, such as message coloring, flagging, advanced filtering, speed improvements, and virus protection


The procedure to trace the e-mail to the sender is as follow :
e-mail ==> header ==> Public IP addres use by mail client==>identify Network or ISP
ISP==> Assign Public IP this IP is tide to the telephone # and finally to a user name & password to connect to the ISP ===> The ISP can identify who is the user.


How to trace an e-mail

Whenever you get online your computer is assigned a Public IP address by your ISP. IP address is the Internet Protocol (IP) address given to every computer connected to the Internet. An IP address is needed to route information much like a street address or PO box is needed to receive regular mail. email addresses are not IP addresses.

Each computer on the Internet has a unique numeric address similar to a phone number. This address is usually assigned to the user's Internet service provider, a university or a company. A database matches such assignments to the location the network has registered.
Every time anyone connects to the internet they are leaving their Public IP fingerprint and ISP domain name and other bits of information behind.



Here is the procedure to trace an e-mail using headers and the IP address of the network the scammer is using.

1. Locate the IP address from the e-mail the scammer sent you.

Different e-mails clienbts have different procedures.

This link will explain how to show the headers for the different e-mail clients.

http://www.fraudaid..htm#Gmail


Here is the e-mail I received with the header

Delivered-To: e-mail of recipient
Received: by 10.90.116.9 with SMTP id o9cs194683agc;
Wed, 10 Oct 2007 07:41:14 -0700 (PDT)
Received: by 10.70.11.1 with SMTP id 1mr1262696wxk.1192027266194;
Wed, 10 Oct 2007 07:41:06 -0700 (PDT)
Return-Path: <Sun_loving_girl@yahoo.com>
Received: from smtp118.plus.mail.mud.yahoo.com (smtp118.plus.mail.mud.yahoo.com [209.191.106.149])
by mx.google.com with SMTP id h39si2202328wxd.2007.10.10.07.41.05;
Wed, 10 Oct 2007 07:41:06 -0700 (PDT)

Received-SPF: pass (google.com: domain of Sun_loving_girl@yahoo.com designates 209.191.106.149 as permitted sender) client-ip=209.191.106.149;

DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of

Sun_loving_girl@yahoo.com designates 209.191.106.149 as permitted sender) smtp.mail=Sun_loving_girl@yahoo.com; domainkeys=pass (test mode) header.From=Sun_loving_girl@yahoo.com

Received: (qmail 85042 invoked from network); 10 Oct 2007 14:41:05 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com; h= Received:Date:From:To:X-Mailer:Message-ID:MIME-Version:Contontent-Type; b= StZevyutK2lDqx0cxRtP16uyKBIal0e2gCpWOLbCYo0H691iVaDonUADd3T3RSp3rmQWNK4riccG5w+ kRu91iz27Gj/yErvoO0KjuY2mLytCKE4d+89253W53W+M3ohEpWxs1dZMw+e2HZESfsNx2HkQ+6WFUlr2mDT/bsRq5KO5Ts= ;
Received: from unknown (HELO 127.0.0.1) (shydebdnd38@70.251.149.119 with plain)
by smtp118.plus.mail.mud.yahoo.com with SMTP; 10 Oct 2007 14:40:57 -0000
Date: Wed, 10 Oct 2007 17:59:58 +0400
From: Sveta <Sun_loving_girl@yahoo.com>
To: e-mail recipient < email recipient>
X-Mailer: The Bat! (v3.80.06)
Message-ID: <519041142.20071010175958@yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/mixedboundary= '--_-01C80B67-_-70F5D113-_-5EF8EFAE-_-'



----_--_-01C80B67-_-70F5D113-_-5EF8EFAE-_-
Content-Type: text/plain; charset='windows-1251'
Content-Transfer-Encoding: quoted-printable


2. The next step is to locate the Public IP of the e-mail client the scammer is using. Since the header has private IP address and Public IP address we need to know how to differentiate one from the other.

Private IP Addresses
Q. What are private IP addresses?
A. The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets (local networks):
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Also, IP addresses in the range of 169.254.0.0 -169.254.255.255 are reserved for Automatic Private IP Addressing.
127.0.0.1 Loop back .

Any IP that fall in the above group we do not pay attention.

Since an e-mail client use The SMTP (Simple mail transfer protocol ) to send e-mail. We look for anything that said SMTP and look before or after for the IP that is next to it.
in this case it says Cient IP : 209.191.106.149 This IP will be a public IP.

In this case Sveta that is supposed to be in Russia is not in Russia, her e-mail client is using the public IP address 209.191.106.149 that will give us the location from where the e-mail was sent. This IP address will reveal also the Network she is using or the ISP service provider.


Go to the geobytes link and enter IP address to locate : 209.191.106.149 this address will reveal that The location is in the USA, California, and the city is Wrightwood.
See attached map.

http://www.geobytes..tLocation
http://www.whatismy..ress.com/

Sometimes the location of the city is not correct, but the location of the Public IP address for the country is correct.

The service provider or ISP is the one asigning the Public IP address so you can connect to the Internet. If you have a DSL or Dial up connection your phone number is tide to Internet service and they can find out to what phone number a certain Public IP address was assigned on a certain date by the DHCP server, if you have been assigned a dynamic ip .


3. The next step is to find out which network or ISP this scammer is using and he/she can be identified by the Network administrator who assign the Public IP address.

This link tell you the different organization for the geographical regions for IP 's around the world.

http://www.apnic.ne..ex.html#2

Since the Public IP is registered to a Network or ISP and this is an IP for the USA, ARIN is the WHOIS database we need to search with the IP address of 209.191.106.149 .
Here we will find out where to report the abuse.

.

http://ws.arin.net/..1.106.149

OrgName: Yahoo!
OrgID: YAOO
Address: 701 First Ave
City: Sunnyvale
StateProv: CA
PostalCode: 94089
Country: US

NetRange: 209.191.64.0 - 209.191.127.255
CIDR: 209.191.64.0/18
NetName: A-YAHOO-US3
NetHandle: NET-209-191-64-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.YAHOO.COM
NameServer: NS2.YAHOO.COM
NameServer: NS3.YAHOO.COM
NameServer: NS4.YAHOO.COM
NameServer: NS5.YAHOO.COM
Comment:
RegDate: 2005-05-20
Updated: 2005-07-21

RAbuseHandle: NETWO857-ARIN
RAbuseName: Network Abuse
RAbusePhone: +1-408-349-3300
RAbuseEmail: network-abuse@cc.yahoo-inc.com

OrgAbuseHandle: NETWO857-ARIN
OrgAbuseName: Network Abuse
OrgAbusePhone: +1-408-349-3300
OrgAbuseEmail: network-abuse@cc.yahoo-inc.com

OrgTechHandle: NA258-ARIN
OrgTechName: Netblock Admin
OrgTechPhone: +1-408-349-3300
OrgTechEmail: netblockadmin@yahoo-inc.com

# ARIN WHOIS database, l



2007-10-12, 01:48:04
anonymous from United States  
I wrote this article to help you on how to determine if the person you are communicating with is in the country they said they are.
I see that the scammer use the BAT as the e-mail client to send their e-mail.

Here is some information about the BAT.
The Bat Description: X-Mailer: The Bat! (v3.80.06) This is their prefered e-mail client.
The Bat is an e-mail application that supports multiple POP3 accounts, multithreading, MIME and UUencode standards, multimedia, APOP authorization, and PGP. You also will find a fast and comfortable message editor with text highlighting, as well as a mail dispatcher for managing messages on servers. English, Russian, German, Dutch, Polish, Swedish, Italian, Lithuanian, and Romanian interfaces are built in, as is a multilingual spelling checker.

The application's other features include automatic dial-up networking (configurable for multiple accounts) and the option to include a photo with each address-book entry. There also are enhancements, such as message coloring, flagging, advanced filtering, speed improvements, and virus protection


The procedure to trace the e-mail to the sender is as follow :
e-mail ==> header ==> Public IP addres use by mail client==>identify Network or ISP
ISP==> Assign Public IP this IP is tide to the telephone # and finally to a user name & password to connect to the ISP ===> The ISP can identify who is the user.


How to trace an e-mail

Whenever you get online your computer is assigned a Public IP address by your ISP. IP address is the Internet Protocol (IP) address given to every computer connected to the Internet. An IP address is needed to route information much like a street address or PO box is needed to receive regular mail. email addresses are not IP addresses.

Each computer on the Internet has a unique numeric address similar to a phone number. This address is usually assigned to the user's Internet service provider, a university or a company. A database matches such assignments to the location the network has registered.
Every time anyone connects to the internet they are leaving their Public IP fingerprint and ISP domain name and other bits of information behind.



Here is the procedure to trace an e-mail using headers and the IP address of the network the scammer is using.

1. Locate the IP address from the e-mail the scammer sent you.

Different e-mails clienbts have different procedures.

This link will explain how to show the headers for the different e-mail clients.

http://www.fraudaid..htm#Gmail


Here is the e-mail I received with the header

Delivered-To: e-mail of recipient
Received: by 10.90.116.9 with SMTP id o9cs194683agc;
Wed, 10 Oct 2007 07:41:14 -0700 (PDT)
Received: by 10.70.11.1 with SMTP id 1mr1262696wxk.1192027266194;
Wed, 10 Oct 2007 07:41:06 -0700 (PDT)
Return-Path: <Sun_loving_girl@yahoo.com>
Received: from smtp118.plus.mail.mud.yahoo.com (smtp118.plus.mail.mud.yahoo.com [209.191.106.149])
by mx.google.com with SMTP id h39si2202328wxd.2007.10.10.07.41.05;
Wed, 10 Oct 2007 07:41:06 -0700 (PDT)

Received-SPF: pass (google.com: domain of Sun_loving_girl@yahoo.com designates 209.191.106.149 as permitted sender) client-ip=209.191.106.149;

DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of

Sun_loving_girl@yahoo.com designates 209.191.106.149 as permitted sender) smtp.mail=Sun_loving_girl@yahoo.com; domainkeys=pass (test mode) header.From=Sun_loving_girl@yahoo.com

Received: (qmail 85042 invoked from network); 10 Oct 2007 14:41:05 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com; h= Received:Date:From:To:X-Mailer:Message-ID:MIME-Version:Contontent-Type; b= StZevyutK2lDqx0cxRtP16uyKBIal0e2gCpWOLbCYo0H691iVaDonUADd3T3RSp3rmQWNK4riccG5w+ kRu91iz27Gj/yErvoO0KjuY2mLytCKE4d+89253W53W+M3ohEpWxs1dZMw+e2HZESfsNx2HkQ+6WFUlr2mDT/bsRq5KO5Ts= ;
Received: from unknown (HELO 127.0.0.1) (shydebdnd38@70.251.149.119 with plain)
by smtp118.plus.mail.mud.yahoo.com with SMTP; 10 Oct 2007 14:40:57 -0000
Date: Wed, 10 Oct 2007 17:59:58 +0400
From: Sveta <Sun_loving_girl@yahoo.com>
To: e-mail recipient < email recipient>
X-Mailer: The Bat! (v3.80.06)
Message-ID: <519041142.20071010175958@yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/mixedboundary= '--_-01C80B67-_-70F5D113-_-5EF8EFAE-_-'



----_--_-01C80B67-_-70F5D113-_-5EF8EFAE-_-
Content-Type: text/plain; charset='windows-1251'
Content-Transfer-Encoding: quoted-printable


2. The next step is to locate the Public IP of the e-mail client the scammer is using. Since the header has private IP address and Public IP address we need to know how to differentiate one from the other.

Private IP Addresses
Q. What are private IP addresses?
A. The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets (local networks):
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Also, IP addresses in the range of 169.254.0.0 -169.254.255.255 are reserved for Automatic Private IP Addressing.
127.0.0.1 Loop back .

Any IP that fall in the above group we do not pay attention.

Since an e-mail client use The SMTP (Simple mail transfer protocol ) to send e-mail. We look for anything that said SMTP and look before or after for the IP that is next to it.
in this case it says Cient IP : 209.191.106.149 This IP will be a public IP.

In this case Sveta that is supposed to be in Russia is not in Russia, her e-mail client is using the public IP address 209.191.106.149 that will give us the location from where the e-mail was sent. This IP address will reveal also the Network she is using or the ISP service provider.


Go to the geobytes link and enter IP address to locate : 209.191.106.149 this address will reveal that The location is in the USA, California, and the city is Wrightwood.
See attached map.

http://www.geobytes..tLocation
http://www.whatismy..ress.com/

Sometimes the location of the city is not correct, but the location of the Public IP address for the country is correct.

The service provider or ISP is the one asigning the Public IP address so you can connect to the Internet. If you have a DSL or Dial up connection your phone number is tide to Internet service and they can find out to what phone number a certain Public IP address was assigned on a certain date by the DHCP server, if you have been assigned a dynamic ip .


3. The next step is to find out which network or ISP this scammer is using and he/she can be identified by the Network administrator who assign the Public IP address.

This link tell you the different organization for the geographical regions for IP 's around the world.

http://www.apnic.ne..ex.html#2

Since the Public IP is registered to a Network or ISP and this is an IP for the USA, ARIN is the WHOIS database we need to search with the IP address of 209.191.106.149 .
Here we will find out where to report the abuse.

.

http://ws.arin.net/..1.106.149

OrgName: Yahoo!
OrgID: YAOO
Address: 701 First Ave
City: Sunnyvale
StateProv: CA
PostalCode: 94089
Country: US

NetRange: 209.191.64.0 - 209.191.127.255
CIDR: 209.191.64.0/18
NetName: A-YAHOO-US3
NetHandle: NET-209-191-64-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.YAHOO.COM
NameServer: NS2.YAHOO.COM
NameServer: NS3.YAHOO.COM
NameServer: NS4.YAHOO.COM
NameServer: NS5.YAHOO.COM
Comment:
RegDate: 2005-05-20
Updated: 2005-07-21

RAbuseHandle: NETWO857-ARIN
RAbuseName: Network Abuse
RAbusePhone: +1-408-349-3300
RAbuseEmail: network-abuse@cc.yahoo-inc.com

OrgAbuseHandle: NETWO857-ARIN
OrgAbuseName: Network Abuse
OrgAbusePhone: +1-408-349-3300
OrgAbuseEmail: network-abuse@cc.yahoo-inc.com

OrgTechHandle: NA258-ARIN
OrgTechName: Netblock Admin
OrgTechPhone: +1-408-349-3300
OrgTechEmail: netblockadmin@yahoo-inc.com

# ARIN WHOIS database, l




This image was also posted here:
Dating scammer Sveta



Keywords:
2007-10-12, 01:48:16
anonymous from United States  
I wrote this article to help you on how to determine if the person you are communicating with is in the country they said they are.
I see that the scammer use the BAT as the e-mail client to send their e-mail.

Here is some information about the BAT.
The Bat Description: X-Mailer: The Bat! (v3.80.06) This is their prefered e-mail client.
The Bat is an e-mail application that supports multiple POP3 accounts, multithreading, MIME and UUencode standards, multimedia, APOP authorization, and PGP. You also will find a fast and comfortable message editor with text highlighting, as well as a mail dispatcher for managing messages on servers. English, Russian, German, Dutch, Polish, Swedish, Italian, Lithuanian, and Romanian interfaces are built in, as is a multilingual spelling checker.

The application's other features include automatic dial-up networking (configurable for multiple accounts) and the option to include a photo with each address-book entry. There also are enhancements, such as message coloring, flagging, advanced filtering, speed improvements, and virus protection


The procedure to trace the e-mail to the sender is as follow :
e-mail ==> header ==> Public IP addres use by mail client==>identify Network or ISP
ISP==> Assign Public IP this IP is tide to the telephone # and finally to a user name & password to connect to the ISP ===> The ISP can identify who is the user.


How to trace an e-mail

Whenever you get online your computer is assigned a Public IP address by your ISP. IP address is the Internet Protocol (IP) address given to every computer connected to the Internet. An IP address is needed to route information much like a street address or PO box is needed to receive regular mail. email addresses are not IP addresses.

Each computer on the Internet has a unique numeric address similar to a phone number. This address is usually assigned to the user's Internet service provider, a university or a company. A database matches such assignments to the location the network has registered.
Every time anyone connects to the internet they are leaving their Public IP fingerprint and ISP domain name and other bits of information behind.



Here is the procedure to trace an e-mail using headers and the IP address of the network the scammer is using.

1. Locate the IP address from the e-mail the scammer sent you.

Different e-mails clienbts have different procedures.

This link will explain how to show the headers for the different e-mail clients.

http://www.fraudaid..htm#Gmail


Here is the e-mail I received with the header

Delivered-To: e-mail of recipient
Received: by 10.90.116.9 with SMTP id o9cs194683agc;
Wed, 10 Oct 2007 07:41:14 -0700 (PDT)
Received: by 10.70.11.1 with SMTP id 1mr1262696wxk.1192027266194;
Wed, 10 Oct 2007 07:41:06 -0700 (PDT)
Return-Path: <Sun_loving_girl@yahoo.com>
Received: from smtp118.plus.mail.mud.yahoo.com (smtp118.plus.mail.mud.yahoo.com [209.191.106.149])
by mx.google.com with SMTP id h39si2202328wxd.2007.10.10.07.41.05;
Wed, 10 Oct 2007 07:41:06 -0700 (PDT)

Received-SPF: pass (google.com: domain of Sun_loving_girl@yahoo.com designates 209.191.106.149 as permitted sender) client-ip=209.191.106.149;

DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of

Sun_loving_girl@yahoo.com designates 209.191.106.149 as permitted sender) smtp.mail=Sun_loving_girl@yahoo.com; domainkeys=pass (test mode) header.From=Sun_loving_girl@yahoo.com

Received: (qmail 85042 invoked from network); 10 Oct 2007 14:41:05 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com; h= Received:Date:From:To:X-Mailer:Message-ID:MIME-Version:Contontent-Type; b= StZevyutK2lDqx0cxRtP16uyKBIal0e2gCpWOLbCYo0H691iVaDonUADd3T3RSp3rmQWNK4riccG5w+ kRu91iz27Gj/yErvoO0KjuY2mLytCKE4d+89253W53W+M3ohEpWxs1dZMw+e2HZESfsNx2HkQ+6WFUlr2mDT/bsRq5KO5Ts= ;
Received: from unknown (HELO 127.0.0.1) (shydebdnd38@70.251.149.119 with plain)
by smtp118.plus.mail.mud.yahoo.com with SMTP; 10 Oct 2007 14:40:57 -0000
Date: Wed, 10 Oct 2007 17:59:58 +0400
From: Sveta <Sun_loving_girl@yahoo.com>
To: e-mail recipient < email recipient>
X-Mailer: The Bat! (v3.80.06)
Message-ID: <519041142.20071010175958@yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/mixedboundary= '--_-01C80B67-_-70F5D113-_-5EF8EFAE-_-'



----_--_-01C80B67-_-70F5D113-_-5EF8EFAE-_-
Content-Type: text/plain; charset='windows-1251'
Content-Transfer-Encoding: quoted-printable


2. The next step is to locate the Public IP of the e-mail client the scammer is using. Since the header has private IP address and Public IP address we need to know how to differentiate one from the other.

Private IP Addresses
Q. What are private IP addresses?
A. The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets (local networks):
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Also, IP addresses in the range of 169.254.0.0 -169.254.255.255 are reserved for Automatic Private IP Addressing.
127.0.0.1 Loop back .

Any IP that fall in the above group we do not pay attention.

Since an e-mail client use The SMTP (Simple mail transfer protocol ) to send e-mail. We look for anything that said SMTP and look before or after for the IP that is next to it.
in this case it says Cient IP : 209.191.106.149 This IP will be a public IP.

In this case Sveta that is supposed to be in Russia is not in Russia, her e-mail client is using the public IP address 209.191.106.149 that will give us the location from where the e-mail was sent. This IP address will reveal also the Network she is using or the ISP service provider.


Go to the geobytes link and enter IP address to locate : 209.191.106.149 this address will reveal that The location is in the USA, California, and the city is Wrightwood.
See attached map.

http://www.geobytes..tLocation
http://www.whatismy..ress.com/

Sometimes the location of the city is not correct, but the location of the Public IP address for the country is correct.

The service provider or ISP is the one asigning the Public IP address so you can connect to the Internet. If you have a DSL or Dial up connection your phone number is tide to Internet service and they can find out to what phone number a certain Public IP address was assigned on a certain date by the DHCP server, if you have been assigned a dynamic ip .


3. The next step is to find out which network or ISP this scammer is using and he/she can be identified by the Network administrator who assign the Public IP address.

This link tell you the different organization for the geographical regions for IP 's around the world.

http://www.apnic.ne..ex.html#2

Since the Public IP is registered to a Network or ISP and this is an IP for the USA, ARIN is the WHOIS database we need to search with the IP address of 209.191.106.149 .
Here we will find out where to report the abuse.

.

http://ws.arin.net/..1.106.149

OrgName: Yahoo!
OrgID: YAOO
Address: 701 First Ave
City: Sunnyvale
StateProv: CA
PostalCode: 94089
Country: US

NetRange: 209.191.64.0 - 209.191.127.255
CIDR: 209.191.64.0/18
NetName: A-YAHOO-US3
NetHandle: NET-209-191-64-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.YAHOO.COM
NameServer: NS2.YAHOO.COM
NameServer: NS3.YAHOO.COM
NameServer: NS4.YAHOO.COM
NameServer: NS5.YAHOO.COM
Comment:
RegDate: 2005-05-20
Updated: 2005-07-21

RAbuseHandle: NETWO857-ARIN
RAbuseName: Network Abuse
RAbusePhone: +1-408-349-3300
RAbuseEmail: network-abuse@cc.yahoo-inc.com

OrgAbuseHandle: NETWO857-ARIN
OrgAbuseName: Network Abuse
OrgAbusePhone: +1-408-349-3300
OrgAbuseEmail: network-abuse@cc.yahoo-inc.com

OrgTechHandle: NA258-ARIN
OrgTechName: Netblock Admin
OrgTechPhone: +1-408-349-3300
OrgTechEmail: netblockadmin@yahoo-inc.com

# ARIN WHOIS database, l




This image was also posted here:
Dating scammer Sveta



Keywords:
2007-10-12, 02:09:57
anonymous from United States  
Here is the Map.


Keywords:
2007-10-12, 09:21:41
anonymous from United States  
I wrote this article to help you on how to determine if the person you are communicating with is in the country they said they are.
I see that the scammer use the BAT as the e-mail client to send their e-mail.

Here is some information about the BAT.
The Bat Description: X-Mailer: The Bat! (v3.80.06) This is their prefered e-mail client.
The Bat is an e-mail application that supports multiple POP3 accounts, multithreading, MIME and UUencode standards, multimedia, APOP authorization, and PGP. You also will find a fast and comfortable message editor with text highlighting, as well as a mail dispatcher for managing messages on servers. English, Russian, German, Dutch, Polish, Swedish, Italian, Lithuanian, and Romanian interfaces are built in, as is a multilingual spelling checker.

The application's other features include automatic dial-up networking (configurable for multiple accounts) and the option to include a photo with each address-book entry. There also are enhancements, such as message coloring, flagging, advanced filtering, speed improvements, and virus protection


The procedure to trace the e-mail to the sender is as follow :
e-mail ==> header ==> Public IP addres use by mail client==>identify Network or ISP
ISP==> Assigned Public IP this IP is tide to the telephone # and finally to a user name & password to connect to the ISP ===> The ISP can identify who is the user.


How to trace an e-mail

Whenever you get online your computer is assigned a Public IP address by your ISP. IP address is the Internet Protocol (IP) address given to every computer connected to the Internet. An IP address is needed to route information much like a street address or PO box is needed to receive regular mail. email addresses are not IP addresses.

Each computer on the Internet has a unique numeric address similar to a phone number. This address is usually assigned to the user's Internet service provider, a university or a company. A database matches such assignments to the location the network has registered.
Every time anyone connects to the internet they are leaving their Public IP fingerprint and ISP domain name and other bits of information behind.



Here is the procedure to trace an e-mail using headers and the Public IP address of the network the scammer is using.

1. Locate the Public IP address from the e-mail the scammer sent you.

Different e-mails clienbts have different procedures.

This link will explain how to show the headers for the different e-mail clients.

http://www.fraudaid...htm#Gmail


Here is the e-mail I received with the header

Delivered-To: e-mail of recipient
Received: by 10.90.116.9 with SMTP id o9cs194683agc;
Wed, 10 Oct 2007 07:41:14 -0700 (PDT)
Received: by 10.70.11.1 with SMTP id 1mr1262696wxk.1192027266194;
Wed, 10 Oct 2007 07:41:06 -0700 (PDT)
Return-Path: <Sun_loving_girl@yahoo.com>
Received: from smtp118.plus.mail.mud.yahoo.com (smtp118.plus.mail.mud.yahoo.com [209.191.106.149])
by mx.google.com with SMTP id h39si2202328wxd.2007.10.10.07.41.05;
Wed, 10 Oct 2007 07:41:06 -0700 (PDT)

Received-SPF: pass (google.com: domain of Sun_loving_girl@yahoo.com designates 209.191.106.149 as permitted sender) client-ip=209.191.106.149;

DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of

Sun_loving_girl@yahoo.com designates 209.191.106.149 as permitted sender) smtp.mail=Sun_loving_girl@yahoo.com; domainkeys=pass (test mode) header.From=Sun_loving_girl@yahoo.com

Received: (qmail 85042 invoked from network); 10 Oct 2007 14:41:05 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com; Received: Date:From:To:X-Mailer:Message-ID:MIME-Version:Contontontent-Type; bStZevyutK2lDqx0cxRtP16uyKBIal0 2gCpWOLbCYo0H691iVaDonUADd3T3RT3RSp3rmQWNK4riccG5kRu91iz27Gj/ yErvoO0KjuY2mLytCKE4d+89253W53W+M3ohEpWxs1dZMw+e2+e2HZESfsNx2HkQ+6WFUlr2mDT/bsRq5KO5Ts= ;
Received: from unknown (HELO 127.0.0.1) (shydebdnd38@70.251.149.119 with plain)
by smtp118.plus.mail.mud.yahoo.com with SMTP; 10 Oct 2007 14:40:57 -0000
Date: Wed, 10 Oct 2007 17:59:58 +0400
From: Sveta <Sun_loving_girl@yahoo.com>
To: e-mail recipient < email recipient>
X-Mailer: The Bat! (v3.80.06)
Message-ID: <519041142.20071010175958@yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/mixedboundary= '--_-01C80B67-_-70F5D113-_-5EF8EFAE-_-'



----_--_-01C80B67-_-70F5D113-_-5EF8EFAE-_-
Content-Type: text/plain; charset='windows-1251'
Content-Transfer-Encoding: quoted-printable


2. The next step is to locate the Public IP of the e-mail client the scammer is using. Since the header has private IP address and Public IP address we need to know how to differentiate one from the other.

Private IP Addresses
Q. What are private IP addresses?
A. The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets (local networks):
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Also, IP addresses in the range of 169.254.0.0 -169.254.255.255 are reserved for Automatic Private IP Addressing.
127.0.0.1 Loop back .

Any IP that fall in the above group we do not pay attention.

Since an e-mail client use The SMTP (Simple mail transfer protocol ) to send e-mail. We look for anything that said SMTP and look before or after for the IP that is next to it.
in this case it says Cient IP : 209.191.106.149 This IP will be a public IP.

In this case Sveta that is supposed to be in Russia is not in Russia, her e-mail client is using the public IP address 209.191.106.149 that will give us the location from where the e-mail was sent. This IP address will reveal also the Network she is using or the ISP service provider.


Go to the geobytes link and enter IP address to locate : 209.191.106.149 this address will reveal that The location is in the USA, California, and the city is Wrightwood.
See attached map.

http://www.geobytes...tLocation
http://www.whatismy...ress.com/

Sometimes the location of the city is not correct, but the location of the Public IP address for the country is correct.

The service provider or ISP is the one asigning the Public IP address so you can connect to the Internet. If you have a DSL or Dial up connection your phone number is tide to Internet service and they can find out to what phone number a certain Public IP address was assigned on a certain date by the DHCP server, if you have been assigned a dynamic ip .


3. The next step is to find out which network or ISP this scammer is using and he/she can be identified by the Network administrator who assign the Public IP address.

This link tell you the different organization for the geographical regions for IP 's around the world.

http://www.apnic.ne...ex.html#2

Since the Public IP is registered to a Network or ISP and this is an IP for the USA, ARIN is the WHOIS database we need to search with the IP address of 209.191.106.149 .
Here we will find out where to report the abuse.

.

http://ws.arin.net/...1.106.149

OrgName: Yahoo!
OrgID: YAOO
Address: 701 First Ave
City: Sunnyvale
StateProv: CA
PostalCode: 94089
Country: US

NetRange: 209.191.64.0 - 209.191.127.255
CIDR: 209.191.64.0/18
NetName: A-YAHOO-US3
NetHandle: NET-209-191-64-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.YAHOO.COM
NameServer: NS2.YAHOO.COM
NameServer: NS3.YAHOO.COM
NameServer: NS4.YAHOO.COM
NameServer: NS5.YAHOO.COM
Comment:
RegDate: 2005-05-20
Updated: 2005-07-21

RAbuseHandle: NETWO857-ARIN
RAbuseName: Network Abuse
RAbusePhone: +1-408-349-3300
RAbuseEmail: network-abuse@cc.yahoo-inc.com

OrgAbuseHandle: NETWO857-ARIN
OrgAbuseName: Network Abuse
OrgAbusePhone: +1-408-349-3300
OrgAbuseEmail: network-abuse@cc.yahoo-inc.com

OrgTechHandle: NA258-ARIN
OrgTechName: Netblock Admin
OrgTechPhone: +1-408-349-3300
OrgTechEmail: netblockadmin@yahoo-inc.com

# ARIN WHOIS database, l

This image was also posted here:
Is this Russian girl scamming me? How to recognize scammers



Keywords:
2007-10-12, 14:12:48
Eddie from Sweden  
anonymous from United States

thanks for the useful info! ....seems you had trouble posting it?
2007-10-31, 16:35:29
anonymous from United States  
The one at the top has been emailing me and here is her new addy:
Sveta.Sunny_Girl@yahoo.com.

2007-11-04, 19:56:45
anonymous  
rating
WARNING www.PerfSpot.com is running a scam! I reported Sveta about 2 months (or more?) now. Her account is still active. So are accounts of other prooven scammers that I have also brought to their attention! At firts they seem to care and were quite diligent in removing suspicious users. NOT ANYMORE!! BEWARE!!
2007-11-05, 17:10:29
anonymous from United States  
I am seeing how far she takes it check this out: Her new email is Sveta.Sunny_Girl@yahoo.com
Up to now and about 12 emails she had never asked for money. Just generic emails with nice pics. Noname, just in case you do not know is just me editing my real name. She is pretty, from pics, whoever she is. It is too bad she's a fake. The last email she asked me for any advice, I through in there make sure you have enough money for plane ticket to my city. Then I got this letter.

Hello my dear Noname

How are you? How is the weather there? I hope you feeling good. I have
some not good news
for us. Oh, I don't know where to start. Today I drove my car to move
to my agency. I needed
to pay last part of my bills to agency. When I came to the agency and
paid them, I got all
documents and ticket in my hands. I was very glad and happy! I wanted
to come back to my home
soon and to let you know about these good news! When I drove car to my
home I got accident!
The boy ran out to the street in front of my car!!!! It was so
unexpected for me, I could react
but all I could do is turn my car to the left side! Because at the
right side was parked big truck
and I couldn't stop without blow to boy at this short distance. The boy
ran out behind of that
truck and I couldn't see him in time. Because of it I turned to the
left and I struck other car!!!
It's bad news. But more bad things are the car I struck was foreign
expensive car and I would
have to pay to fix all damages! The man from that car called road
police and they made up protocol
of accident. The boy ran away and we couldn't find him! So all fault
was mine. But I hope you can
understand that this fault of that boy. But I couldn't prove it because
boy was absent. When the
expert commission said me about sum of money I have to pay I was
shocked and cried a lot!!! I didn't
have this kind of resources! The damages of the foreign car were big
and my car suffered strongly too!
Don't worry I am ok and my health is good. I got only couple of
scratches and bruises. The police took
my car and placed it to the pay auto parking. My car can't move now and
I used bus to come to my home.
The police gave me copy of protocol and other papers and bill to pay
for accident. They said that
I have to pay it in short time and all I thought up is move back to the
agency and ask them about
getting money back. I told them about my situation and after two hours
of talks they gave me money
back. They took back all documents and ticket. So now I have no it in
my pocket and all documents
in agency again! But they said that I have to pay them back during 14
days else they will cancel my
request for getting work in your country!!!!! So they will delete my
documents and will cancel reserved
ticket! Agency said that they can't hold my documents and ticket long
time. So if I want to get documents
and ticket and to come to you I must pay them completely during 14 work
days. Else I will lose all I have!!!
All my dreams will be broken! I will not be able to get new job I can't
start new life in your country but
more important I will not be able to meet you and to be with you
Noname!!! This is terrible situation
for me and I am in depression now because even that I got money from
agency it was not be enough
to pay for accident completely!!! So I spent all money that I saved
some years. I wanted to bring some of
this money to my trip and much part give to my mom, but I spent it all.
When I came home I asked my
friends about help that I could pay for my papers and tickets again.
They were shocked and commiserated
to me. We could find some money but I still have to find some funds to
pay for my documents and tickets
that I could go to America! It's not very much of money but I don't
know where to get it! My friends did
all they could and I can't ask them about help again because they will
not be able to help. They would
like to help more but they can't! They said that I can give debts back
as soon as it will be possible for
me. I thanked them. I don't know what I would do if I would not have
friends! I will try to figure out what
I can do and will tell you about my results. It's very important for me
to pay to the agency! If I will not
do it I will lose all documents and will not come to you! This fact
oppress me and put me in depression.
I don't know what to do and what to think up! I can't believe that it
was happen with me! Why Noname?
Noname I want to ask you maybe you can suggest me what to do? Honey
do you have any idea how to overcome
this situation? Do you still want to meet me my dear and will support
me morally before I will be here?
Will you continue to write me?? Are you angry for me because of this
occasion and because of that we can't
meet each other??? I hope you did not change your mind on me and still
want to meet me. It was not my fault
but I can't prove it! I just don't know when we can meet each other at
all if I will not find necessary sum
of money during 14 days (till 22 November). Because I will lost
documents and to get new will take about
6-8 months and agency said that perhaps I will not get it again at all
because at the first time I didn't
use it!!! There are many people who want get documents and government
will work with them and not with
person who will refuse from documents some times. I hope you can
understand what I wanted to say. I will
try to get loan from bank tomorrow, but I think that it will not be
success. I know that they will not
give money to person who will left country. Also I will try to sell my
broken car but It will not be easy
because we don't have a lot of men who want buy broken car. I don't
know when I can do it and I think It
will cost very cheap! Also my car was old and this is other reason why
I will not sell it quickly. At least
I think so. But firstly I will need to take my car from parking and to
deliver it to my garage. I think
I will have to use special truck which will transport it. But It's
extra expenses!!! Right now I can't find
any way where to find money. Please write me back as soon as you can
and let me know your point of view.
It's important for me to hear your thoughts. Remember I love you and
want to be with you, Noname but I am
in difficult situation, I don't know what to do. I need to find money
to pay to agency during 14 work days
else I may forget about new job and coming to your country and about
our meeting!!!! I hope for your quick
response and for your words which will support me and will turn me back
from depression to normal condition.
I will wait for your next e-mail with great impatience. Remember honey
I think of you and never forget.
I love you Noname!
Your loving Sveta.



P.S. Please forgive me if I made a lot of mistakes. I just was nervous
and upset. I hope you understand.

***Ya' see she loves me, ahh he, I mean she broke my heart***
2007-11-06, 09:57:02
[hidden] from Atlanta, United States  
I must to say that this spam sveta have another mail : Sveta.Sunny_Girl@yahoo.com , please be alert, she now try to stole money saying that had and accident.....funny right?
2007-11-06, 15:07:58
OJAS from United States  
If you're a newcomer who found this thread via Google or whatever, PLEASE READ THIS: http://www.delphifa..p=10#59557

@allbies, once in a while check these links for information currency [Link Version 2007-11-06, 12:16:02]
2007-11-06, 15:59:11
anonymous from United States  
rating
You're right, she is hot, whoever she is.

I just spent the last month talking to 'her' everyday.

She just changed her email today and my last message just returned undeliverable.

Watch out for these emails:

Sveta.Sunny_Girl@yahoo.com
sun_loving_girl@yahoo.com
Svetakirov@rambler.ru
svetavirov2007@yahoo.com
This image was also posted here:
Dating scammer Sveta



Keywords:
2007-11-07, 09:53:46
jhaland@yahoo.com from United States  
rating
Carefull, the scam sveta change of mail, now is Solonkina.Sveta@gmail.com them please take carefull, she saying that is searching for money between her friends for come USA, is funny right...
You are on page 2 of 7, other pages: 1 [2] 3 4 5 6 7

 

 

Are you being scammed and this is your first visit here?
Read the welcome page/ primer for newbies.
Thanks to Eddie for writing it up.

Please also read Miss Marple's article about recognizing male dating scammers.

NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.
 

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture:
Picture Search

You have received photos and wonder if these photos has been posted here before? Because you suspect this could be a dating scammer, but you do not want to post this picture? Try the Picture Search