DelphiFAQ Home Search:

Dating scammer Mariya

 

commentsThis article has not been rated yet. After reading, feel free to leave comments and rate it.

Name: Mariya


Email: sweetrosemariya@gmail.com


Address:
none yet, still baiting this scammer


Other Comments:
IP address: 91.144.161.154 traces to Moscow


Comments:

2008-06-07, 15:57:07   (updated: )
[hidden] from Canada  



Keywords:
2008-06-07, 15:57:07   (updated: )
[hidden] from Canada  



Keywords:
2008-06-07, 15:57:07   (updated: )
[hidden] from Canada  



Keywords:
2008-06-07, 15:57:07   (updated: )
[hidden] from Canada  



Keywords:
2008-06-07, 15:57:07   (updated: )
[hidden] from Canada  



Keywords:
2008-06-07, 15:57:07   (updated: )
[hidden] from Canada  



Keywords:
2008-06-07, 18:34:41
Dirk from Heerlen, Netherlands  
Hidden from Canada,

IP 91.144.161.154 doesn't trace to Moscow:

IP address: 91.144.161.154
Reverse DNS: net161.144.91-154.yoladom.ru.
Reverse DNS authenticity: [Could be forged: hostname net161.144.91-154.yoladom.ru. does not exist]
ASN: 0
ASN Name: IANA-RSVD-0
IP range connectivity: 0
Registrar (per ASN): Unknown
Country (per IP registrar): RU [Russian Federation]
Country Currency: RUR [Russia Rubles]
Country IP Range: 91.144.128.0 to 91.144.191.255
Country fraud profile: High
City (per outside source): Yoshkar-Ola, Mariy-El
Country (per outside source): RU [Russian Federation]
Private (internal) IP? No
IP address registrar: whois.ripe.net
Known Proxy? No
Link for WHOIS: 91.144.161.154

http://private.dnss..4.161.154

2008-06-07, 18:39:10
Dirk from Heerlen, Netherlands  
Here you find more info on the range of IP's beginning with 91.144.161....

http://www.delphifa..shtml?p=7

IP 91.144.161.154 was used in other scams:

http://www.romances..hp?t=7331

http://www.romances..76f8619e6

2008-06-08, 10:51:33
anonymous from Canada  
Dirk - thanks for the feedback.

I'm not sure I agree with your conclusions. That DNSStuff site seems to give different results than http://www.geobytes..etLocation and SpamCop.net depending on the IP address.

For example, I have a new scam going on now (will post more when I get a name), coming from IP 78.138.0.123

When I look it up on DNSStuff, it says it's in UK.

When I look it up on SpamCop, it gives me a Sky-vision.net ISP address for abuse (that ISP appears to be Nigerian).

When I look it up on Geobytes it also gives me Nigeria.

I'm not sure any of these lookups are that reliable.
2008-06-08, 14:17:40
OJAS from United States  
2008-06-08, 15:24:51   (updated: 2008-06-08, 16:12:07)
Dirk from Heerlen, Netherlands  
Anon from Canada,

I rely on DNS. It combines every search-engine on IP's. Please, correct me if I'm wrong. No problem at all. The Problem is, that all the IP's are forged. Even the Yoshkar-Ola ones. (BTW The only real Mari-El IP's begin with 77.40....)

I did a DNS-trace on IP 78.138.0.123. Here are the results (back and forth, the complete analysis):

First the normal IP-trace:

IP address: 78.138.0.123
Reverse DNS: [No reverse DNS entry per ns1.sky-vision.net.]
Reverse DNS authenticity: [Unknown]
ASN: 0
ASN Name: IANA-RSVD-0
IP range connectivity: 0
Registrar (per ASN): Unknown
Country (per IP registrar): GB [United Kingdom]
Country Currency: GBP [United Kingdom Pounds]
Country IP Range: 78.138.0.0 to 78.138.63.255
Country fraud profile: Normal
City (per outside source): Unknown
Country (per outside source): UK [United Kingdom]
Private (internal) IP? No
IP address registrar: whois.arin.net
Known Proxy? No

http://private.dnss..138.0.123

Second: the route of this IP:

IP address: 78.138.0.123
Reverse DNS: [No reverse DNS entry per ns1.sky-vision.net.]
Reverse DNS authenticity: [Unknown]
ASN: 0
ASN Name: IANA-RSVD-0
IP range connectivity: 0
Registrar (per ASN): Unknown
Country (per IP registrar): GB [United Kingdom]
Country Currency: GBP [United Kingdom Pounds]
Country IP Range: 78.138.0.0 to 78.138.63.255
Country fraud profile: Normal
City (per outside source): Unknown
Country (per outside source): UK [United Kingdom]
Private (internal) IP? No
IP address registrar: whois.arin.net
Known Proxy? No

http://private.dnss..138.0.123

And third... The Ripe Wois (Ripe is reliable):

Location: United Kingdom [City: ]

[Caching always on for search engines and InfoPath]
ARIN says that this IP belongs to RIPE; I'm looking it up there.

% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net..ight.html

% Information related to '78.138.0.0 - 78.138.63.255'

inetnum: 78.138.0.0 - 78.138.63.255
org: ORG-SGN1-RIPE
netname: UK-SKYVISION-20070607
descr: SkyVision Holdings Ltd.
country: GB
admin-c: SVAC-RIPE
tech-c: SVNC-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: SV-MNT
mnt-routes: SV-MNT
notify: ***@sky-vision.net
changed: **********@ripe.net 20070607
changed: **********@ripe.net 20070720
source: RIPE

organisation: ORG-SGN1-RIPE
org-name: SkyVision Holdings Ltd.
org-type: LIR
address: SkyVision Holdings Ltd.
Kinetic Business Centre
Theobald Street
WD6 4PJ Borehamwood
UNITED KINGDOM
phone: +44 20 8387 1750
fax-no: +44 20 8387 4004
e-mail: ***@sky-vision.net
admin-c: DR1870-RIPE
admin-c: SVAC-RIPE
admin-c: SVNC-RIPE
admin-c: SB106-RIPE
admin-c: YURI
admin-c: JP4406-RIPE
mnt-ref: SV-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: **********@ripe.net 20040415
changed: *********@ripe.net 20040428
changed: *********@ripe.net 20041229
changed: *********@ripe.net 20050307
changed: *********@ripe.net 20050310
changed: *********@ripe.net 20050315
changed: *********@ripe.net 20050315
changed: *********@ripe.net 20050401
changed: *********@ripe.net 20050412
changed: *********@ripe.net 20050602
changed: *********@ripe.net 20050714
changed: *********@ripe.net 20051114
changed: *********@ripe.net 20060305
changed: *********@ripe.net 20060305
changed: *********@ripe.net 20060305
changed: *********@ripe.net 20060316
changed: *********@ripe.net 20060606
changed: *********@ripe.net 20061206
changed: *********@ripe.net 20070121
changed: *********@ripe.net 20070121
changed: *********@ripe.net 20070130
changed: *********@ripe.net 20070320
changed: *********@ripe.net 20070322
changed: *********@ripe.net 20070322
changed: *********@ripe.net 20070404
changed: *********@ripe.net 20070502
changed: *********@ripe.net 20070516
changed: *********@ripe.net 20070516
changed: *********@ripe.net 20070720
changed: *********@ripe.net 20070720
changed: *********@ripe.net 20070720
changed: *********@ripe.net 20070813
changed: *********@ripe.net 20080213
changed: *********@ripe.net 20080213
changed: *********@ripe.net 20080312
changed: *********@ripe.net 20080326
changed: *********@ripe.net 20080326
changed: *********@ripe.net 20080326
changed: *********@ripe.net 20080327
changed: *********@ripe.net 20080401
changed: *********@ripe.net 20080506
changed: *********@ripe.net 20080506
source: RIPE

role: SkyVision Network Coordination Center
org:     ORG-SGN1-RIPE
address: SkyVision Global Networks
address: Kinetic Business Centre
address: Theobald Street
address: Borehamwood
address: Hertfordshire WD6 4PJ
address: United Kingdom
phone: +44 20 8387 1750
fax-no: +44 20 8387 4004
e-mail: ***@sky-vision.net
admin-c: SVAC-RIPE
tech-c: SVTC-RIPE
nic-hdl: SVNC-RIPE
mnt-by: SV-MNT
notify: ***@sky-vision.net
changed: ***@sky-vision.net 20011220
source: RIPE

person: SkyVision Administrative Contact
address: SkyVision Global Networks
address: Kinetic Business Centre
address: Theobald Street
address: Borehamwood
address: Hertfordshire WD6 4PJ
address: United Kingdom
org:     ORG-SGN1-RIPE
phone: +44 20 8387 1750
fax-no: +44 20 8387 4004
e-mail: *******@sky-vision.net
nic-hdl: SVAC-RIPE
mnt-by: SV-MNT
notify: ***@sky-vision.net
changed: ***@sky-vision.net 20011220
source: RIPE


Hidden from Canada,

You can make me believe anything. I am a believer. If your girl-friend is in Russia (or whereever) the computer is there too. Hope we agree on that. You're girlfriend is in England? If not: She has long arms. Cheerio!

About the IP-range 91.144.161 (...). We have proof that there are 40 computers in 1 room. The IP traces to Yoshkar-Ola (Mari-El Republic), but those IP's are all FORGED. I am dealing with them. And I am certain that these IP's (the computers) are NOT in Russia. Please, correct me if I'm wrong. Prove the opposite!

http://www.delphifa..shtml?p=7

Wish you all a good hunt...

P.S. Your tracer says: Nigeria? 99% HIT. Or...???



2008-06-09, 16:47:51
anonymous from Canada  
Hi again Dirk,

My girlfriend? That was a joke, right ;-)

I wasn't trying to convince you of anything, just saying that the results seem to vary. Just because an IP is registered in an office in UK doesn't place the machine there. Like I said, the sky-vision.net web site seems to show it as a Nigerian-based company. Anyway, it doesn't really matter - this site logs the photos and the IPs so that when others search for them, they correlate with other reported scams.

By the way, the photo search is a BRILLIANT idea!

Attaching the latest photo of 'my girlfriend' Mariya Angel


Keywords:

 

 

Are you being scammed and this is your first visit here?
Read the welcome page/ primer for newbies.
Thanks to Eddie for writing it up.

Please also read Miss Marple's article about recognizing male dating scammers.

NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.
 

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture:
Picture Search

You have received photos and wonder if these photos has been posted here before? Because you suspect this could be a dating scammer, but you do not want to post this picture? Try the Picture Search