DelphiFAQ Home Search:

Dating scammer Masha


comments88 comments. Current rating: 4 stars (15 votes). Leave comments and/ or rate it.

Name: Masha



Other Comments:


You are on page 3 of 6, other pages: 1 2 [3] 4 5 6
2008-07-17, 09:01:56 from Norway  
A couple of more letter and pics from 'Masha'

2008-07-17, 10:32:25   (updated: 2008-07-17, 10:45:03)
Dirk from Heerlen, Netherlands  
2008-07-17, 14:51:45   (updated: 2008-07-17, 15:02:02)
OJAS from United States  
A picture for your translation scammer. (I just scammed Dirk, lol!). It says

Hello vile, greedy retard,
Do not insult my intelligence. My species can write every language far better than you, scammer. We are much prettier than you, and we make an honest living. Your face is unworthy of my flatulence! Fuck you!

2008-07-18, 04:03:54 from Norway  
What do you mean with delete my info before posting it?
Thanks for all your help, Tormod
2008-07-18, 07:23:03
OJAS from United States  
The most useful fields are
1) Sender IP, (I posted earlier, how to extract it)
2) X-Mailer (It could be Bat!, or whatever e-mail program the sender used)

You can ignore rest of the header. People usually at least delete their own personal information, like name, e-mail address etc.

It is good to have all the different IPs, and e-mail programs they used.

Feel free to e-mail Fjellhare, he can explain to you.

Guys like Dirk display their own information, because, they KNOW exactly what they are doing. I won't post my personal info on public domains, but through e-mail exchanges Dirk and many others know my true identity, when I sign as OJAS

2008-07-18, 11:08:00 from Norway  
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2w9MDthPTA=

X-Message-Status: n:0

X-SID-PRA: Masha <>

X-Message-InfR00BdL5giqqP2IYfLOgMG0fperLkw9jw6kSYb4HMl7mwH5hEtLi7PPAq2Us/ Ds/DUHxVbuKeTi7dRXeRORXhTcL31ksUpkg+utg

Received: from ([]) by with Microsoft SMTPSVC(6.0.3790.2668);

    Thu, 3 Jul 2008 07:43:23 -0700

Received: from compute2.internal (compute2.internal [])

    by (Postfix) with ESMTP id 3366E132AF7

    for <>; Thu, 3 Jul 2008 10:43:23 -0400 (EDT)

Received: from ([])

by compute2.internal (MEProxy); Thu, 03 Jul 2008 10:43:23 -0400

X-Sasl-enc: mgiT9tyhr7UhHYWAOusZPPwuycsC1sGapw264rMK9BTe 1215096199

Received: from ( [])

    by (Postfix) with ESMTPA id B6A36114BE

    for <>; Thu, 3 Jul 2008 10:43:19 -0400 (EDT)

X-Mailer: QUALCOMM Windows Eudora Version

Date: Thu, 03 Jul 2008 16:22:30 +0300


From: Masha <>

Subject: I will miss your letters

Mime-Version: 1.0

Content-Type: multipart/mixed;


Message-Id: <>


X-OriginalArrivalTime: 03 Jul 2008 14:43:24.0094 (UTFILETIME= [255FA5E0:01C8DD1B]

2008-07-18, 11:47:39   (updated: 2008-07-18, 11:56:49)
OJAS from United States  
Pasting the whole header http://www.ip2locat..acer.aspx
Extracts sender IP in Ukraine, (Mail Server) (Relay Server in USA)

IP trace links http://www.delphifa..p=0#93930

Continue with the sender IP
Malicious http://www.trusteds..y/
No useful information is returned from
Delphi search this IP hits banned / blacklisted by web masters http://www.delphifa..p=2#82669
output from

Result for

--> /usr/local/bin/fwhois

OrgName: DoD Network Information Center
Address: 3990 E. Broad Street
City: Columbus
StateProv: OH
PostalCode: 43218
Country: US

NetRange: -
NetHandle: NET-7-0-0-0-1
NetType: Direct Allocation
RegDate: 1997-11-24
Updated: 2006-04-28

OrgTechName: Network DoD
OrgTechPhone: +1-800-365-3642

# ARIN WHOIS database, last updated 2008-07-17 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database

The sender used Department of defefense military computer in Ohio for personal purposes; Sender's mail server is in Ukraine ... ''Perfect Gentleman'' ...

Tormod, you can complain to the department of defense. The coward could not even show his flag. Send a complaint to the name given above,
that someone using that computer was trying to scam you.

A lot of Americans will be upset at seeing such things happening with our tax money.
2008-07-20, 17:16:36
Skeet from United States  
Hullo gent's,Took 10 minutes for the page to load but it did! :grin:

I can see another BIG reason for the problem with available space...

You all put way too much of the IP look-up in the post's! You really don't need all that ARIN / AFRIN crap! All you actually need is the basic ISP info;


inetnum: -
netname: RU-MARI-20061120
address: OJSC VolgaTelecom
org-name: OJSC VolgaTelecom
address: Sovetskaya 138
address: 424000
address: Yoshkar-Ola
address: Russian Federation
address: VolgaTelecom Mari El branch

I keep these in a folder and just change the numbers that need to be and it's ready for posting.No need to even use a tool unless I don't have it. Then I add it,fast,easy and simple!

Anyone who'd like a copy and has my addy,I'll be happy to share it with you.


2008-07-21, 18:36:15
OJAS from United States  
Thanks Skeet,
Good to see you with yet another posting guide line. I think it is you from whom I stole a guide line that we only need from the full full header, just 2 lines, the sender IP and the X-mailer.
See you whenever you muster enough patience for page load with dial-up.

Maybe the scammers have rubbed on some of their impatience on you? lol! :-D
2008-09-03, 19:05:53
anonymous from United States  
2008-09-12, 09:02:00
[hidden] from Australia  
More of 'masha' here
working with '' flower/gift/translation scamming
2008-09-12, 20:36:22
[hidden] from Australia  
She(?) is wondering why I don't repl.
X-Message-De-Delivery: Vj0zLjQuMDt1cz0wO2w9MDthPTA=
X-Message-Status: n:0
X-SID-PRA: Masha <>
X-Message-InfR00BdL5giqqThK46ZLKhbS/ 7TKVc8+vAHYdAM6D5BJ1fFWeGI+vJnVndxUwOAwOALxNdXyqDVyUECKiP4xTkrZ/qVrDsrmE8Z9o
Received: from ([]) by with Microsoft SMTPSVC(6.0.3790.2444);
    Fri, 12 Sep 2008 05:03:41 -0700
Received: from compute2.internal (compute2.internal [])
    by (Postfix) with ESMTP id 7F83915EF38
    for <xxxxx>; Fri, 12 Sep 2008 08:03:41 -0400 (EDT)
Received: from ([])
by compute2.internal (MEProxy); Fri, 12 Sep 2008 08:03:41 -0400
X-Sasl-enc: Y4n2jtMKnpUaDWd42fdKVbmfLbE0clVBijTLJ8oqUbKc 1221221021
Received: from ( [])
    by (Postfix) with ESMTPA id D3D602C6E7
    for <xxxxx>; Fri, 12 Sep 2008 08:03:40 -0400 (EDT)
X-Mailer: QUALCOMM Windows Eudora Version
Date: Fri, 12 Sep 2008 13:31:49 +0300
To: xxxxx
From: Masha <>
Mime-Version: 1.0
Content-Type: text/plain; charset='us-ascii'; format=flowed
Message-Id: <>
X-OriginalArrivalTime: 12 Sep 2008 12:03:41.0618 (UTC) FILETIME=[991A1920:01C914CF]
From: Masha []
Sent: Friday, 12 September 2008 20:32
To: xxxxx

xxxxx, how have you been? Is everything all right? I haven't got a
letter fryou!

-------------------------------------------- ---------------------------------------------------------------------------
This message was translated and delivered to you by Red Rose C.
---------------------------------------------------------- ----------------------------------------------------------

2008-10-30, 10:05:57
[hidden] from United States  
2008-10-30, 10:12:35 from United States  
well i was quite shocked to find this site. i have been in correspondence with this person for some time.i have all the same photos that are posted here. and i now feel quite embarrased. but to who ever you are that put this site up thank you! i was days away from making a trip there, not sure what i was going to find when i got there.i would appreciate any other info you might have on this whole thing. thank you again....matt
2008-11-07, 14:58:03   (updated: 2008-11-07, 14:58:50)
anonymous from Sweden  
Hi...I have been in contact with her too with most of the pics...but a question..what it does mean by scammer???
You are on page 3 of 6, other pages: 1 2 [3] 4 5 6



Are you being scammed and this is your first visit here?
Read the welcome page/ primer for newbies.
Thanks to Eddie for writing it up.

Please also read Miss Marple's article about recognizing male dating scammers.

NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture:
Picture Search

You have received photos and wonder if these photos has been posted here before? Because you suspect this could be a dating scammer, but you do not want to post this picture? Try the Picture Search