IP Tracing

[XMan]

Since I've done the agency thing, at suggestions of others tried russianpersonals.ru. 

Been a very long time since I did "in the trenches" tech support work.  That having been said, decided to check e-mail headers and do some IP tracing.  Sure I'm paranoid.  Whatever. 

2 women, supposedly in the same city (Cheboksary). 
Lady 1 seems to check out as OJSC Volga Telecomm (in Yokshar-Ola, Russia, which perhaps is close enough Cheboksary to be legit).
Lady 2, the good old USA.  Plano, TX. 
Now, this is assuming the tools I used were accurate. 

Checked e-mail tonight, had one from Lady 2 giving me her address in Cheboksary, and also an 11 digit phone (frankly, been 2 years since I was in Russia, don't know if this number checks out yet, haven't tried it since I just saw it this evening).

Haven't received contact info from Lady 1 yet.

Thoughts?
Suggestions?
Thanks.

[JR]

http://www.nextwebsecurity.com/HeaderTool2-pub.asp

A good tool to cut and paste the entire email header for tracing.

Plano Texas is a bad thing.

Check the header for "the BAT" Bad sign...

The country code for Russia is 7. Calling from the US a Russian phone number will begin like this: 011-7-area code-number.

[XMan]

Same results for the tool you recommended.

Curious about what "the BAT" implies.

[Admin]

Since I've done the agency thing, at suggestions of others tried russianpersonals.ru. 

Been a very long time since I did "in the trenches" tech support work.  That having been said, decided to check e-mail headers and do some IP tracing.  Sure I'm paranoid.  Whatever. 

2 women, supposedly in the same city (Cheboksary). 
Lady 1 seems to check out as OJSC Volga Telecomm (in Yokshar-Ola, Russia, which perhaps is close enough Cheboksary to be legit).
Lady 2, the good old USA.  Plano, TX. 
Now, this is assuming the tools I used were accurate. 

Checked e-mail tonight, had one from Lady 2 giving me her address in Cheboksary, and also an 11 digit phone (frankly, been 2 years since I was in Russia, don't know if this number checks out yet, haven't tried it since I just saw it this evening).

Haven't received contact info from Lady 1 yet.

Thoughts?
Suggestions?
Thanks.

You may be able to work with the links in the RWDpedia for FSU Telephone Information, found here -- http://www.russianwomendiscussion.com/mwiki/index.php?title=Telephone_Directories.

If the information is helpful, please post and let us know. If not, let us know that as well.

- Dan

[JR]

BAT, in it's various versions, ie: v3.1, etc. is an email tool which allows the user to quickly send form emails to many reciepants. It has the ability to change pre-placed names throughtout the letter making it appear more legit. The BAT is used extensively by professional scammers.

It is not the end-all proof you are dealing with a scammer but it is an indicator.

Oh yeah, Cheboksary is known to be a scammer haven

[Admin]

BAT, in it's various versions, ie: v3.1, etc. is an email tool which allows the user to quickly send form emails to many reciepants. It has the ability to change pre-placed names throughtout the letter making it appear more legit. The BAT is used extensively by professional scammers.

It is not the end-all proof you are dealing with a scammer but it is an indicator.

Oh yeah, Cheboksary is known to be a scammer haven

'The BAT' is the *only* email client my SPAM reporting software (Purify from Hendricom.com) explicitly calls out with a configuration option to immediately classify email sent with 'The BAT' as SPAM.

Like you say JR - not conclusive, but a relatively strong indicator of a high-volume email source.

BTW - some of my friends and colleagues in Ukraine use 'The BAT' frequently, so I obviously do not exercise Purify's configuration option.

- Dan

[Shadow]

Interesting thing those IP traces. 

As for lady 1, het location (Cheboksary) and IP (Yoshkar-Ola) indicate she might be part of the scam ring. Check the IP again, if it points to the University of Yoshkar-Ola you can be 99% sure.

Case 2 is more interesting. You should check if the lady sends her mail from work, as working for an American company can cause the IP to be routed through the US.
Another thing can be that she is using a web-based service and the originating IP is masked. If she gave you her number, use it.

[XMan]

Concerning phone, no luck with these:
    * White Pages (RIN) : http://whitepages.rin.ru/cgi-bin/search_e.cgi (in English)
    * Nomer : http://www.nomer.org (in Russian)

Some sort of technical issue on the first, couldn't translate the latter well enough to check. 

BAT is in both e-mails.  The odd thing, however, is specific answers to my questions.  If it was a global response with a name replacement, that wouldn't work. 

Say what you will about agencies, and some are the biggest scam-fests ever, if you can find a decent one I still think you're better off.  But, only my opinion, and that is clearly colored by this frustrating experience. 

[Shadow]

Do not expect to find a russian number in an online dictionary.
If you can confim the number is in Russia, just call it...

As for the BAT, it is a program used in the FSU as more legal replacement for a pirated Microsoft Outlook. 

[XMan]

Using this tool:

http://www.nextwebsecurity.com/HeaderTool2-pub.asp

for both women I see this field:
Int Emails: (and a lengthy number @yahoo.com)
Don't know what, if anything, it indicates.

Used a downloadable product called Visual IP Trace that gives a very good hop-by-hop display.  Plano, TX appears to be certain for Lady 2.  Yokshar-Ola certain as well for Lady 1.  

I don't know if there is any way either woman can be legit or not.  
Not sure if there is IP masking of some sort happening, and if so why, on Lady 2.
Considered sending flowers to Lady 2 through a service that provides photo to see if address / photo are real.  An expensive test.  Waiting to see what I get as far as contact info (if any) for Lady 1.  

Having trouble confirming whether phone is in Russia or not.

[Johnny2009]

Using this tool:

http://www.nextwebsecurity.com/HeaderTool2-pub.asp

for both women I see this field:
Int Emails: (and a lengthy number @yahoo.com)
Don't know what, if anything, it indicates.

Used a downloadable product called Visual IP Trace that gives a very good hop-by-hop display.  Plano, TX appears to be certain for Lady 2.  Yokshar-Ola certain as well for Lady 1.  

I don't know if there is any way either woman can be legit or not.  
Not sure if there is IP masking of some sort happening, and if so why, on Lady 2.
Considered sending flowers to Lady 2 through a service that provides photo to see if address / photo are real.  An expensive test.  Waiting to see what I get as far as contact info (if any) for Lady 1.  

Having trouble confirming whether phone is in Russia or not.

Hi

Sorry, I have not read any of your other posts, I have a couple of questions.

Have you spoken to either of these ladies yet?
And has either lady offered a land line telephone number yet?

P.S "The Bat" in email information is never a good sign as it is normally used by persons wishing to conceal their location.

[Johnny2009]

Hi

Sorry, I have not read any of your other posts, I have a couple of questions.

Have you spoken to either of these ladies yet?
And has either lady offered a land line telephone number yet?

P.S "The Bat" in email information is never a good sign as it is normally used by persons wishing to conceal their location.

Opps, just seen that you haven't called either lady yet, best advice is to pick up the phone and try to ring her, and if its not her phone number, try and get that to.

[Mars]

I find all this detective type of work a bit confusing and amusing at the same time.
Why bother??
Cast a very wide net over your target city.
Make initial contact with a zillion women.
Start screening them out.  And for sure screen out any such as those discussed in this thread.
You will end up with many women to date in your target city; none of which you will have such concerns about as discussed in this thread.
There are a lot more important things to concentrate on than trying to fine tune info on a possible scammer.

[XMan]

I understand the wide net view.
But unless independently wealthy, who can manage the time to try to contact hundreds of women, let alone manage the correspondence and then phone etc.
Pick a dozen, go from there, that's the best I can manage.  I couldn't keep more than that straight and remember who I said what to when. 

In this case had some decent correspondence and narrowed down to 2 (seemingly) interesting ladies.  Have contact info on one, waiting to see on the other.  But whether it's legitimate contact info is what I am trying to determine.  Again, to each his own concerning approach.  What works for one may not work for another. 

[Shadow]

You have a phone number. If it starts with '7' its in Russia.
If it is, call it. If not, flower test is not needed.

As you have her address, put the street name and numer in Google, or even better in Yandex and see what comes up.
Google Earth will give a nice view of the surroundings.

Best option is to call.

[XMan]

Does not begin with a 7.
Begins with 8. 

Google maps can't find the address. 

Sounds like the end of the trail to me. 
Perhaps no better on the other woman. 
Will find out shortly I imagine. 
And then, back to looking for a reputable (if one exists) agency. 
Or, become a monk. 
Always an option. 
Comfy robe.

[RussianWind]

P.S "The Bat" in email information is never a good sign as it is normally used by persons wishing to conceal their location.

NO, please don't set The Bat as a red flag.

As Shadow correctly said "it is a program used in the FSU as more legal replacement for a pirated Microsoft Outlook". The Bat was written by Belorussian guys, costs only about $20 and widespread here. It is just a email client, much better than all Outlooks together. I personally use it for 15+ years.

[RussianWind]

Does not begin with a 7.
Begins with 8. 

+7 is the international code of Russia
8 - local people use it as intercity code. Most locals don't even know that the int code is +7 (actually should be considered as a good sign 

[XMan]

OK. Thank you, RussianWind.

Well, back to calling and seeing WTF happens.

[RussianWind]

Lady 2, the good old USA.  Plano, TX. 

This is strange. Can it be a mistake? Send me letter headers.

one from Lady 2 giving me her address in Cheboksary,

Send it to me, I will try in Russian. Sometimes Google maps don't know some streets. Or spelling may be different.

and also an 11 digit phone

This is a mobile phone. If you change 8 for +7 you can call or send sms.

[Sculpto]

Plano texas is not a mistake.  Thee is some sort of hosting service there that has been called out in a lot of scams.  I have spoken to them on the phone and they claim innocence, but, it keeps coming up over and over again.  Plano is a strong indicator of scam and an attempt to defeat IP traces.

Questions being answered also are not an indicator anymore.  Nor is a phone call.  Too much evidence for my taste.  The scammers have advanced and could have partners inside the usa. 

[XMan]

RussianWind,

Sent you a PM.
Thanks.

[Shadow]

A partner is not needed. A proxy server can do the trick just fine.
There can be multiple reasons people use proxy servers. One is to hide their IP.
Another because where they operate the internet (at work ?) has a number of sites blocked. Third because they want to register to a dating service that has blocked the FSU.

[Sculpto]

A partner is not needed. A proxy server can do the trick just fine.
There can be multiple reasons people use proxy servers. One is to hide their IP.
Another because where they operate the internet (at work ?) has a number of sites blocked. Third because they want to register to a dating service that has blocked the FSU.

right but there have been repeated confirmations of scams with that same isp out of plano.. IMO not worth going any further once that comes up.

[RussianWind]

Plano texas is not a mistake.   

I think you are right. I found few links in connection with Russian scam and Plano TX like this one http://74.125.77.132/search?q=cache:AxoG6PIelqMJ:www.romancescam.com/forum/viewtopic.php%3Ff%3D6%26t%3D20504+72.36.146.2&cd=3&hl=ru&ct=clnk

Both letters are sent from yahoo via the bat

Do I understand correctly that yahoo.com doesn't allow free services via smtp? So I am curious how they do that.