This is a tool that can help you figure out your 'lady' is not quite telling you the truth about where she's located!

I'm not good at this, but it helps me sometimes.
EXAMPLE: You're dealing with a NIGERIAN romance scammer, posing as a person in the US. You check the headers, and see they are in Africa, somewhere.

It also works with the Russians. Any email from the Republic of Mari El are additionally suspect!
Your girlfriend states in her letters she is in St. Petersburg, and has never left there, but her emails show she is in Yoshkar Ola.







Here's the header from 'Elena'...........

Quote:

X-Gmail-Received: 476bfad68966650047c929944cee6b3bef50026a Delivered-To: Only registered users can see links on this forum! Register or Login on forum! Received: by 10.48.218.3 with SMTP id q3cs2700nfg; Mon, 13 Feb 2006 07:04:55 -0800 (PST) Received: by 10.67.30.9 with SMTP id h9mr1178324ugj; Mon, 13 Feb 2006 07:04:55 -0800 (PST) Return-Path: <Elena_nice77@mail.ru> Received: from mx3.mail.ru (mx3.mail.ru [194.67.23.149]) by mx.gmail.com with ESMTP id s1si3979800uge.2006.02.13.07.04.54; Mon, 13 Feb 2006 07:04:55 -0800 (PST) Received-SPF: pass (gmail.com: domain of Only registered users can see links on this forum! Register or Login on forum! designates 194.67.23.149 as permitted sender) Received: from [195.161.247.156] (port=30512 helo=comp2.mshome.net) by mx3.mail.ru with asmtp id 1F8fG1-000Hn7-00 for Only registered users can see links on this forum! Register or Login on forum! ; Mon, 13 Feb 2006 18:04:53 +0300 Date: Mon, 13 Feb 2006 15:02:14 +0300 From: Only registered users can see links on this forum! Register or Login on forum! X-Mailer: The Bat! (v3.0.1.33) Professional Reply-To: Only registered users can see links on this forum! Register or Login on forum! Organization: Only registered users can see links on this forum! Register or Login on forum! X-Priority: 3 (Normal) Message-ID: <1954533168.20060213150214@mail.ru> To: Only registered users can see links on this forum! Register or Login on forum! > Subject: Hello!!! In-Reply-To:

You'll want to look for the last 'receieved from' entry, IN BRACKETS,in this case it's


Received: from [195.161.247.156] (port=30512

195.161.247.156 is the IP address you want.

Go to

Only registered users can see links on this forum! Register or Login on forum!

or

Only registered users can see links on this forum! Register or Login on forum!

Code:

http://www.dnsstuff.com/ http://headertool.apelord.com/.

And enter this IP number into the red box in the center of the page that says 'CITY FROM IP'.

This is what comes up

Quote:

IP: 195.161.247.156 Country: Russian Federation City: Unknown Country Code: RU Merchant Note: Country may have high rate of fraud [6] Currency: RUR [Russia Rubles] Private IP? No Known Proxy? No

Not much info, it did come from Russia.
Enter the IP address into the 'IPwho is' box on the same page, right above the 'City from IP' box, and look what you find!

Quote:

inetnum: 195.161.244.0 - 195.161.247.255 netname: MARTELCOM descr: Mari El Net descr: VolgaTelecom Mari El branch country: RU admin-c: NN-RIPE tech-c: NN-RIPE status: ASSIGNED PA notify: ***@mari-el.ru notify: ***@rtcomm.ru mnt-by: AS8342-MNT changed: ***@rtcomm.ru 20051018 source: RIPE person: Nikolay Nikolaev address: Volgatelecom Mari El branch address: Sovetskaya 138 address: 424000 Yoshkar-Ola address: Russia MariEl Republic phone: +7 8362 421549 phone: +7 8362 664435 fax-no: +7 8362 664151 e-mail: ***@relinfo.ru nic-hdl: NN-RIPE changed: ***@relinfo.ru 20040402 source: RIPE

Yes, Mari El is a red flag!!! This lady claims to be in MURMANSK!!
I know little about Russia, but I don't think MURMANSK is in Mari el!!


With some email headers, it's a little easier, here you see a reference to Mari el without much digging! See the 'dialup.mari-el.ru ' entries?
Mari el is always a red flag! There are probably some decent women in Mari El, but since this is the HOME of Russian Email scams, be careful!

Quote:

X-Gmail-Received: fafbbddff788b8e10128a29c4a280a6735e20dbb Delivered-To: Only registered users can see links on this forum! Register or Login on forum! Received: by 10.48.218.3 with SMTP id q3cs21529nfg; Sat, 11 Feb 2006 01:59:44 -0800 (PST) Received: by 10.70.104.19 with SMTP id b19mr387926wxc; Sat, 11 Feb 2006 01:59:43 -0800 (PST) Return-Path: <popovanadya59@l.ru> Received: from aqua.relinfo.ru (ns.mari-el.ru [195.161.208.130]) by mx.gmail.com with ESMTP id i39si2788301wxd.2006.02.11.01.59.42; Sat, 11 Feb 2006 01:59:43 -0800 (PST) Received-SPF: softfail (gmail.com: domain of transitioning Only registered users can see links on this forum! Register or Login on forum! does not designate 195.161.208.130 as permitted sender) Received: from 115.237.dialup.mari-el.ru (115.237.dialup.mari-el.ru [217.107.237.115]) by aqua.relinfo.ru (8.12.11/8.12.11) with ESMTP id k1B9tIsg052772 for <XXXXX@gmail.com>; Sat, 11 Feb 2006 12:57:39 +0300 (MSK) (envelope-from Only registered users can see links on this forum! Register or Login on forum! ) Date: Sat, 11 Feb 2006 12:18:56 +0300 From: Only registered users can see links on this forum! Register or Login on forum! Reply-To: Only registered users can see links on this forum! Register or Login on forum!

Received: from 115.237.dialup.mari-el.ru (115.237.dialup.mari-el.ru [217.107.237.115])




Another tip off, although not quite as reliable, is the notation that
'The Bat' email server is being used.
This is a program favored by spammers, and scammers, who handle LARGE amounts of emails.
I have been told it's a good program, used by a lot of non-criminal types, but I almost ALWAYS see it in my scammer emails!

From:

Only registered users can see links on this forum! Register or Login on forum!

X-Mailer: The Bat! (v3.0.1.33) Professional
Reply-To:

Only registered users can see links on this forum! Register or Login on forum!

Note: the version number may change, and the user version, here it's 'Professional', I've seen 'Home', and 'Educational' versions



Here's more..........


Let me find an example and I'll post it. I'm not real good at it.....

Here's the header from an email sent from a Yahoo account by a NIGERIAN scammer, who claimed to be a US citizen, stranded in Africa.

(I'm putting a blank line before, and after the line you're looking for, to make it easier to see, but they'll be run together in the header.)

Quote:

X-Gmail-Received: 6d01b8ed2451a54149e64586d358781c56188405 Delivered-To: Only registered users can see links on this forum! Register or Login on forum! Received: by 10.67.22.5 with SMTP id z5cs5286ugi; Sun, 11 Dec 2005 19:01:29 -0800 (PST) Received: by 10.70.44.5 with SMTP id r5mr8556292wxr; Sun, 11 Dec 2005 19:01:28 -0800 (PST) Return-Path: <jenny_prestonluv@yahoo.com> Received: from web35015.mail.mud.yahoo.com (web35015.mail.mud.yahoo.com [209.191.68.209]) by mx.gmail.com with SMTP id i12si5617431wxd.2005.12.11.19.01.27; Sun, 11 Dec 2005 19:01:28 -0800 (PST) Received-SPF: pass (gmail.com: domain of Only registered users can see links on this forum! Register or Login on forum! designates 209.191.68.209 as permitted sender) DomainKey-Status: good (test mode) Received: (qmail 98450 invoked by uid 60001); 12 Dec 2005 03:01:27 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=M8O700rZskzGZPxAFDnMfr6+tHtpVZWvedAhd2tjY HpaAJUgsCtzZe7Z2kdC3gCiyZaejBsWpAGWt5e1r8khHpxKK 2EbjKreiFzuYs6pMxtE5yZTJ1EFbaXpsMAMdwwR1j+s7ToifGDpaU1Crjh2n1 XSGZPUOYoMM6pb0JjmlGo= ; Message-ID: <20051212030127.98448.qmail@web35015.mail.mud.yahoo.com> THIS is the IP you are looking for. The LAST received from IP in BRACKETS. (below) Received: from [196.3.62.4] by web35015.mail.mud.yahoo.com via HTTP; Sun, 11 Dec 2005 19:01:27 PST Date: Sun, 11 Dec 2005 19:01:27 -0800 (PST) From: jenny preston <jenny_prestonluv@yahoo.com> Subject: hello To: Only registered users can see links on this forum! Register or Login on forum! In-Reply-To: <275908380512111440r491a008eu3517381f9cb35c18@mail.gmail.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="0-1866979598-1134356487=:97333" Content-Transfer-Encoding: 8bit --0-1866979598-1134356487=:97333 Content-Type: multipart/alternative; boundary="0-701980742-1134356487=:97333" --0-701980742-1134356487=:97333 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit

196.3.62.4 is NIGERIA. OK, easy this girl said she was in Nigeria, anyway.


Here's a Yahoo email sent by a Filipina who contacted me on Kissesline.
She claims to be in Dubai, UAE, but look at what her email headers say?

Quote:

X-Gmail-Received: 1554c188fa6ec2ecfec178c79f83fe88fe87c411 Delivered-To: Only registered users can see links on this forum! Register or Login on forum! Received: by 10.67.22.7 with SMTP id z7cs34383ugi; Thu, 23 Feb 2006 00:47:34 -0800 (PST) Received: by 10.70.77.14 with SMTP id z14mr21718wxa; Thu, 23 Feb 2006 00:47:32 -0800 (PST) Return-Path: <XXXX@yahoo.com> Received: from web33904.mail.mud.yahoo.com (web33904.mail.mud.yahoo.com [66.163.178.68]) by mx.gmail.com with SMTP id i39si21272wxd.2006.02.23.00.47.31; Thu, 23 Feb 2006 00:47:32 -0800 (PST) Received-SPF: pass (gmail.com: domain of Only registered users can see links on this forum! Register or Login on forum! designates 66.163.178.68 as permitted sender) DomainKey-Status: good (test mode) Received: (qmail 20412 invoked by uid 60001); 23 Feb 2006 08:47:31 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=zEKj8es/iPQZ0TB8CL0kq8kw/rBlpxLXgeComofOqk2Yw+ C+y2yKjZ8hpCBzvOIMFC9Egi4fqRq5FYp5o7Z2/lwWoP EcXiFbYXaQry7iRnZGvEFzn4B7nqHOpAoAdQbOrWc1 VFskfZkJyZYaWIlWDtXViFpNFHUkazKj4tlwbR4= ; Message-ID: <20060223084730.20410.qmail@web33904.mail.mud.yahoo.com> Received: from [210.213.233.79] by web33904.mail.mud.yahoo.com via HTTP; Thu, 23 Feb 2006 08:47:30 GMT Date: Thu, 23 Feb 2006 08:47:30 +0000 (GMT) From: XXXX <XXXX@yahoo.com> Subject: have a nice day To: XXX <XXXX@gmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-722567156-1140684450=:18512" Content-Transfer-Encoding: 8bit --0-722567156-1140684450=:18512 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Hi XXXX, im here in Dubai already i work inside the mall as stock clerk is not easy to stay here i have no rest day yet and i still adjusting all things here. how i wish i could raom around to see the place. hows your job? i hope you' like your new job and happy, about me im beginning to love my job couse this is the only way to survive here. next month i can go out already i'll send you pictures of nice place here. i love hearing from you always. take extra care XXX

Guess what her IP shows? The email came from the Philippines.




IP: 210.213.233.79
Country: Philippines
City: Unknown

Country Code: PH
Merchant Note: Country may have high rate of fraud [1]
Currency: PHP [Philippines Pesos]
Private IP? No
Known Proxy? No



If you do a 'who is' of the IP, it shows the local Manila Telephone/Internet provider.


One more, my old friend, Oksana Belousova, who uses Gmail accounts.

Quote:

X-Gmail-Received: 777700a080f9aa0496a0653b4ec2ce6707fae6b9 Delivered-To: Only registered users can see links on this forum! Register or Login on forum! Received: by 10.65.98.19 with SMTP id a19cs99998qbm; Sat, 1 Apr 2006 12:59:57 -0800 (PST) Received: by 10.70.91.8 with SMTP id o8mr272308wxb; Sat, 01 Apr 2006 12:59:57 -0800 (PST) Return-Path: <oksana.belousova@gmail.com> Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.233]) by mx.gmail.com with ESMTP id i37si1012440wxd.2006.04.01.12.59.56; Sat, 01 Apr 2006 12:59:57 -0800 (PST) Received-SPF: pass (gmail.com: domain of Only registered users can see links on this forum! Register or Login on forum! designates 64.233.184.233 as permitted sender) DomainKey-Status: good (test mode) Received: by wproxy.gmail.com with SMTP id i6so1078188wra for <pplepeu@gmail.com>; Sat, 01 Apr 2006 12:59:56 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:date:x-mailer:reply-to:x-priority:message-id:to:subject:in-reply-to:references:mime-version:content-type:from; b=r1iPJYB8DyesWoWeidGeY7UMrtdyLSPng70V 9ielm8IO8zBeNkkGXegMIISowYh2TXWSbzSOsbVlz0w6 phsjHZziLOANxJs3OatXUM3Xdxo9VBWuMEI0Tg/V76N Cn1iSx8YBmdeF6lfI94gecv5r520NygM4hMGILqjM/X59wAA= Received: by 10.65.235.11 with SMTP id m11mr107362qbr; Sat, 01 Apr 2006 12:59:56 -0800 (PST) Return-Path: <oksana.belousova@gmail.com> Received: from comp4.mshome.net ( [195.161.214.166]) by mx.gmail.com with ESMTP id f17sm426697qba.2006.04.01.12.59.12; Sat, 01 Apr 2006 12:59:55 -0800 (PST) Date: Sat, 1 Apr 2006 13:19:39 +0400 X-Mailer: The Bat! (v1.62r) Reply-To: Oksana <Oksana.Belousova@gmail.com> X-Priority: 3 (Normal) Message-ID: <248533642.20060401131939@gmail.com> To: "Stepan" <XXXX@gmail.com> Subject: You yet have not forgotten me liked? In-Reply-To: <275908380603290203q57696cag6159fa64363454c2@mail.gmail.com> References: <275908380603290203q57696cag6159fa64363454c2@mail.gmail.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------10137118BA86029" From: Oksana <oksana.belousova@gmail.com>

See the last 'received from' IP in Brackets?
195.161.214.166 Points to MOSCOW.

But, go at DNSSTUFF.com, enter that IP into the box that says 'NEW! IP Informations', and it spits this out....



IP address: 195.161.214.166
Reverse DNS: 166.214.dialup.mari-el.ru.
Reverse DNS authenticity: [Verified]
ASN: 8342
ASN Name: RTCOMM-AS (RTComm.RU Autonomous System)
IP range connectivity: 1
Registrar (per ASN): RIPE
Country (per IP registrar): RU [Russian Federation]
Country Currency: RUR [Russia Rubles]
Country IP Range: 195.161.0.0 to 195.161.255.255
Country fraud profile: High
City (per outside source): Moscow, Moskva
Private (internal) IP? No
IP address registrar: whois.ripe.net
Known Proxy? No



Anytime I see Mari El in the email header when the girl claims to be 'elsewhere', I smell a crook! Having 'The Bat!' in the header also!

This works unless you have an up-to-date, affluent scammer.
Here's one who's using a SATELLITE internet connection.
What's wrong with that? IT only tells you the IP where the signal was recieved into the system.....by the 'big dish', not where it originated from.
The Message goes from the scammers DIsh, to the satellite, and to the base station/terminal Dish, THEN it gets an IP.
(MY rough abbreviated explanation of the mess....)

Quote:

,X-Gmail-Received: 2b3c288a64cd3ddb6ab126b1b400e69f01532d0a Delivered-To: xxxxxxxxxmail.com Received: by 10.48.218.3 with SMTP id q3cs31957nfg; Fri, 17 Feb 2006 11:16:13 -0800 (PST) Received: by 10.65.230.4 with SMTP id h4mr1675881qbr; Fri, 17 Feb 2006 11:16:12 -0800 (PST) Return-Path: <katyalon@gmail.com> Received: from uproxy.gmail.com (uproxy.gmail.com [66.249.92.206]) by mx.gmail.com with ESMTP id f13si1296106qba.2006.02.17.11.16.11; Fri, 17 Feb 2006 11:16:12 -0800 (PST) Received-SPF: pass (gmail.com: domain of Only registered users can see links on this forum! Register or Login on forum! designates 66.249.92.206 as permitted sender) DomainKey-Status: good (test mode) Received: by uproxy.gmail.com with SMTP id k3so320579ugf for <xxxxxt@gmail.com>; Fri, 17 Feb 2006 11:16:11 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:date:from:x-mailer:reply-to:x-priority:message-id:to:subject:in-reply-to:references:mime-version:content-type; Fri, 17 Feb 2006 11:16:09 -0800 (PST) Return-Path: <katyalon@gmail.com> Received: from ?172.16.199.13? ( [82.211.138.7]) by mx.gmail.com with ESMTP id k1sm443964ugf.2006.02.17.11.15.55; Fri, 17 Feb 2006 11:16:06 -0800 (PST) Date: Fri, 17 Feb 2006 22:14:53 -0500 From: Katya <katyalon@gmail.com> X-Mailer: The Bat! (v3.0.1.33) Professional Reply-To: Katya <katyalon@gmail.com> X-Priority: 3 (Normal) Message-ID: <1598200878.20060217221453@gmail.com>

The 82.211.138.7 IP points to:

inetnum: 82.211.128.0 - 82.211.191.255
org: ORG-NPEL1-RIPE
netname: CY-PLANETSKY-20031014
descr: PROVIDER Local Registry
descr: Net Planet Earth Lmited
country: CY
admin-c: PSKY-RIPE
tech-c: PSKY-RIPE
status: ALLOCATED PA
notify: **********@planetsky.com
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: NPE-MNT
mnt-routes: NPE-MNT
changed: **********@ripe.net 20031014
changed: **********@ripe.net 20031020
changed: **********@ripe.net 20041025
source: RIPE

organisation: ORG-NPEL1-RIPE
org-name: Net Planet Earth Lmited
org-type: LIR
address: 6, Vasili Vryonides Str.
Gala Court Chambers, PO box 52080
address: 4060
address: Limassol
address: Cyprus
phone: +357 25 817 204
fax-no: +357 25 817 211
e-mail: ***@planetsky.com




Wow, this poor little girl who has to save up her Kopeks to write you a few lines from the Internet Cafe, and had to eat her pet cat, Dasha, for dinner last night, since she couldn't afford to feed him, has satellite internet service, through Cyprus!!!!

Hi Stepan,
I have tried for IPs but I only get this, can you explain???.
frm.action="/cgi-bin/kill?a=640e5715776c26a7793a75cd022e1413e91a05693ab1e77bd347161af9e16f86&"

Not sure what you're doing wrong?
You'll need to view the 'raw' message to see the headers.
In the various email services, the command to do this is a little different.
In gmail, you click on 'show original'.
In yahoo, I think it is 'full headers'.
Will check when I have time.

With the new Yahoo Mail Beta headers are now found top right-hand above date. Full headers now open in their own dialogue box separate from the message.

I have discovered you can find e-mail headers in Hotmail after all, despite MSN stating that you cannot also gmail as well

Only registered users can see links on this forum! Register or Login on forum!

Great site

I've altered your post to make the link clickable.

Anyone know how to get full headers on a earthlink.net e-mail account

Perhaps one of you can answer this. Is it not possible to get the IP's with MSN? I've been searching around and didn't find a clear way to be able to extract this info. Appreciate in advance your time and reply. Jombee Out.

MSN seems to be the same as Hotmail. Have a look at the link in my signature at the directions for Hotmail and let me know if it works. I'm not a Microsoft fan so try to stay away from them as much as I can.

Hey,
I run MSN 7.5 and this is how you do it, first in your inbox click on options in the top right corner, in the list of options click on mail display settings, then change the message headers option to advanced, thats it, hope it helps

Thanks guys for your assistance.

What worked? That way I can update my info to help others.

I also have 7.5 MSN and actually what I had just found out at the time I read your reply is how to do this

Open the Inbox e-mail.
Press Alt and Enter together presto there's the info

Excellent. I'll go add that so others can use it.