Hello & Welcome to our community. Is this your first visit? Register

Page 4 of 5 FirstFirst 12345 LastLast
Results 31 to 40 of 49
  1. #1
    Join Date
    Oct 2005
    Posts
    11

    Default ISP Trace Help Please

    Greetings to All,
    I have read that email using the "The Bat!" X-mailer program is a red flag to identify these Russian scammers. I see that I have received one.(My e-mail source info is listed below). I had no idea as to the HUGE number scammers out there.

    I did some googleing and of course came upon all those "Blacklist Sites" Being on a dialup connection - I had to make lunch while all their pics downloaded!! Oh my. Although I must say, I don't believe I've ever seen so many beautiful women on one webpage. What a shame.

    Perhaps someone can shed a little light on my source info below.
    It would be greatly appreciated. Better safe than sorry.
    Thank You in advance,
    ~Bob




    Return-Path: <xxxx@rambler.ru>
    Received: from mxb.rambler.ru ([81.19.66.30])
    by cortelyou.mail.atl.earthlink.net (EarthLink SMTP Server) with ESMTP id 1enS6715M3Nl3py0
    for <xxxx@peoplepc.com>; Fri, 7 Oct 2005 09:17:14 -0400 (EDT)
    Received: from mailc.rambler.ru (mailc.rambler.ru [81.19.66.27])
    by mxb.rambler.ru (Postfix) with ESMTP id DB442852B4
    for <xxxx@peoplepc.com>; Fri, 7 Oct 2005 17:17:13 +0400 (MSD)
    Received: from 127.0.0.1 ([82.198.27.203])
    (authenticated bits=0)
    by mailc.rambler.ru (8.12.10/8.12.10) with ESMTP id j97DHAev081229
    for <xxxx@peoplepc.com>; Fri, 7 Oct 2005 17:17:12 +0400 (MSD)
    X-AntiVirus: Checked by Dr.Web [version: 4.32b, engine: 4.32b, virus records: 76871, updated: 8.06.2005]
    Date: Fri, 7 Oct 2005 17:15:51 +0400
    From: xxxx@rambler.ru
    X-Mailer: The Bat! (v1.53d)
    Reply-To: xxxx@rambler.ru
    Organization: xxxx@rambler.ru
    X-Priority: 3 (Normal)
    Message-ID: <42366953093.20051007171551@rambler.ru>
    To: xxxx <xxxx@eoplepc.com>
    Subject: Re[2]: Another letter to my friend - xxxx!
    In-Reply-To: <30945034.1128660557978.JavaMail.root@mswamui-bichon.atl.sa.earthlink.net>
    References: <30945034.1128660557978.JavaMail.root@mswamui-bichon.atl.sa.earthlink.net>
    MIME-Version: 1.0
    Content-Type: text/plain; charset=us-ascii
    Content-Transfer-Encoding: 7bit
    X-Auth-User: xxxx@rambler.ru, whoson: (null)
    X-ELNK-AV: 0
    Female Scammers from Nigeria, Ghana, Russia, Ukraine and Philippines

  2. #31
    Join Date
    Aug 2005
    Posts
    622

    Default

    and last but not least....... you asked about finding information from a pc......

    here is a link. actually from mail.ru http://www.mail.ru/pages/help/262.html and before you say it is in russian use this web translator http://translation.paralink.com/translation.asp and all will be revealed. [8D][8D]

    look on right hand side and look for stealing passwords.



    to all russian scammers: i am somewhat of a bullshi*ter myself but i do like to listen to a professional. please carry on

  3. #32
    Join Date
    Oct 2005
    Posts
    15

    Default

    Nick,

    Can you look at this and tell me where this email originated from?

    Received: from mail.nis.nnov.su ([172.18.12.132])
    by vms052.mailsrvcs.net (Sun Java System Messaging Server 6.2-2.05 (built Apr
    28 2005)) with ESMTP id <0IOC00DS5OWWLSD0@vms052.mailsrvcs.net> for
    res0hoXX@verizon.net; Fri, 14 Oct 2005 07:48:32 -0500 (CDT)
    Received: from mail.nis.nnov.su (212.67.0.18)
    by sv6pub.verizon.net (MailPass SMTP server v1.2.0 - 080905135255JY+PrW)
    with SMTP id <1-5373-97-5373-319759-1-1129294110> for vms052pub.verizon.net;
    Fri, 14 Oct 2005 07:48:32 -0500
    Received: from 212.67.4.53 (ipdl053.nis.nnov.su [212.67.4.53])
    by mail.nis.nnov.su (8.12.11/8.12.11) with ESMTP id j9ECmQml019062 for
    <res0hoXX@verizon.net>; Fri, 14 Oct 2005 16:48:29 +0400
    Date: Fri, 14 Oct 2005 16:20:25 +0400
    From: Anna <XXX@knobmail.net>
    Subject: Re[4]: Your message
    In-reply-to: <0IO9002P1Y496QU2@vms040.mailsrvcs.net>
    X-Originating-IP: [212.67.0.18]
    To: "Bill Green" <res0hoXX@verizon.net>
    Reply-to: XXXX <XXXX@knobmail.net>

    It's confusing to me as to which IP it originated from.

    Thanks!

  4. #33
    Join Date
    Oct 2005
    Posts
    15

    Default

    Nick,

    Can you look at this and tell me where this email originated from?

    Received: from mail.nis.nnov.su ([172.18.12.132])
    by vms052.mailsrvcs.net (Sun Java System Messaging Server 6.2-2.05 (built Apr
    28 2005)) with ESMTP id <0IOC00DS5OWWLSD0@vms052.mailsrvcs.net> for
    res0hoXX@verizon.net; Fri, 14 Oct 2005 07:48:32 -0500 (CDT)
    Received: from mail.nis.nnov.su (212.67.0.18)
    by sv6pub.verizon.net (MailPass SMTP server v1.2.0 - 080905135255JY+PrW)
    with SMTP id <1-5373-97-5373-319759-1-1129294110> for vms052pub.verizon.net;
    Fri, 14 Oct 2005 07:48:32 -0500
    Received: from 212.67.4.53 (ipdl053.nis.nnov.su [212.67.4.53])
    by mail.nis.nnov.su (8.12.11/8.12.11) with ESMTP id j9ECmQml019062 for
    <res0hoXX@verizon.net>; Fri, 14 Oct 2005 16:48:29 +0400
    Date: Fri, 14 Oct 2005 16:20:25 +0400
    From: Anna <XXX@knobmail.net>
    Subject: Re[4]: Your message
    In-reply-to: <0IO9002P1Y496QU2@vms040.mailsrvcs.net>
    X-Originating-IP: [212.67.0.18]
    To: "Bill Green" <res0hoXX@verizon.net>
    Reply-to: XXXX <XXXX@knobmail.net>

    It's confusing to me as to which IP it originated from.

    Thanks!

  5. #34
    Join Date
    Aug 2005
    Posts
    11

    Default

    quote:Originally posted by Smoote

    Nick,

    Can you look at this and tell me where this email originated from?

    Received: from mail.nis.nnov.su ([172.18.12.132])
    by vms052.mailsrvcs.net (Sun Java System Messaging Server 6.2-2.05 (built Apr
    28 2005)) with ESMTP id <0IOC00DS5OWWLSD0@vms052.mailsrvcs.net> for
    res0hoXX@verizon.net; Fri, 14 Oct 2005 07:48:32 -0500 (CDT)
    Received: from mail.nis.nnov.su (212.67.0.18)
    by sv6pub.verizon.net (MailPass SMTP server v1.2.0 - 080905135255JY+PrW)
    with SMTP id <1-5373-97-5373-319759-1-1129294110> for vms052pub.verizon.net;
    Fri, 14 Oct 2005 07:48:32 -0500
    Received: from 212.67.4.53 (ipdl053.nis.nnov.su [212.67.4.53])
    by mail.nis.nnov.su (8.12.11/8.12.11) with ESMTP id j9ECmQml019062 for
    <res0hoXX@verizon.net>; Fri, 14 Oct 2005 16:48:29 +0400
    Date: Fri, 14 Oct 2005 16:20:25 +0400
    From: Anna <XXX@knobmail.net>
    Subject: Re[4]: Your message
    In-reply-to: <0IO9002P1Y496QU2@vms040.mailsrvcs.net>
    X-Originating-IP: [212.67.0.18]
    To: "Bill Green" <res0hoXX@verizon.net>
    Reply-to: XXXX <XXXX@knobmail.net>

    It's confusing to me as to which IP it originated from.

    Thanks!

  6. #35
    Join Date
    Aug 2005
    Posts
    11

    Default

    quote:Originally posted by Smoote

    Nick,

    Can you look at this and tell me where this email originated from?

    Received: from mail.nis.nnov.su ([172.18.12.132])
    by vms052.mailsrvcs.net (Sun Java System Messaging Server 6.2-2.05 (built Apr
    28 2005)) with ESMTP id <0IOC00DS5OWWLSD0@vms052.mailsrvcs.net> for
    res0hoXX@verizon.net; Fri, 14 Oct 2005 07:48:32 -0500 (CDT)
    Received: from mail.nis.nnov.su (212.67.0.18)
    by sv6pub.verizon.net (MailPass SMTP server v1.2.0 - 080905135255JY+PrW)
    with SMTP id <1-5373-97-5373-319759-1-1129294110> for vms052pub.verizon.net;
    Fri, 14 Oct 2005 07:48:32 -0500
    Received: from 212.67.4.53 (ipdl053.nis.nnov.su [212.67.4.53])
    by mail.nis.nnov.su (8.12.11/8.12.11) with ESMTP id j9ECmQml019062 for
    <res0hoXX@verizon.net>; Fri, 14 Oct 2005 16:48:29 +0400
    Date: Fri, 14 Oct 2005 16:20:25 +0400
    From: Anna <XXX@knobmail.net>
    Subject: Re[4]: Your message
    In-reply-to: <0IO9002P1Y496QU2@vms040.mailsrvcs.net>
    X-Originating-IP: [212.67.0.18]
    To: "Bill Green" <res0hoXX@verizon.net>
    Reply-to: XXXX <XXXX@knobmail.net>

    It's confusing to me as to which IP it originated from.

    Thanks!

  7. #36
    Join Date
    Oct 2005
    Posts
    11

    Default

    Hey Smoote... I believe Nick is on Holiday...
    In his absence - I'll take a crack at it. I'm a beginner at this... but I believe that your e-mail originated from the city of - "Nizhniy Novgorod", Russia. (Unless they are using a live/remote web-hosted app to create and send mail from... in which case their exact location will remain a mystery.)

    I would google that address she gave you... it may not be correct. I found a "Molochnaya" river and a dairy company spelled close to same way, but upon 1st glance I don't see any city with the name "Molochnyi".

    Also you left your own name in that source code...

    Be careful with those letters... read some posts...

    Nick's post...
    http://www.stop-scammers.com/forum/t...p?TOPIC_ID=346
    is a good one to start with, it should be required reading.

    Good Luck!
    Bob



  8. #37
    Join Date
    Oct 2005
    Posts
    11

    Default

    Hey Smoote... I believe Nick is on Holiday...
    In his absence - I'll take a crack at it. I'm a beginner at this... but I believe that your e-mail originated from the city of - "Nizhniy Novgorod", Russia. (Unless they are using a live/remote web-hosted app to create and send mail from... in which case their exact location will remain a mystery.)

    I would google that address she gave you... it may not be correct. I found a "Molochnaya" river and a dairy company spelled close to same way, but upon 1st glance I don't see any city with the name "Molochnyi".

    Also you left your own name in that source code...

    Be careful with those letters... read some posts...

    Nick's post...
    http://www.stop-scammers.com/forum/t...p?TOPIC_ID=346
    is a good one to start with, it should be required reading.

    Good Luck!
    Bob



  9. #38
    Join Date
    Oct 2005
    Posts
    15

    Default

    Thank you for the help. I just Googled "Russia, 184365" and came up with a city called Molochny which is where she claims to live although she put an "i" on the end of the name. And apparently it's close to Murmansk which she also claimed.

    The only problem is "Nizhniy Novgorod", Russia is no where near Murmansk. LOL She claims to use an internet cafe so I don't know what the deal is.

    Thanks for the tips on letters! I'm off to read Nicks post that you linked.




  10. #39
    Join Date
    Oct 2005
    Posts
    15

    Default

    Thank you for the help. I just Googled "Russia, 184365" and came up with a city called Molochny which is where she claims to live although she put an "i" on the end of the name. And apparently it's close to Murmansk which she also claimed.

    The only problem is "Nizhniy Novgorod", Russia is no where near Murmansk. LOL She claims to use an internet cafe so I don't know what the deal is.

    Thanks for the tips on letters! I'm off to read Nicks post that you linked.




  11. #40
    Join Date
    Aug 2005
    Posts
    622

    Default

    sorry for late post but as rjg381 said i was away for a week. just got back.

    @rjg381, yes you are right. just did a trace and it comes same location you mention.

    map of russia: http://www.russiatrek.com/map.shtml

    look at this one. http://www.worldtimezone.com/time-russia1.htm

    novgorod is close to st petersburg.

    trace:

    NeoTrace Version 3.25 Trace Results
    Target: 212.67.4.53
    Date: 22/10/2005 (Saturday), 04:12:44
    Nodes: 2


    Node Data
    Node Net Reg IP Address Location Node Name
    1 - - 81.76.238.159 Leeds fcuk
    2 1 1 212.67.4.53 Nizhny Novgorod ipdl053.nis.nnov.su


    Packet Data
    Node High Low Avg Tot Lost
    1 0 0 0 1 0
    2 ---- ---- ---- 2 2


    Network Data
    Network id#: 1
    Kostina, 2, 11
    Nizhny Novgorod, Russia



    Registrant Data
    Registrant id#: 1
    See Registrant Pane for registrant contact information.

    by the way, rjg381, thanks for kind words about one of my posts. i do hope it helps people in not being scammed.



    to all russian scammers: i am somewhat of a bullshi*ter myself but i do like to listen to a professional. please carry on

 

 

Similar Threads

  1. Scam odds
    By Reactive in forum Scam or not?
    Replies: 0
    Last Post: 11-04-2004, 03:05 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
All times are GMT. The time now is 08:17 PM.