confusing email header location? Scammer?

Post your questions about tracing the source IP address of an email here.
Locked
hyrokungen
New Member
Posts: 1
Joined: Fri Aug 04, 2017 4:26 pm

confusing email header location? Scammer?

Post by hyrokungen » Fri Aug 04, 2017 5:15 pm

Hi!

I'm a little confused over an email conversation I've had for a few days now.
I met a woman on a swedish dating site and she wanted me to email her. She says she's from Nizjnekamsk, Russia.
But I looked up her first email on a trace email site and it told me that the senders IP comes from Kassel, Germany. I kept on conversating with her and a few emails later the location of the email header IP changed to Hudiksvall, Sweden.
You can look up this for yourself, I'll paste the first email header and the other email header when the location changed.
Should I worry about this? Is she a russian scammer??

I even looked up the exact location of the IP address. The german one comes from Auedamm 48 in Kassel. That is an address of a chinese restaurant and a minigolf club.
The second email headers IP comes from Humlegatan 39 in Hudiksvall. Address of a ordinary family living in a ordinary house.

Delivered-To: {removed}@example.com
Received: by 10.140.101.131 with SMTP id u3csp2058767qge;
Thu, 27 Jul 2017 07:41:25 -0700 (PDT)
X-Received: by 10.223.176.57 with SMTP id f54mr489581wra.194.1501166485365;
Thu, 27 Jul 2017 07:41:25 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1501166485; cv=none;
d=google.com; s=arc-20160816;
b=dpM3jIjzhI2TnJU6vlS1R1g59YX2Aijl4pPQEFu5H4nE2mD5lLXtOr7sn8aoZOj8KX
2Rl0By1/tpbQt76HuNxelAh+a+XIjv6Dj4rvPrA7ud6dAGpYJM6AWRdjuPRRb+bAgBQu
kW/my8b+yH3lJ10qiXYrugHyre3nUmh8V2cfWh9wk54xOb2Oa/vD/1OLXgoc/ObcsJjM
nTnCrMxv1+DEaEptxem9jeFE4/s73A+lvxY2qEq8I4dnp8OXzFWIWKU5XcZAu8PmjZdM
9qcQzD3hLO6XmhYpHBQeztZPZVXRvqOx62uSfnqlOBWbKQTp8AILZjJVWt9CZdD5Hb7M
oqQg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=mime-version:references:in-reply-to:subject:to:message-id
:organization:from:date:dkim-signature:arc-authentication-results;
bh=0JnN01zbBg01uj+BLW+8uViObPxaxosa36SNwBBa3HE=;
b=ArCB/n6pZT98NxP0wR5pvUCVKsGrf15BLszF2jEVuan+pecZJVaCutW24VCpMORpbQ
R+gnQuvCWU0xQAEmhkmpjtUYIB4deGii9WysW2HPdw3oI3P9CES0JrXe+XJNHUfKDa7u
1AHX6wsLos5s6ee+s+gEIQPRv21KBiwO9OHSVrymCHkI/1DSsIN5xwiV5TurjP9zp8bT
YB0w2RLeEbHEjuIa3hKIgy9T0EsqLyT35GgLz4xkzQu2mCojKYU6csXzMjhDl8+ojnxU
7n7Vi/RcrwO4p9TeK3/cWy76XeQNCF1yUbKuoYN52WWUpG6Zkhk3LY2mhqH5RgmvazTB
/5oQ==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass [email protected] header.b=bnklofIE;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:400c:c0c::242 as permitted sender) smtp.mailfrom=[email protected];
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gmail.com
Return-Path: <[email protected]>
Received: from mail-wr0-x242.google.com (mail-wr0-x242.google.com. [2a00:1450:400c:c0c::242])
by mx.google.com with ESMTPS id l33si19225444wrl.217.2017.07.27.07.41.25
for <{removed}@example.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 27 Jul 2017 07:41:25 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a00:1450:400c:c0c::242 as permitted sender) client-ip=2a00:1450:400c:c0c::242;
Authentication-Results: mx.google.com;
dkim=pass [email protected] header.b=bnklofIE;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:400c:c0c::242 as permitted sender) smtp.mailfrom=[email protected];
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gmail.com
Received: by mail-wr0-x242.google.com with SMTP id 12so15609161wrb.4
for <{removed}@example.com>; Thu, 27 Jul 2017 07:41:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=date:from:organization:message-id:to:subject:in-reply-to:references
:mime-version;
bh=0JnN01zbBg01uj+BLW+8uViObPxaxosa36SNwBBa3HE=;
b=bnklofIE/XGTx64ECy8H2fzvdeHJBj4TtZ1ZYWyZcv7rUFOVmji5NOJiAdlrc33X0U
ryu8Hcmlt1Hnr1dxbYk9iSL8Vr52XHA/rpaVFipamibmdZU+gP66/7whl0Pbu70XgUFt
hTB4yfZn7yE4Vl8nXEyxaHs16rlgZ7UhyaA1KQAaoqvrfBu/JvgG61vdvxArJ+HfMLVm
AO5Yg+Ih8eSvXU8c9Ot/WkrLTL4pXfoztSsEt6x+QONwzb7/aD4dd/sRe4hmrQPYc6pn
13kXZC+SwAXQLqVge7znjvs3RA6g/u2D6pBA7Z0XSvylIAn87YLiEOI5/cp+n+KVESs1
CXjg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:date:from:organization:message-id:to:subject
:in-reply-to:references:mime-version;
bh=0JnN01zbBg01uj+BLW+8uViObPxaxosa36SNwBBa3HE=;
b=kwiR/Tu8Op6GsvvZ8u5xAO3NFXWrYbBFazDu+Vsq+SWvO9ouowanD08MmPGc4ulMV7
YeW/5P+63dxVvQFb8Admehr8W5UAu4XRu2XGsSB9/pwfdsU5t4VuMD5HyFx5EHXwetke
b3oDxFlDRT0sWehrUSl43QCqddXDO8Dy9ojUvfrYiqrwG0AQRXTmz3r3igUd1Snk8cl4
8EsYULL5ZPGh/A+JnH5kuaCXAlV4O2/0l+60auDwXWdyi9VGWO7cSzQthocw0k8BTMhl
9avIGL8PwzdIvb/Ep+7naSpZTml2Zl8cLB58mEl0Pt1rI5BP3ZS1ZWQZYIyygg55qGdP
1QUw==
X-Gm-Message-State: AIVw113gm9ZwIIBKfSHrkd/guPh3uB2WDQ+NNE3pe73X/91mzOjnWAqI LeZs2Et8+zU4wBdV
X-Received: by 10.223.167.73 with SMTP id e9mr3643814wrd.205.1501166484582;
Thu, 27 Jul 2017 07:41:24 -0700 (PDT)
Return-Path: <[email protected]>
Received: from [192.168.137.21] ([37.58.59.21])
by smtp.gmail.com with ESMTPSA id i67sm20157765wri.61.2017.07.27.07.41.18
for <{removed}@example.com>
(version=TLS1_1 cipher=AES128-SHA bits=128/128);
Thu, 27 Jul 2017 07:41:24 -0700 (PDT)
Date: Thu, 27 Jul 2017 16:35:50 +0200
From: [email protected]
Organization: [email protected]
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: Removed Example <{removed}@example.com>
Subject: Hej))
In-Reply-To: <[email protected]om>
References: <[email protected]om>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------11206315D2E4C783C"

------------11206315D2E4C783C
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head><title>Hej))</title>
</head>
<body bgcolor =3D >
<span style=3D" font-family:'Courier New'; font-size: 9pt;">Hej<br>
Jag &#228;r v&#228;ldigt glad att du skrev till mig, och det vill jag svara=
dig. Men f&#246;rst vill jag ber&#228;tta om mig sj&#228;lv s&#229; kan du=
f&#229; lite b&#228;ttre vet jag och jag hoppas ocks&#229; att du kommer a=
tt ber&#228;tta lite om dig sj&#228;lv s&#229; att vi b&#228;ttre l&#228;ra=
k&#228;nna varandra. Jag tror att det f&#246;r oss starkt kommer att bidra=
till att komma n&#228;rmare v&#229;r dr&#246;m och vi kommer att hitta ett=
gemensamt spr&#229;k. Jag s&#246;ker n&#229;gon f&#246;r ett seri&#246;st =
f&#246;rh&#229;llande f&#246;r att vara med honom och leva resten av mitt l=
iv.<br>
Jag bor i Ryssland &#228;r det mycket l&#229;ngt fr&#229;n ditt hus, och j=
ag vet inte om du n&#229;gonsin i Ryssland. Min stad som heter Nizjnekamsk.=
Det &#228;r en vacker stad och jag &#228;lskar det h&#228;r med att leva. =
Nu &#228;r jag 32 &#229;r gammal och jag har fortfarande inte hittat din pa=
rtner. Jag romantisk man, och trots att alla s&#228;ger att k&#228;rlek vid=
f&#246;rsta &#246;gonkastet inte finns, jag tror det. Jag vill hitta denna=
person, s&#229; n&#228;r jag hittade honom visste jag direkt att detta ver=
kligen &#228;r den jag alltid letat efter. Jag &#228;r glad och n&#228;stan=
alltid glad, jag gillar att k&#228;nna en k&#228;nsla av f&#246;rtroende. =
Jag &#228;r glad n&#228;r jag efter min axel &#228;r sj&#228;lvs&#228;ker, =
stark man, vem som helst kan st&#229; upp f&#246;r sig sj&#228;lv och f&#24=
6;r sin &#228;lskade kvinna.<br>
Om du visste att den sista tiden ryska m&#228;n mycket kallt behandla kvinn=
or. De &#228;r mycket roligare att dricka alkohol eller att sitta med v&#22=
8;nner. Jag har aldrig varit gift, men hade jag tr&#228;ffat ett par g&#229=
;nger och kan bara s&#228;ga att efter n&#229;gra datum de har f&#246;rlora=
t allt intresse. Ber&#228;tta f&#246;r mina enda v&#228;nner. Ryska m&#228;=
n f&#246;rs&#228;mras, de &#228;r mer intresserade av alkohol, inte vackra =
ryska kvinnor och det &#228;r verkligen bums ut mig.<br>
Men &#228;nd&#229; f&#246;r mig att det &#228;r s&#229;dan sp&#228;nning o=
ch mystik. Jag &#228;r mycket r&#228;dd f&#246;r att g&#246;ra misstag och =
bli besviken.<br>
Jag vill bara vara lycklig och &#228;lskad f&#246;r den h&#228;r mannen att=
jag &#228;r redo att g&#229; p&#229; alla. Jag kommer att bryr sig om och =
respekterar honom. <br>
Jag vet att jag ocks&#229; &#228;lskar fitness. Jag har alltid g&#229; till=
gymmet tre g&#229;nger i veckan. Jag f&#246;rs&#246;ker att se efter sig s=
j&#228;lva och sitt utseende, eftersom det &#228;r mycket viktigt f&#246;r =
varje kvinna. Jag &#228;lskar ocks&#229; att vara ensam med naturen. Jag &#=
228;lskar att g&#229; p&#229; kv&#228;llen runt staden. V&#229;rt land &#22=
8;r mycket vacker, vi har en mycket rik natur och m&#229;nga sj&#246;ar och=
floder. Jag &#228;lskar att titta ut genom f&#246;nstret p&#229; den vackr=
a solnedg&#229;ngen.<br>
<br>
om du vill l&#228;ra k&#228;nna mig n&#228;rmare, du har att s&#228;ga och=
jag ska ber&#228;tta f&#246;r dig. I n&#228;sta brev f&#246;rs&#246;k att =
ber&#228;tta om sig sj&#228;lva och sina klasser. Om du kan skicka mig g&#2=
28;rna din bild.<br>
S&#229; jag skicka dig n&#229;gra bilder. <br>
<br>
Jag ser fram emot din n&#228;sta bokstav Kseniya !!!</body></html>
------------11206315D2E4C783C
Content-Type: image/jpeg; name="A18ckOBeRb0.jpg"
Content-transfer-encoding: base64
Content-Disposition: attachment; filename="A18ckOBeRb0.jpg"


------------11206315D2E4C783C
Content-Type: image/jpeg; name="X7xxa088di0.jpg"
Content-transfer-encoding: base64
Content-Disposition: attachment; filename="X7xxa088di0.jpg"


------------11206315D2E4C783C--



The second Email header with Hudiksvall as location:

Delivered-To: {removed}@example.com
Received: by 10.140.101.131 with SMTP id u3csp816106qge;
Thu, 3 Aug 2017 07:05:58 -0700 (PDT)
X-Received: by 10.25.25.197 with SMTP id 188mr693609lfz.93.1501769158733;
Thu, 03 Aug 2017 07:05:58 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1501769158; cv=none;
d=google.com; s=arc-20160816;
b=xib55Jt97EMAF/FVhhMh2oSmrMH2YPz8w5IwHbLmr5INjeEtoZapsBP+Hfy3KGOLun
l8Jussga3/zVtNTDO6w6i10FgFlDhKD5yKQd4IEZxfI+G6w5I3C9zFZcZBr7zQakAO4W
ChQGDYS+H1jwoO/nu5CVJS57OaNACkZDZSL0RtFsp47urZtD1NxgzTJg5SHKdUVAaPeV
QwEGGEdOWJX09cyzWCxp1mgkjGpzPiX5cMEQnDcupfUdI2PoJ1aJksBmgwJUL7cQ7N2d
f7TcEBmkPe4ZMHVw7hwOsy/IJ3g6FVCCoYieBh9aCkpZVyC4vKYlTP17EtC++2PJjsll
MSkA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=mime-version:references:in-reply-to:subject:to:message-id
:organization:from:date:dkim-signature:arc-authentication-results;
bh=WpIXSlLkTz8ot+s18Mz2oyvcH7G2XDRK1g8M+Wa7Sms=;
b=1Do8Hodng+jayUh4I/+we6PHgwW4rgdOrjzg6dYdKby7g9ra7npR2N6OIKZeaJuGeq
vrTqK29o5xy6JUgrIjOSS+Sey1q/56Nop9rufZYvsWDGLXR3+B8WzrVZ2vRbsrQ39Vi1
oQ3rBaNeqcTO5AqKb8IXVMC+TnzwhpGV0vm9n8V4QSAQCiyMoaHyUCKPPATnkNxj9rZa
+GraFUWLsJQPB8U7JfOC5OcW9JgIWb7FXhhmS9svpnXSbZ1YWGRK96mB+biNRjPtW71I
OtDjW4Dxbrf0MBkh01GY84996F+uSbKypd9YDeNfK924TkwBvkkI9wRxc5Tibpmgy81q
z+vw==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass [email protected] header.b=MWuQ0rlH;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:4010:c07::241 as permitted sender) smtp.mailfrom=[email protected];
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gmail.com
Return-Path: <[email protected]>
Received: from mail-lf0-x241.google.com (mail-lf0-x241.google.com. [2a00:1450:4010:c07::241])
by mx.google.com with ESMTPS id r14si870456ljd.471.2017.08.03.07.05.58
for <{removed}@example.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 03 Aug 2017 07:05:58 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a00:1450:4010:c07::241 as permitted sender) client-ip=2a00:1450:4010:c07::241;
Authentication-Results: mx.google.com;
dkim=pass [email protected] header.b=MWuQ0rlH;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:4010:c07::241 as permitted sender) smtp.mailfrom=[email protected];
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gmail.com
Received: by mail-lf0-x241.google.com with SMTP id y15so937628lfd.5
for <{removed}@example.com>; Thu, 03 Aug 2017 07:05:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=date:from:organization:message-id:to:subject:in-reply-to:references
:mime-version;
bh=WpIXSlLkTz8ot+s18Mz2oyvcH7G2XDRK1g8M+Wa7Sms=;
b=MWuQ0rlHS/TK0bl36YxKkGH6sHLWe42sBMgPZca4x7Hhk5O+G97glHqNwzpOboaSOV
/VQtfEkfWNiQGi9sHgh8MwFkSgv8xLCT9FXHsfDQhwFY7c1dl/aQBzm4bIEv4TzMx3gt
xUdjxtTxtWmp6bm4Oir77YPMxLq4HrAk/QKeqaDukhPb2cileCxp5lOn4e6SF8KFv7lb
oIz3dNR8GDmnmmvvO8GuPB40NeM74Jpm1s+kKfdAzE4Q6yuo9GV0hA95F1X7awqP8ML+
YJb4PTpK5Ddeso0KGQOkVEMVugPQ6MueYUP8coCp+ZpUKq3HTsBJeaJP1LtdNL7MSPkj
U0Sw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:date:from:organization:message-id:to:subject
:in-reply-to:references:mime-version;
bh=WpIXSlLkTz8ot+s18Mz2oyvcH7G2XDRK1g8M+Wa7Sms=;
b=hyUlnWu41PuIlnh5RRjeCfhzJO31C4KjFhuscqGWsX6+SrXargh6fFHNW12dGVqMVo
57NTfKgiws6CaU/4LlCdNWLHOhbvfRh5r63nWzWrqUwu9AQ7IrRkoh3rDbblIhxSYvdQ
9yPJR1CxuuWtq0daNhyltxVgM5mNQ2sYMCGsj2cyTggzZUjZ0hHk3uz/i1e0D7PCR8Kl
eXKJ1JRTgI0j5ju1yzRfvIe5D6dmEt3f90EiQv/y+a1C6KloHwlbWY1LxqLVGzxCUhFH
UKpYaB7a6gwnZ8Bc84ShOWi0KuS85lB6A5dZR7yX2hwzDU5Y27KyHLra7ynnr/wLVVX+
3Jdg==
X-Gm-Message-State: AIVw110rtyuhjpYLVjp+qf93TIch3gwGpvPQnkSOsq4Ae+ovVL/cbIc6 EVt97iGUvedZcgTW
X-Received: by 10.46.21.72 with SMTP id 8mr785606ljv.115.1501769157803;
Thu, 03 Aug 2017 07:05:57 -0700 (PDT)
Return-Path: <[email protected]>
Received: from ?.? ([95.143.193.61])
by smtp.gmail.com with ESMTPSA id g19sm1621328lfg.63.2017.08.03.07.05.52
for <{removed}@example.com>
(version=TLS1_1 cipher=AES128-SHA bits=128/128);
Thu, 03 Aug 2017 07:05:56 -0700 (PDT)
Date: Thu, 3 Aug 2017 16:05:46 +0200
From: [email protected]
Organization: [email protected]
X-Priority: 3 (Normal)
Message-ID: <66184[email protected]>
To: Removed Example <{removed}@example.com>
Subject: Hello
In-Reply-To: <[email protected]om>
References: <[email protected]om>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------0D612E0143A7C2D59"

------------0D612E0143A7C2D59
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi dear!!!!!! I'm so happy again to receive from you the letter.Last
night when I went to bed, I thought about you and when I fell asleep I
had a dream. In the dream, we walked together, hand in hand, along the
ocean shore. And the ocean, playful as a kitten, licking our tracks
from the wet sand. Milky pink dawn was just born in the cloudless sky,
spraying waves with its Golden sparkle, light breeze plays with our
hair. Yes, of course I saw the video yesterday, which you I send. I
also liked your photo which you send me. Very sorry that you lost your
phone. Yes, of course we could in the future speak on the phone. I
prefer to write via mail. Because to write in "SMS", then too it is
not profitable in our country. I'm really glad that we met. Before our
acquaintance my life was boring and meaningless after all my failures.
And I thought that I will never be able to believe the man. However,
as communication with you I start to slowly change their minds. I
don't know why, but I like a little hang on your every word. Perhaps
for the time when I was alone, I was able to wean from it all. Don't
know, I still haven't figured out in my mind. But I'm glad we know
each other. I'm sorry that I can't take you today to write but I'm
very tired at work. I'll wait for your next letter! I really hope
you'll like my photos.
Yours Kseniya
------------0D612E0143A7C2D59
Content-Type: image/jpeg; name="43294HGf.jpg"
Content-transfer-encoding: base64
Content-Disposition: attachment; filename="43294HGf.jpg"


------------0D612E0143A7C2D59
Content-Type: image/jpeg; name="f8HD7fd.jpg"
Content-transfer-encoding: base64
Content-Disposition: attachment; filename="f8HD7fd.jpg"


------------0D612E0143A7C2D59
Content-Type: image/jpeg; name="H7f4FHF4G.jpg"
Content-transfer-encoding: base64
Content-Disposition: attachment; filename="H7f4FHF4G.jpg"


------------0D612E0143A7C2D59--



Thanks for your help.
Regards DJ

User avatar
Chrispcritters
Forum Administrator
Posts: 2536
Joined: Tue Mar 02, 2010 5:41 pm
Location: 127.0.0.1 | ::1
Contact:

Re: confusing email header location? Scammer?

Post by Chrispcritters » Sat Aug 05, 2017 9:16 am

It's actually unusual for gmail to include the sender's IP address in the headers.

Couple of things about those IP addresses:
* While the evidence is pretty minimal I suspect those IP addresses are VPNs or proxy servers. So they likely do not represent where the actual emailer is from.
* IP Geolocation doesn't give you an exact address so to assume it's a specific house or a particular business is in error.

Based on the content of the email you included above and that you've only been emailing for a few days I think it's the beginning of romance scam.

You could also try some of the tip on the How to get someone's IP address page and see if you get some additional IP addresses in future correspondence.
Founder & CEO of WhatIsMyIPAddress.com.
You can follow me on Twitter and Facebook for some behind the scenes info.

Jasmine38
New Member
Posts: 2
Joined: Sat Aug 12, 2017 4:06 am

Re: confusing email header location? Scammer?

Post by Jasmine38 » Sat Aug 12, 2017 9:08 pm

Yes, I agree, is too poetic this E-mail... For sure is a scam ! A real person will talk more and open about her/himself. If you meet this poetic E-mails, they are just to let you relax reading their "mind" or what they "dreaming", but isn't true ! If you try to appear professional in IT, and scare her a little bit ( possible be a man who wrote also ! ) you will see reactions . Or try to ask details about her as phone number, real name , anything that is real and not story.
And also when you get E-mails from gmail, ask the person to use other E-mail, as yahoo , which is more easy I guess to be located. But for your safety and good, stop all your conversations here or scare her or say anything that would make her angry about her proposal and see reactions. A scammer do not like someone else appear more intelligent than him/her !

Locked

Who is online

Users browsing this forum: No registered users and 5 guests