roommate scam?

[Unregistered]

Hello <deleted by poster>,
How you today ?hope fine! And I Guess you would like
to know a little about me.
Well I am …27 yr. old… from the United Kingdom .originally from Brazil. 've been living here with my grand mom for the past 7 years. I reliable and trustworthy about an average when it comes to cleanliness. I work in a computer firm here in London as a programmer FOR VAULT. We are into operations and IT consultation. I'm laid back with good sense of humor .Would appreciate if you can tell me more about you, so Feel free to add me up so that we can chat
and get to know ourselves .Here is my email address vickyjones27@yahoo.comJust want to let you know I got your email address from Easyroomate.com incase you wondering where I got it from.lol.

I would be coming to the states on Holiday and I would love to stay in
your
room when I come, I will be coming alone and I intend spending 6 months as I do not have much time since it's an holiday as I will be busy visiting the whole of California and the beaches around and outside California cos there no good ones here. Would use the opportunity to enroll for Tourism Developmental Program at San Diego state university. Would preferably go for a course on Recreation, park and tourism so I could get to know more about California and its environment.

Would like to know how much you charge per month including deposit...would appreciate if you can send a picture of the room also. And also the amount you are charging per month including deposit so that I can talk to my former Employer regarding the rent because they will be mailing the payment on my behalf.

‘ve attached my picture below so you could see what I look like


VAULT/OPERATION AND IT CONSULTATION.
VICTORIA JONES
35 ABBEVILLE RD
LONDON,
UNITED KINGDOM
SW4 9JN
mobile:+448715049911
:+447031925585
feel free to contact me here :vickyjones27@yahoo.com as I use the other email mostly when I'm home

Hope to hear from you soon,
With Love,
Vicky

[John Fairheart]

You are right to be suspicious.

However, if you post the original headers of the email we can make a much better analysis by trying to find out from where the email actually came from. I highly doubt it would have originated from her alleged location of United Kingdom.

The email text bears all the hallmarks of 'Lad Speak'.

Writer is a foreigner, living currently in another country but coming to 'your' country for an extended stay. This in itself could be plausable, but very unusual.

The next piece of evidence are the telephone and fax numbers given:

First, +448715049911 is a Freephone number on the Magrathea Telecommunications Limited network. A call made to this number would be redirected to (probably) a real mobile phone held by the individual concerned.

Now for +447031925585. This is known as a 'Follow Me' or 'Personal Number' once again on the Magrathea Telecommunications Limited network. As in the above example, the caller would be redirected to another phone, probably a mobile in the possession of the individual concerned. It is also mighty expensive to call if the person is somewhere in Africa, which is very common.

With these 3 pieces of evidence, I can say that I am 99% sure that the email is a scam.

Here is the other 1%...
I can talk to my former Employer regarding the rent because they will be mailing the payment on my behalf.
Typical overpayment scammer. Here you would be sent a cheque or money order in the post for more than you would be asking for. The payment is always to be sent by an associate, colleague, employer etc. You would be asked to cash the cheque and send the balance via Western Union (or similar) to someone else.

The cheque would be couterfeit, faked or just plain stolen. Once the bank discover it to be fraudulent, the bank would sieze the money back from your account, and probably report you to the Police for passing a fraudulent cheque. If you are in the USA, this would be 'uttering a forged instrument' and is a very serious offence.

So with that done, your answer is: YES, this letter is 100% scam.

[Unregistered]

I did a bit of digging, and I think you're right. However, here are the original headers for good measure:

X-Apparently-To: <deleted by poster>@yahoo.com via 209.191.84.234; Fri, 14 Apr 2006 17:23:40 -0700
X-Originating-IP: [64.136.28.164]
Return-Path: <vickyjones27@juno.com>
Authentication-Results: mta331.mail.mud.yahoo.com from=juno.com; domainkeys=neutral (no sig)
Received: from 64.136.28.164 (HELO outbound-mail.lax.untd.com) (64.136.28.164) by mta331.mail.mud.yahoo.com with SMTP; Fri, 14 Apr 2006 17:23:40 -0700
Received: from webmail44.lax.untd.com (webmail44.lax.untd.com [10.131.27.184]) by smtpout05.lax.untd.com with SMTP id AABCEARHVACE5M4A for <jacarterjr2003@yahoo.com> (sender <vickyjones27@juno.com>); Fri, 14 Apr 2006 17:23:15 -0700 (PST)
Received: (from vickyjones27@juno.com) by webmail44.lax.untd.com (jqueuemail) id LMX5VZK5; Fri, 14 Apr 2006 17:22:24 PDT
Received: from [80.89.177.69] by webmail44.lax.untd.com with HTTP: Sat, 15 Apr 2006 00:21:36 GMT
X-Originating-IP: [80.89.177.69]
Mime-Version: 1.0
From: "vickyjones27@juno.com" <vickyjones27@juno.com> Add to Address BookAdd to Address Book Add Mobile Alert
Date: Sat, 15 Apr 2006 00:21:36 GMT
To: <deleted by poster>@yahoo.com
Subject: Room for Rent
X-Mailer: Webmail Version 4.0
Content-Type: multipart/mixed;boundary="--__JWM__J058e.7a5fS.28d9M"
Message-Id: <20060414.172224.8674.944339@webmail44.lax.untd.com>
X-ContentStamp: 2:3:1773630846
X-MAIL-INFO: 023de15439799139095079b0a1a1593071f025150c8104a5008da920d5b1 b4356db5454d893095c155101410c94119518019909051a080a03dc484c5 60d1b9f4447499c58415fd854144a009e134ad64b98559e4909065e02054 7071e480e5748dadbde9742d6121
X-UNTD-OriginStamp: e42JhOsrDtVd6mdsttseI3bwt50C26dpjslNQ/Ot44F/NrZqDRmPUw==
X-UNTD-Peer-Info: 10.131.27.184|webmail44.lax.untd.com|webmail44.lax.untd.com| vickyjones27@juno.com
Content-Length: 31074

[FW Admin]

Thanks for the header information. From this, we get the location from where the email was originally sent:

Whois Record
inetnum: 80.89.176.0 - 80.89.191.255
netname: LB-COBRANET-20050530
descr: Cobranet Limited
country: LB
org: ORG-CL34-RIPE
admin-c: ED758-RIPE
tech-c: ED758-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: COB-MNT
mnt-routes: COB-MNT
source: RIPE # Filtered

organisation: ORG-CL34-RIPE
org-name: Cobranet Limited
org-type: LIR
address: Cobranet Limited
Dima Saleh
Network Administrator
BASHA GARDENS BLDG JISR EL BASHA
BEIRUT BEIRUT
LEBANON
phone: +961 1 512 513
fax-no: +961 1 486 568
admin-c: DSA1978
admin-c: BT68-RIPE
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: IDM-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered
person: Elie Dib
address: rafiu babatunde street plot 8, Lekki Phase 1, Lagos, Nigeria
nic-hdl: ED758-RIPE
source: RIPE # Filtered In addition, the postal address given for this "Vault" company is, in fact, a restaurant. The postcode given is incorrect for that address.

A definite 100% fraud.

[John Fairheart]

Excellent, thanks for the header and to FW Admin for beating me to the analysis :D . As you can see, the email has not come from the UK, but from downtown Lagos in Nigeria via a Lebanese service provider.