Russian girls
Lately there’s been an influx of comment spam from Russian girls seeking to date men from other countries. They often complain of not having a credit card, and thus not being able to use a dating site.
I often receive several copies of the same spam, and there are new variations daily. Normally there’s no link, just an e-mail address. And lately that e-mail address has even been munged to avoid being harvested by spambots.
Although there are lots of Russian girls seeking to meet foreign men, you’re more likely to get scammed if you get involved with one of these.
You see, there’s a subculture where men (yes, men) pretend to be Russian women seeking men. They chat up anyone who responds, and after a while announce that they want to visit the man. Problem is, they don’t have enough money for the ticket. So if the man could please send them enough money for the ticket? Or part of the cost.
It’s a scam. Pure and simple. The same type of scam even hit the front pages of Norwegian tabloids, when a Danish magazine investigated a Norwegian scammer who took Danish men for a ride - the exact same scam. The same picture, with different names and locations, had been placed on a dating service, and the respondents were men. Yup, it happens.
I first saw this scam in operation when I saw spam addressed to a defunct address coming through my mail server at work. A girl who said she’d noticed this gentleman online, and was bold enough to e-mail him. I realized this had to be fake. That it HAD to be spam, and checked to see what the scam might be. The news is, that now the scammers are moving from e-mail to blogspam. And this is not traditional webspam. It’s aimed at the owners of the blogs, and the visitors of the blog.
So guys, PLEASE delete those messages from your blog, and please don’t fall for the scam!
I was looking for links explaining the scam. Not that easy to find. These seemed relatively clean: Delphi FAQs: Dating Scams , Russian Women Black List. Update: Found this link: Russian Tea Room (thanks Dave, for the link)
And now for the technical stuff. I’ll tackle some of the many spams I’ve received, and see what I can glean from the technical end.
The first spams I received were the work of a Russian speaking hacker gang. The same gang who offered mail lists they stole from dating sites. And they’ve offered their services for spamming forums etc. It’s their MO, and it was so unique in the beginning, there was just no doubt it was them. I’m guessing they spam for themselves as well as customers. And who knows if the dating spam is for them or customers. No way to know right now.
Back then, and even today, the comments always have the same user agent, and it’s a bot - not a person browsing:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
The IP addresses are from all over. Italy, France, USA, Ukraine, Russia.
The first few messages related to this scam, were a few comments with women saying they were photo models (around June 17), with links to websites. I’m guessing that didn’t bring the desired results, so the next permutation was an invitation to a Russian dating site (June 23). Same site, different subdomain (free website service, both pages are now gone). The first message directly from an alleged Russian woman that I noticed, was July 11.
Their favorite posting place is this post (it’s currently the estimated most spammed post on my site) :
August 4th, 2006 at 11:46 am
We’ve been getting a ton of these on the Screamer forums over the past few weeks. Alas they don’t last long as I monitor it pretty much 24/7, so any that do get posted, are generally deleted within seconds ….
August 4th, 2006 at 2:11 pm
Remember …. there’s only enought fluid pressure present in a male to run one thinking aparatus at a time
……… Sorry to say this, being male and all, but it’s true. So long as males think they can chase … they’ll chase …errrr, ehem …. the things that are available to chase.
August 4th, 2006 at 4:06 pm
Not-not,
there’s some grain of truth in what you say: A male may gets easily manipulated if he’s deprived of something the female (in this case the scammer) appears to offer. Just by ratio you shouldn’t fall for it but then again if someone wants to dream of life, the scammer will be part of the play (at least as long as the money lasts).
PS: I liked your explanations in the other thread about vulnerable scripts and php configurations. I’ve already seen web spam pointing to doorway pages that were obviously uploaded via an exploit and the site owners may not be aware about the problem.
August 9th, 2006 at 7:14 am
A few months ago, Russian bride spam was quite common on match.com. Russian brides would sign up for the free three-day trial, and send out as many form letters as possible to male match.com users. Most had instructions to write back at a Yahoo or mail/rambler.ru address.
Most match.com Russian bride spammers claim to live in small American towns, apparently to make their profiles seem more believable. The mangled English with a thick Russian patois gives it away, though. “I much very like you structure …”
Match seems to have the Russian brides under control now; not completely, but still, they seem to be working on addressing the problem.
August 10th, 2006 at 10:36 am
Uhhh … my comment is still awaiting moderation. I hope including something in the “Website” field didn’t render it as spam.
August 26th, 2006 at 11:57 pm
Some time scame became less. Now became women which less swindle. There were companies which are called as marriage agencies.
Which show very much greater activity in promotion spam-scam.
It is better to men to not use free sites. In paid agencies of the girl basically with the passport. And such agencies very quickly react to complaints of men to the certain girl.
And the most important to have sensible mind, and at the best to organize a trip to the girl.
If at you ???????? statistics IP, it is possible to transfer it in department K. Department K is organized in Russia for struggle against criminality on the Internet.
The last month the agency of swindlers in Ioshkar-Ola has been opened.
I apologize for bad English, only I study:)
October 4th, 2007 at 4:01 pm
recently joined match.com and with a couple of weeks received an email from a Russian girl who states she still lives in Russia and is working on a Visa to come to the U.S. to work for 3 months. When I asked what city she was planning to vist it got really interesting. She stated whatever city I lived in she could fly into that airport and I could pick her up. So far I am still trying to get details on exactly what she expects from me and that it is rather strange that a female would fly across the world to meet a complete stranger and expect that stranger to get them a job…….pls email me if similar stories are popping up on match.com
June 9th, 2008 at 3:48 am
Yah very true. There are Tatyanas, Marie’s and et al from whom i and many frineds of mine get mails. it starts with simillar message and a few pictures.The second mail comes with slightly revealing pics of woman not realy matching ith previous mails. and when we reply that we are indians, al of a sudden it stops forever. Not only Russians, many from the African countires whose names not frequently heard for any good reason do caome on mail. They say that there is huge some of money in some non-descript bank left behind their father, usually killed in civil wars. And some banks ph.no and sometimes even account number. Christ I am tired of these and feel nauseating when such mails land in my inbox. Unfortunatley there is no measure to stop except to block the Id’s or delete without opening the mails.
August 8th, 2008 at 7:34 am
“Hi my new friend! My name is Olga. To me of 27 years. I saw your questionnaire, and you have liked me. I would like, will get acquainted with you more close. I wish serious relations with you and love to grow. And if I too was pleasant to you also you would like to communicate to me that I leave the e-mail address.Olenka-Lubimaya@yandex.ru. I will be glad if you answer me. your new girlfriend Olga.”
I received this on Dating Direct, and is typical of the 2/3 spam mails I receive daily, obviously the website monitors don’t appear to take this problem very seriously as I’ve never seen an acknowledgement that it is being looked into once reported, or a confirmation that action has been taken.
But in any case… do people actually fall for this sort of tripe? Surely not.