

It’s financial fraud with a romance hook. It’s like nigerian prince scams, except instead of some rich prince who will pay you back many times over, the motivation is helping your long distance lover with some big financial problem that came up.
It’s not just referring to people getting catfished (it’s possible the other person is even real, because it’s a lot more effective when they can do video chats and video chat sex… And it might even involve human trafficking and/or slavery and that woman’s whole “job” is to have video chat sex with targets).
That said, I think those are all just excuses, valid threats or not.



An alternative that will avoid the user agent trick is to curl | cat, which just prints the result of the first command to the console. curl >> filename.sh will write it to a script file that you can review and then mark executable and run if you deem it safe, which is safer than doing a curl | cat followed by a curl | bash (because it’s still possible for the 2nd curl to return a different set of commands).
You can control the user agent with curl and spoof a browser’s user agent for one fetch, then a second fetch using the normal curl user agent and compare the results to detect malicious urls in an automated way.
A command line analyzer tool would be nice for people who aren’t as familiar with the commands (and to defeat obfuscation) and arguments, though I believe the problem is NP, so it won’t likely ever be completely foolproof. Though maybe it can be if it is run in a sandbox to see what it does instead of just analyzed.