nikorose@redgradd.com

[firefly]

Hello how are you? you probably don't remember me, but we talked on social networks for a long time, and you left me your address. my name is Nicoleta , i'm from ukraine. as you heard, there is fighting going on in our country right now. I am very lonely, and I saw your address, I decided to write to you. I hope you don't mind our communication? I want a serious relationship. remind me what country and city you are from.I will be glad to communicate with you again. perhaps we have a future, unless of course you are against Ukrainian girls.write to me, I'll be waiting. Nicoleta

Header:

Received: from baymoon.com (baymoon.com. [63.249.82.5])
Date: Tue, 17 Oct 2023 03:48:16 -0700 (PDT)
Message-Id: <202310171048.39HAmGw0096921@baymoon.com>
Subject: hey
From: nikorose <nikorose@redgradd.com>
Reply-To: nikorose@redgradd.com

Originating IP: 63.249.82.5
Originating ISP: Czio-asn
City: Santa Cruz
Country of Origin: United States

Stolen picture received with the message:



Gallery: https://scamsurvivors.com/piwigo/index. ... egory/3930

Note: redgradd.com is a fraudulent domain name registered in May and updated in September, used only for sending similar messages as the one posted above.

[Pandazombie]

Hello how are you? you probably don't remember me, but we talked on social networks for a long time, and you left me your address. my name is Nicoleta , i'm from ukraine. as you heard, there is fighting going on in our country right now. I am very lonely, and I saw your address, I decided to write to you. I hope you don't mind our communication? I want a serious relationship. remind me what country and city you are from. I will be glad to communicate with you again. perhaps we have a future, unless of course you are against Ukrainian girls. write to me, I'll be waiting. Nicoleta P.S I'm hope you like my photo

Header:

from: nikorose <nikorose@redgradd.com> via patient-docs.com
date: Nov 3, 2023, 10:04 PM
subject: hey
mailed-by: patient-docs.com



ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of admin@patient-docs.com designates 138.68.102.158 as permitted sender) smtp.mailfrom=admin@patient-docs.com;
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redgradd.com
Return-Path: <admin@patient-docs.com>
Received: from patient-docs.com (patient-docs.com. [138.68.102.158])
by mx.google.com with ESMTPS id 30-20020a508e5e000000b0053e30efb4e8si1447171edx.62.2023.11.03.19.04.28
for <>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Fri, 03 Nov 2023 19:04:28 -0700 (PDT)
Received-SPF: pass (google.com: domain of admin@patient-docs.com designates 138.68.102.158 as permitted sender) client-ip=138.68.102.158;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of admin@patient-docs.com designates 138.68.102.158 as permitted sender) smtp.mailfrom=admin@patient-docs.com;
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redgradd.com
Received: from admin by patient-docs.com with local (Exim 4.93) (envelope-from <admin@patient-docs.com>) id 1qz61T-0005O8-OG for; Sat, 04 Nov 2023 04:04:27 +0200

[Big Al]

Thank you for the additional information.

You should stop all contact with the scammer.
Do not tell them you know they are a scammer.
Then be careful of any new contact from anyone you do not know.