Allen Andrew - allenhallblack1983@gmail.com

[ashelleh]

Any possibility you can post an E-mail header from the message?
It will help us kill the website being used to commit fraud.

How to get the header varies from E-mail provider to E-mail provider.
You might Google how to get it from yours.
Be sure to remove your name and E-mail address from it.

Here is the header from the message from above:

[ashelleh]

Here is the header:

[Big Al]

We actually need the huge batch of text below that.
Please copy and paste the text rather than just do a screenshot of it.

I removed your E-mail address from the image you posted.

[ashelleh]

Received: by 2002:a0c:f30e:0:b0:63c:cd1b:fffa with SMTP id j14csp329067qvl;
Thu, 17 Aug 2023 07:28:11 -0700 (PDT)
X-Google-Smtp-Source: AGHT+IHPWdlvX1X/13mKbr33ZI0lPtLzTFRKs6RI+242Si0a2hfpxhQTshqp8bZWxPzB6WjExmZ1
X-Received: by 2002:a0c:f552:0:b0:641:8bf9:e0ec with SMTP id p18-20020a0cf552000000b006418bf9e0ecmr4790017qvm.0.1692282491521;
Thu, 17 Aug 2023 07:28:11 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1692282491; cv=none;
d=google.com; s=arc-20160816;
b=QLO4lV7SocAU/4TwwRPJzsAEZw0yEnerao2wVWdaCU+YvLjart7EgEj3DsK/0yyxhI
GXJSyED7qjt2R1QILCDQzP+rbj517bFsWclmebOz/Op5ATfp+wmHYYOwlMgFK0WYQJ8Y
TYOwoE5lS+A81Lf+wSu3QD7dP49rawN2gCoxQRw09RXowABR/Nraj069izgzyM/LAjUO
rSymNNHaX3NfHbFKddkwJffP5cc9qElSg75chpWfju459G6bB8Ewk83q2Iv5AqcwVYW7
//tjAyULVlBZmPuL/K3YXYhLgcpZWwx5aGwGroUWA3NFgGukmxkDmScTX/Z+1SbPV0E3
LjAw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:message-id:user-agent:subject:to:from
:date:mime-version:dkim-signature;
bh=pc0XK9vCcetmbPt9gJGQZPt1zIS9zd6KGCUoIcQqt1g=;
fh=4iUCvHLcb1l8yLG8IywJNB/eIXE63Tpo3J5hNEoyR74=;
b=XMewMD9dWWTYsDsJOZAJCZ61+ai9tDLeUt0nMkHBwxH9MB4oGkEfR4J64HQzKIvRnw
H0UwzwEBRla+FWot4NYYsXEw0owGEkMNoWLsNStCtQHDAOi1YG0S7qqoSiVp3vzRAmYa
KjzdBkuFN33wGb/AvfspsfyPpU/cGHbAl5BNj93O8k/jg5x27m6zGwCQVT7+/rVrmeZV
j+4vwe6qD13rfdz/klWbgQTABEMEQaLo8MLDc5CqYZIymBxVuLEgkGMcvqAAB30PXBJP
v+D1v2/my8obPlGpzqB1ZAu+JSDLZx8V9WUIKEwozbHKRvQJtWW31QWhosn/bmF9Hyhq
f3dA==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@bluestarcolog.com header.s=default header.b=bb4AxAEt;
spf=pass (google.com: domain of info@bluestarcolog.com designates 23.168.193.26 as permitted sender) smtp.mailfrom=info@bluestarcolog.com
Return-Path: <info@bluestarcolog.com>
Received: from cpan10.webline-servers.com (cpan10.webline-servers.com. [23.168.193.26])
by mx.google.com with ESMTPS id fi8-20020a0562141a4800b006498baa298csi1620949qvb.487.2023.08.17.07.28.11
for <>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Thu, 17 Aug 2023 07:28:11 -0700 (PDT)
Received-SPF: pass (google.com: domain of info@bluestarcolog.com designates 23.168.193.26 as permitted sender) client-ip=23.168.193.26;
Authentication-Results: mx.google.com;
dkim=pass header.i=@bluestarcolog.com header.s=default header.b=bb4AxAEt;
spf=pass (google.com: domain of info@bluestarcolog.com designates 23.168.193.26 as permitted sender) smtp.mailfrom=info@bluestarcolog.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=bluestarcolog.com; s=default; h=Content-Transfer-Encoding:Content-Type: Message-ID:Subject:To:From:Date:MIME-Version:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=pc0XK9vCcetmbPt9gJGQZPt1zIS9zd6KGCUoIcQqt1g=; b=bb4AxAEtMh8M+nlzka5GflXyYO uxIUV6/CPciajm1RORg2q8HanGMNHDqKiwMWcRJ0cEQER85h6hiWLS0IlnNqRkPRnD6wjF2UGYvB6 5O7r4i8R2nbcMycuzSDV2cjwiBnUMS3yhms+24SROkEY9YUt/vq+EVrDEg0tAXva3mM0wzX8HY91F uy0xrsuPzVlmg2/c3ByRjOdhnms5HEDk20lMasfHNDS2uebnTDwghIFQHsAlEYl+CCW38RuYRYk/r NOW0Noq/RIMRgTM4OT9smLlh7yEzJfWFV9C2ji8ZZMzi0DyTf3vMfTPYSsv6nZKaEci0yU4u+LMlQ PTsyUhjA==;
Received: from [::1] (port=42940 helo=cpan10.webline-servers.com) by cpan10.webline-servers.com with esmtpa (Exim 4.96) (envelope-from <info@bluestarcolog.com>) id 1qWdyv-007BHY-1O for aim28burger@gmail.com; Thu, 17 Aug 2023 10:28:10 -0400
MIME-Version: 1.0
Date: Thu, 17 Aug 2023 10:28:10 -0400
From: info@bluestarcolog.com

Subject: URGENT RESPONSE NEEDED
User-Agent: Roundcube Webmail/1.6.0
Message-ID: <930c1b537de8170c44cd05eae59f24ca@bluestarcolog.com>
X-Sender: info@bluestarcolog.com
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Orig IP: 23.168.193.26 | Orig ISP: Webline19 | City: n/a | Country: United States

[Big Al]

Thank you.
Our Admin Firefly will examine the information and take it from here.

Is there any other help that I can give you concerning this?
I assume they have not asked you for money yet and have given you any payment information.
Is that correct?

[ashelleh]

Thank you.
Our Admin Firefly will examine the information and take it from here.

Is there any other help that I can give you concerning this?
I assume they have not asked you for money yet and have given you any payment information.
Is that correct?

They have not asked for money yet since those emails. Not even payment information. There has been no talk of it since the unblocking.

I also know that I will pretty much give them another week before I drop them again...I just like keeping them on the hook just a little bit longer. No personal information has been given out so I just play their game. (I love watching Catfish the TV show, so the signs were always there...I just was seeing how long it took before they came up. Now I am just dragging it out so no one else can be scammed.

[firefly]

The fake courier used in scam claims to be Bluestar Constantine Logistics INTL.

From their fake website:

Responding to the UAE's growing importance and aspirations, we started a shipping company called Bluestar Constantine Logistics INTL, with the vision even then, to be the best at what we do.
Today, with a firm bedrock in the UAE, Bluestar Constantine Logistics INTL supports organisations from the far corners of the globe, who require ‘Best-In-Class’ Logistics and Supply Chain services in this region.

Contact details:

Elite business center- Sanaiya-45
Abu Dhabi- UAE
P.O Box: 27509
Tel : +971 2-5555168
Fax : +971 2-5555194
Mobile: +16783905751
Email: info@bluestarcologs.com

+97125555168 / +97125555194
Number billable as geographic number
Country or destination United Arab Emirates
City or exchange location Abū Z̧aby (Abu Dhabi)
Original network provider* Etisalat

+16783905751
Number billable as geographic number
Country or destination United States
City or exchange location Carrollton, GA
Original network provider* Dovetel Communications, Llc - Ga

UAE is, in this case, in Nigeria...

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=163309

From the domain name registration:

Domain Name: BLUESTARCOLOG.COM
Updated Date: 2023-04-04
Creation Date: 2022-03-29
Registrar Registration Expiration Date: 2024-03-29
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: adeleke adeyemi
Registrant Organization: yemlat global concepts
Registrant Street: 34 sule st,mongoro ikeja
Registrant City: ikeja
Registrant State/Province: Lagos
Registrant Postal Code: 100001
Registrant Country: NG
Registrant Phone: +234.8028359239
Registrant Email: yemlat@gmail.com

This is what the fake courier website looks like:



Adeleke Adeyemi and Yemlat Global Concepts were reported for the first time back in 2010 with a fraudulent domain name impersdonating another delivery company: deltaglobalsecurity.org. Since then, the email address yemlat@gmail.com was used to register over 1000 domain names, some for local Nigerian businesses, and the rest used in various scams.

[Coop630]

I think this is happening to me right now.

[Big Al]

If you are in contact with this scammer.
You should stop all contact with the scammer and any associates.
They will all be involved in the scam.
Do not tell them you know they are scammers.
Do not send them to our anti-scam website.

Please post as much information about the scammer(s) as possible.
E-mails, E-mail addresses, Phone numbers, fake documents, Additional fake websites, & any places you were asked to send money like a bank account or Western Union details are all helpful.

[amym6612]

He also goes by the name of Bryan Black.
His username on Snapchat is ryantrachtblack
I unfortunately believed him and have lost thousands of pounds.Realised too late.I have been in contact with whoever this spammer really is for 14 months.It’s the 2nd time I have had what is known as “romance fraud” happen to me. I she have trusted my instincts and not send any money.Please trust your instincts and never send any money.They first made contact of the dating website “POF” then said they just want to stick to “Snapchat” and said they closed their account.Claimed to be a military officer in the us military for the “fort Irwin” platoon.Said they was working in Afghanistan and they couldn’t transfer their money from their us bank account to a U.K. account without money being paid.Then sent in an image showing them “apparently” being tied up from a kidnapper.Claimed to be from York.As well as other made up stories.They also have an instagram account under the username “bryanblack767” and a TikTok account under the username “bryanb890”.If anyone is currently chatting to this person please block them. I have been so depressed and have not told anyone what has happened.But feel a bit better for writing this post in the hope it helps anyone else this scammer is chatting to.