aleksandaivanna418@hotmail.com

[firefly]

Part of reports on Ukraine Scams: search.php?keywords=UKRScams

Money transfer scam.

My names are Ivanna Bodashka Aleksanda I am 20yrs old, and the only daughter to late. Bodashka Aleksanda; I am from UKRAINE. I lost my parent during the Russian troops under heavy bombardment, destroyed Severodonetsk's housing which my parent are among the victims. My late father owns a Pharmaceutical Company in the city of Severodonetsk, and the Pharmaceutical Company affected during the heavy bombardment by the Russian troops due to the conflict between my country Ukraine and Russian.

My late father deposited some funds in a Mortgage and Financial Company worth the sum of Ђ15,600,000,000 Euro (Fifteen Million Six Hundred Thousand Euros) My family estates documents stated that as the next of kin, before I claim the money I will be up to the age of 24yrs old by my late Parents. Presently I was kidnapped by Military higher ranking officers from Russian who knows my Parent, they are requesting from me to release my family estate documents to them and to give them information of the Security and Finance Company; as they are threatening to kill me.

I only have little opportunity to write you through the help a Nanny laptop, seeking for your urgent assist to secure my family estates for me, as I have lost my Parents. No matter how long my Russian Military will keep me on hostage, I will surely escape one day! Then find my way-out. All communication to me must be by email only for security reason/s

Thanks in anticipation

Ivanna Aleksanda

Header:

Received: from User (unknown [87.120.84.158])
Reply-To: <aleksandaivanna418@hotmail.com>
From: Ivanna Aleksanda <aleksandaivanna418@gmail.com>
Subject: HELP ME FROM UKRAINE
Date: Tue, 11 Jul 2023 16:31:12 -0700
X-Mailer: Microsoft Outlook Express 6.00.2600.0000

Originating IP: 87.120.84.158
Originating ISP: Sharcom Ltd.
City: Kozloduj
Country of Origin: Bulgaria

[Big Al]

Thank you very much for responding to my email.
There is no chance to write you back before now since where they kept me is full with Russian Military Officers, so it is not easy for the Nanny to allow me to use his Laptop

I will not be able to write much but will go straight to the point. My family estate documents and the funds are with a Licensed Real Estate Agent (Carey Mark Portman) in United Kingdom

You are going to write to Carey Mark Portman with this email address: (careymarkportman@dcmflimited.website)
quoting this Reference Number DC20221966 he will know you are from me and he inform you how to go about everything.

Attached herewith is a photo of my parents and I when I had my 20th birthday on January 1st last year before war began.

I have to go now it appears a Russian Military Officer is monitoring me and the Nanny

Ivanna Aleksanda

Header:

Return-Path: <aleksandaivanna418@hotmail.com>
Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-cwlgbr01olkn082f.outbound.protection.outlook.com. [2a01:111:f400:fe14::82f])
From: Ivanna Aleksanda <aleksandaivanna418@hotmail.com>
Subject: Re: HELP ME FROM UKRAINE
Date: Fri, 21 Jul 2023 04:38:44 +0000
Message-ID: <LO2P123MB4636740008E21D105275E4BF973FA@LO2P123MB4636.GBRP123.PROD.OUTLOOK.COM>

Gallery: https://scamsurvivors.com/piwigo/index. ... egory/3858

[Big Al]

ATTNTION:

This to inform to acknowledge the receipt of your email and contents is hereby noted.

Seeing your forwarded email with this Reference No DC20221966 shows that truly it was Ivanna Aleksanda that refers you to me.

Actually the Funds and Estate Documents of Late. Bodashka Aleksanda, Ivanna Aleksanda Parents was originally transferred from Italy to United Kingdom, before they were killed by Russian Soldiers.

I plead with you to make sure Ivanna Aleksanda is safe and for security reason/s I do not communicate with Ivanna Aleksanda much these days and I believe you can take care of her once she is released from Detention.

Therefore, the Funds and Estate Documents are with Natwest Bank as me as the Custodian of the Funds and the Estate Document. See attached Authority to transfer the Funds to you. Kindly fill it and return to me for processing by Natwest Bank

Thanks for your assistance and support to Ivanna Aleksanda.



Carey Mark Portman

Header:

Delivered-To:
Received: by 2002:a98:d64f:0:b0:1d5:30b:bc18 with SMTP id o15csp406039eik;
Fri, 21 Jul 2023 16:15:40 -0700 (PDT)
X-Google-Smtp-Source: APBJJlFw/4+FxbHNxTRXDkiCwVm9TIscck/ygOjVT/YTsHNynyGYQBAJo6uyNYZfqDPZg+zg6gWY
X-Received: by 2002:a17:90b:4a51:b0:263:c247:6d1b with SMTP id lb17-20020a17090b4a5100b00263c2476d1bmr2850775pjb.40.1689981339668;
Fri, 21 Jul 2023 16:15:39 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1689981339; cv=pass;
d=google.com; s=arc-20160816;
b=aT67bGqkYaC6O+xHRie/mH3zVUcIXqV8Q9h+BRGaZaXv4CKdWU3YL9Zz2RxDVt4qUh
DxJ2+dtVvX93TX7L+bBsxOgqZew82XlRebEoFIuwE/jpAAFFImDVqsnis6DlLyGjyoxh
D/6MJhjpYbeBZRmeYwofGHAIxITT75CG7bBi7JG45kAwmsvD1kvgdGcfq9vdfJi5f+52
H58KDds+54KcaI4tPsQuP9JmiVqZi2hL3DwWc23DEEC0uozEtrqykfF9BucRLelsmgg7
OBqaH5RzU5wfdHasUn7HYXTssJmPKlnqLTvSzyt6DtMGvpN8+VwXsN1jZ+osjE9VtDbn
GqFQ==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=disposition-notification-to:message-id:references:in-reply-to
:subject:to:from:date:mime-version:dkim-signature;
bh=ZfTUz4GCHmJkCLtJLCgmwUC1F85p35jWny3RPmR1/NM=;
fh=nKMPTPusok9P4uvxOJeNTFkhnZjZvdcorOKR2Q4vGU8=;
b=yEY+6rP3HlCUtVX+czwWGURG3ksh58UOpPuTC5V8aL/3lBYryepH3C71iChdzpFjDb
Gu5cNEtUZiH1/4qrxg43vRd/jLRlDBdwFVSRGF6mSvJzS3rU8ROjseS/czPHNMEC600V
qT19tIjWHMpaoEwEpkLQkqn0+05+aovE/O/6Au+la72cvewAvfShtC7613k9hEsip9I/
kF9Ob7AJ/aBh1n1CMAX7CpAgyDIMn6nVMTwcYxlWzD4NkrZGjtgBevUMiSZFmBc1DrW4
3cUjUe0636zIMu21AVcrLe1KK4PZjz2C3adOyNfOFkaP6nukvPZTsh6fy3QH4fNWshHS
yKkg==
ARC-Authentication-Results: i=2; mx.google.com;
dkim=pass header.i=@dcmflimited.website header.s=hostingermail-a header.b=EfhKUvxj;
arc=pass (i=1);
spf=pass (google.com: domain of careymarkportman@dcmflimited.website designates 23.83.222.42 as permitted sender) smtp.mailfrom=careymarkportman@dcmflimited.website
Return-Path: <careymarkportman@dcmflimited.website>
Received: from crab.ash.relay.mailchannels.net (crab.ash.relay.mailchannels.net. [23.83.222.42])
by mx.google.com with ESMTPS id ik2-20020a170902ab0200b001b1bf4c8688si3791175plb.231.2023.07.21.16.15.33
for < >
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Fri, 21 Jul 2023 16:15:39 -0700 (PDT)
Received-SPF: pass (google.com: domain of careymarkportman@dcmflimited.website designates 23.83.222.42 as permitted sender) client-ip=23.83.222.42;
Authentication-Results: mx.google.com;
dkim=pass header.i=@dcmflimited.website header.s=hostingermail-a header.b=EfhKUvxj;
arc=pass (i=1);
spf=pass (google.com: domain of careymarkportman@dcmflimited.website designates 23.83.222.42 as permitted sender) smtp.mailfrom=careymarkportman@dcmflimited.website
X-Sender-Id: hostingeremail|x-authsender|info@dcmflimited.website
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id BE19C26139E for < >; Fri, 21 Jul 2023 23:15:29 +0000 (UTC)
Received: from uk-fast-smtpout4.hostinger.io (unknown [127.0.0.6]) (Authenticated sender: hostingeremail) by relay.mailchannels.net (Postfix) with ESMTPA id DCE6D2612F1 for < >; Fri, 21 Jul 2023 23:15:27 +0000 (UTC)
ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1689981329; a=rsa-sha256; cv=none; b=D81+h4UzRZmS8bYOFT2XhjIpDUKBnLMsWQusik/F8qgzR/4obmZGnLwD7G0sRy6w1EaiKP tV0G2+zFJQLID5f+VgLRwC74X35ofiHpqMVZk2aJsAqtlKhiOtwuLYJkunQL0RFGoCbav5 nzMVwkHAfvIekJlEtqw1KIuVSjr+jjJozZAjMuSgGx6NyImWNUE7gVVZl0qtvGk5tG2W93 A2GlLz9ybZDFNwv8aaeHNHVLwN4d302bd2LxRIjoo0vQtI+KeCNoAma/CtUa/NTL9B9zfv L+U1jLM5rHthhThaE/F4JRVqbUr+3hghL0MBTGrr1WwbIvNL5Rg+GV7LiOXrOQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1689981329; h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
in-reply-to:in-reply-to:references:references:dkim-signature; bh=ZfTUz4GCHmJkCLtJLCgmwUC1F85p35jWny3RPmR1/NM=; b=Mu/f+M21bExFdcaHfNTDIecthHW3ObATwcJjc8FviKg8RM66KDEzPYgVH5c06NUwfnNx3V 3JhaFg/HLwvX7RJILlNq2/BhgXRxYkxvtNd48U7L/xg4VIO6y02ULbHc1RzKpzFIebBlSQ l/AXcgrFWhA7/A+/+WynB3I/OWsfwEBE40bpyxtRtoJvYdDi6zBduqk0U7uMLfdAxCCwT8 w3pt802gXvxO2DbdiTbLyfMGBS2uI2K/Go4gS9vk7rrqTumeKLVoEtIIj2m3g1eHkMiE2S uZnATgn3lcGUdjcGwQwaf28+ene0YQetqUo7nR0gC42uoVp0Y/i1kON+X5z8Gg==
ARC-Authentication-Results: i=1; rspamd-6879cb8ddb-55ntn; auth=pass smtp.auth=hostingeremail smtp.mailfrom=careymarkportman@dcmflimited.website
X-Sender-Id: hostingeremail|x-authsender|info@dcmflimited.website
X-MC-Relay: Neutral
X-MailChannels-SenderId: hostingeremail|x-authsender|info@dcmflimited.website
X-MailChannels-Auth-Id: hostingeremail
X-Towering-Duck: 7cd4c1f23b018ab5_1689981329456_592917440
X-MC-Loop-Signature: 1689981329456:3792021257
X-MC-Ingress-Time: 1689981329456
Received: from uk-fast-smtpout4.hostinger.io (uk-fast-smtpout4.hostinger.io [31.220.23.38]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.120.163.62 (trex/6.9.1); Fri, 21 Jul 2023 23:15:29 +0000
Received: from mail.hostinger.com (117.138.230.35.bc.googleusercontent.com [105.112.182.192]) (Authenticated sender: info@dcmflimited.website) by smtp.hostinger.com (smtp.hostinger.com) with SMTP id 4R754t0xW5z2L2x9 for < >; Fri, 21 Jul 2023 23:15:26 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dcmflimited.website; s=hostingermail-a; t=1689981326; h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
in-reply-to:in-reply-to:references:references; bh=ZfTUz4GCHmJkCLtJLCgmwUC1F85p35jWny3RPmR1/NM=; b=EfhKUvxjDfB0U4Au7N9aLCYmOg7bLFhwImTtOsihgV+zDZCU7gbO/xxi4JZJwR88o5s8W6 CnfAMxx8T8P73gtUbn803Tlb5JJ4PTHmVoRwwJPeWstwk7wHaKnjihDC1fbpFHWpM6FDCT sFNNwio0A4oFZE2jjTMwYNMMVwAsP00xtAAPEMKftUbhg+w80pMM3pRKsgcadOK7gRYY4Q alNZIPFyxK49yH+CXUB7hcE+fNlSHCgGY9m3aLpyIhYBL2NLKS/PLNU+YqHsbcukPL3X0x tWwFBncq4jpr8KxRTOrWnSlb4GB0DYejjl6+Zvd5ui9G11DSL5/8EUEoHRAPOA==
MIME-Version: 1.0
Date: Sat, 22 Jul 2023 00:15:25 +0100
From: CAREY MARK PORTMAN <careymarkportman@dcmflimited.website>
To:
Subject: Re: Fwd: HELP ME FROM UKRAINE
In-Reply-To: <CABwrbKrpL7c1W5zdZtTfuizExcdJy2H+myyAFA4o=M7UfrFX4A@mail.gmail.com>
References: <CABwrbKrDCamrZrW-gzEtiHyJ8TsU90_SGN_0wJNSs0oxWSryfg@mail.gmail.com> <LO2P123MB4636740008E21D105275E4BF973FA@LO2P123MB4636.GBRP123.PROD.OUTLOOK.COM> <CABwrbKrpL7c1W5zdZtTfuizExcdJy2H+myyAFA4o=M7UfrFX4A@mail.gmail.com>
Message-ID: <901d974545491b0e1f472b2606307c47@dcmflimited.website>
X-Sender: careymarkportman@dcmflimited.website
Disposition-Notification-To: CAREY MARK PORTMAN <careymarkportman@dcmflimited.website>
Content-Type: multipart/mixed; boundary="=_9b6caa4caf0a9230538533946b8b4bcd"
X-CM-Analysis: v=2.4 cv=bouKRmWi c=1 sm=1 tr=0 ts=64bb118e a=LTuR0n2KYTIXWwkeU/iVOg==:117 a=LTuR0n2KYTIXWwkeU/iVOg==:17 a=bAGBRFzrfLget5F6:21 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=03DX_18n6NAA:10 a=69EAbJreAAAA:8 a=pGLkceISAAAA:8 a=sZ9uagN8KjRyb2soiUMA:9 a=QEXdDO2ut3YA:10 a=Ns2U6wnu_ykA:10 a=pc-r3pmUDR4bG6PEEy4A:9 a=YcUqLVW56oADXWEk:21 a=_W_S_7VecoQA:10 a=lqcHg5cX4UMA:10 a=rNgYkTgwOPkvp5xs1FcA:9 a=KQqxNPgzF0kA:10 a=VEiTNn8F7TgA:10 a=WH9GsmIg4qEz5EX-sks4:22
X-CM-Envelope: MS4xfAIEdPdZ/srRrBjIswVAtH2qMjdobONdUMsEP2eVGdtpcaTTYd4qthXVZsqlqDa4H/MLwMRRbBx6UOxvVdOqkhuUN7Q720p3/730+S3D5DjJEgv0Rn8c u3ha0vF5eQ6Pajs2LUm2abVvHFpUgdXCAgpLv1Sw4FLj3h4kln+G0vnd99cjqveVLggUyO/fM//htW1/v/Q11kaOwHCwWOltMuAtG19e80lWD4Ms8QHdOnqe

--=_9b6caa4caf0a9230538533946b8b4bcd
Content-Type: multipart/alternative; boundary="=_5fea7c202920a01b01f645bd4b170c48"

--=_5fea7c202920a01b01f645bd4b170c48
Content-Transfer-Encoding: 8bit

Orig IP: 105.112.182.192 | Orig ISP: Celtel Nigeria Limited T.a Zain | City: Lagos | Country: Nigeria

[firefly]

The fake site used in scam claims to be DC Markets Finance LTD and is active on a free subdomain.

The scammers stole the registration details and address of a real UK company no longer active since September last year.

From the fake website:

DC Markets Finance LTD was Incorporated on 22 April 2020 in United Kingdom (UK) as a Private Limited Company with Company Registration Number 12568280. This business's declared SIC number is 64922 meaning Activities of Mortgage Finance Companies.with a focus on Personal/Business Loans, Mortgage, Financial services, Keeping of Valuables, Securities, Project Funding, Asset Management and Bitcoin Trading Program/Investment with operations in 3 countries worldwide. For our Bitcoin Trading Program/Investment. Investors are to deposit a minimum of USD20,000 equivalent of Bitcoin value in our trading Bitcoin Account and same will be traded upon and current return rate is 5% per Month. The beauty of this Bitcoin Trading Program/Investment is that our Investors are guaranteed on return rate and can receive Loan from us at 10 times value of their Investment. If an investor applied for loan, returns from Bitcoin Investment is used to pay interest on loan as at when due. Our office is founded and head-quartered in United Kingdom. DC MARKETS FINANCE LTD employs more than 20 Employees and Agents across Europe and Canada

Contact details:

4d Salisbury Road, Weston-Super-Mare,Somerset, BS22 8EW, London,United Kingdom (UK) Email: koromamustapha@dcmflimited.website
Tel/Fax +44845132 2762,
ITALIAN AGENT OFFICE: Via Alberico Albricci, 10, 20122 Milano MI, Italy
Telephone: +39351 2085199
Email: italianoffice@dcmflimited.website
CANADA OFFICE 234 Wellington Street Ottawa ON K1A OG9 Canada
Email: cacanadianoffice@dcmflimited.website

+448451322762
Number billable as local rate number
Country or destination United Kingdom

+393512085199
Number billable as mobile number
Country or destination Italy
Original network provider* Lycamobile S.r.l.

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=162612

This is what the fake website looks like:

[firefly]

The fraudulent domain name is used only for the email address, as in careymarkportman@dcmflimited.website.

The scammers asking victims for identity documents copies and bank account details have their identity and location hidden under the privacy protection given by the Registrar.

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=162613

From the domain name registration:

Domain Name: DCMFLIMITED.WEBSITE
Updated Date: 2023-06-23
Creation Date: 2023-06-23
Registrar Registration Expiration Date: 2024-06-23
Registrar: Hostinger, UAB

Registry Registrant ID: Not Available From Registry
Registrant Name: Domain Admin
Registrant Organization: Privacy Protect, LLC (PrivacyProtect.org)