RobertYancey@hrmsglobal.org

[Big Al]

Recovery Scam:

I hope this email finds you in good health and high spirits. My name is Mr. Robert K. Yancey, and this communication is regarding unclaimed inheritance funds that have been linked to your name for some years now. I am reaching out to you as an authorized representative to help you navigate through the process.

Kindly provide me with your home address so that I may provide you with further details and the necessary instructions on how you will receive your Ten Million USD without any delay

Regards
Mr Robert K. Yancey

Header:

Received: from 10.217.150.202
Return-Path: <RobertYancey@optusnet.com.au>
X-Originating-Ip: [211.29.132.97]
Reply-To: <RobertYancey@hrmsglobal.org>
From: "Mr Robert K. Yancey"<RobertYancey@optusnet.com>
To: You
Subject: Re: Transfer of unclaimed inheritance
Date: Mon, 4 Mar 2024 22:38:56 -0800

[Big Al]

Good day to you .

You will be required to travel to Vietnam to meet our payment
officers and sign some documents that will enable you to receive your
payment and you are not going to pay any fee to any one or pay for any
travailing ticket ,we are to cover all and make sure you receive your
payment okay ..
Please sir, we would like to know when you will be ready for this trip
and also send us your passport copy to enable us to start the processing
of your trip to Vietnam
Have it in mind that you will not pay for any fee or any flight ticket
okay , We are to pay all that to proof to you that we are legit not
scammers okay

Do you have international passport if you do send a copy to enable us
start the process okay
information required Full name home address Cell phone number Copy of
your international passport
.Regards
Mr. Robert K. Yancey,

Header:

Delivered-To:
Received: by 2002:a0c:e145:0:b0:690:6845:f90b with SMTP id c5csp251735qvl;
Tue, 5 Mar 2024 03:19:43 -0800 (PST)
X-Google-Smtp-Source: AGHT+IFQ9n0ULcyuTTdLM3a371k9D/8cOc2z+h2XkEUZGmysFtmDpnHBoh5UXJaiNi5nEUQ+B+dN
X-Received: by 2002:adf:ec52:0:b0:33d:108e:bcc3 with SMTP id w18-20020adfec52000000b0033d108ebcc3mr8819301wrn.35.1709637583170;
Tue, 05 Mar 2024 03:19:43 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1709637583; cv=none;
d=google.com; s=arc-20160816;
b=h4mli5wXyEMcdccw3Wx8C48CFZHK1h2NJymSwFhPSuNRq4m4f2y9An5nukcXMqXmfo
Z2PbLhcN4EOeh/P1xXjZdPxvIJhWk4R/c0AkXewRo+XPKv1JI6Y2yNoWYfb0jJZvPpEn
+RadxrOP2S1gwhTpiUkOnvfkCY2foBLjen7n2nUsS3zq6327/DDBFdpUeEyMuT7JFEES
zNfBV0GvafZcYCDGbv3XCa+ffhKiRr4jfRAbP202k74aX/ohUzrOZR6yyfI0Ac0dafxA
Koqv4jr9GydQsJ5u0z5+baKT4K4279GhCbcADR9VopbCz5BAoZuRCvx3CTtmXrr2sLTE
uFhA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:message-id:user-agent:references
:in-reply-to:subject:to:from:date:mime-version:dkim-signature;
bh=+AAGnOae0EcyY/lbh5+npYa86BO48DmQsTu0cWW1U+0=;
fh=1sHkQJ/xbgGUbbhsRYBis8OU8h3NdbF+/Og171TwfaY=;
b=shRN6lUd9B+EAWrS0UPgB5/gd4UhYGFLHy9spGM/tz9l2ontZQQnFZMc1yIAjz2CDi
09r6w2sd+Wv8yoQ0IZQhjIL4KR3p3WPoGcuY6lqtVScEkZVWNlz9QaT+kVvBETKuKmxa
WGOPSjL79jIoQh0EznHXoPQs1RgJOsWmJw+cUgXj53ncVBv35888MGtW5RuaJVDyVA0g
GByJMXdke0FWlpUwnMlJ802BSy2FcmxiD/Kf8s3ZjQ/cUoK/XDWDyE5xmwoRSUn/o2dJ
e3rwJrJ6CjdmQcjOf1ypOEcudGohFpEcZpv75o3qUI/cPKlmNMz+griqbVF/c7ZoN2xA
j8kw==;
dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@hrmsglobal.org header.s=default header.b=l6tCPdg5;
spf=pass (google.com: domain of robertyancey@hrmsglobal.org designates 198.251.84.141 as permitted sender) smtp.mailfrom=robertyancey@hrmsglobal.org
Return-Path: <robertyancey@hrmsglobal.org>
Received: from c2.my-control-panel.com (c2.my-control-panel.com. [198.251.84.141])
by mx.google.com with ESMTPS id t16-20020adfe450000000b0033df82b0e1dsi6220349wrm.375.2024.03.05.03.19.42
for < >
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 05 Mar 2024 03:19:43 -0800 (PST)
Received-SPF: pass (google.com: domain of robertyancey@hrmsglobal.org designates 198.251.84.141 as permitted sender) client-ip=198.251.84.141;
Authentication-Results: mx.google.com;
dkim=pass header.i=@hrmsglobal.org header.s=default header.b=l6tCPdg5;
spf=pass (google.com: domain of robertyancey@hrmsglobal.org designates 198.251.84.141 as permitted sender) smtp.mailfrom=robertyancey@hrmsglobal.org
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=hrmsglobal.org; s=default; h=Content-Transfer-Encoding:Content-Type: Message-ID:References:In-Reply-To:Subject:To:From:Date:MIME-Version:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=+AAGnOae0EcyY/lbh5+npYa86BO48DmQsTu0cWW1U+0=; b=l6tCPdg5Mo/TnFsLErHfwR5h+u rOAmVhtW/NO0K35RJg0P4iLJ3o03UMFTb6ADxsXocuels8iOm+fXxeqyEdV/rJMYUZQ8/GnSt0rqb xHVbXzV/zU93UOZx/qBIAyEOcfX8spGXDx8+vhJ/ArB5EfMsN0/2SiWTpy+mf6WBp7DpuIz+7bH+j iT0msxSzB80Jz2CGbrki99/2anhfS1iGySslx7W5quJttyg/CrNcY59d22jOKhtr4BQn6aDO9gg3u 9lbVT6FsDwIIBVfjRj74JiUFIEYgIieynR7MQ0HfBPcwqQmb6mITkaSBtdxFVkz9T+bN3KaS43RdM j3mh27OA==;
Received: from [::1] (port=40244 helo=c2.my-control-panel.com) by c2.my-control-panel.com with esmtpa (Exim 4.96.2) (envelope-from <robertyancey@hrmsglobal.org>) id 1rhSpj-00HAIY-2d for ; Tue, 05 Mar 2024 12:19:42 +0100
MIME-Version: 1.0
Date: Tue, 05 Mar 2024 12:19:41 +0100
From: robertyancey@hrmsglobal.org
To:
Subject: Re: Transfer of unclaimed inheritance
In-Reply-To: <CABd=3yhxKoYjybLn-pT+tTdXr2jY1395KGi=KBPR-xEEZFouTw@mail.gmail.com>
References: <CABd=3yhxKoYjybLn-pT+tTdXr2jY1395KGi=KBPR-xEEZFouTw@mail.gmail.com>
User-Agent: Roundcube Webmail/1.6.0
Message-ID: <ed5fd7d98fa5dfa1c2ac9a2cb217150a@hrmsglobal.org>
X-Sender: robertyancey@hrmsglobal.org
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Orig IP: 198.251.84.141 | Orig ISP: Ponynet | City: n/a | Country: United States

[Big Al]

where are you ??

[firefly]

When it's not used for recovery scams, as shown above, the fake site is used in job scams:

We are Consultax
We consistently deliver outstanding results in Recruitment and On-boarding, Human Capital Development, Performance Management, Payroll Administration, Organizational Development and Human Resource Outsourcing in a technology enabled environment.

ACHIEVEMENTS & STATISTICS
Our 25 years of operation
750+
350 clients in the world
1080+
1080 the project had finished
50+
52 experts are working

Contact details:

307 Jesse Centers
London City, England 12568
(+917) 814 – 3527

Both the address and the phone number are part of a WorldPress template.

Their "25 years of operation" started last month.

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=166060

From the domain name registration:

Domain Name: hrmsglobal.org
Updated Date: 2024-03-04
Creation Date: 2024-02-22
Registry Expiry Date: 2025-02-22
Registrar: HOSTINGER operations, UAB

Registry Registrant ID: REDACTED FOR PRIVACY
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: Privacy Protect, LLC (PrivacyProtect.org)
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: MA
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US

This is what the fake website looks like: