Hello folks,
I received messages from a person who uses exact photo posted to these Linda James threads. Name - Esther Karume - Email -
estherkarume6@yahoo.com - FreeDateWorld handle - esther2011 - id - 23094 - 26 y/o female - New York, USA - English - student - Have no children - Last logged in: 2012-03-21 12:05:14 - Personal details - ProfileType single - Sex female - Want children No - Date of birth 1986 - May - 5 - Height 5'4" - 5'7" (161-170cm) - Body type Slim - Ethnicity African American - Religion Other - Marital status Single - Education High School graduate - Income $10,000-$30,000/year - Smoker No - Drinker No - Details of the person you are looking for - I look for a male - Looking for an age range 26 - 75 - Looking for a height 4'8" - 4'11" (141-150cm) - Looking for a body type Average - Relationship Friendship - Description: i am a nice good looking girl - Ideal match description: i am looking for a nice man who will who me love and take car of me
--------
end of profile data
--------
The introduction message is a common script posted to Romancescam except the person changed the name and email address. The first email is basically a script edited version of script with little difference posted about Roselin Karume; <roselinkarume@yahoo.com> posted by by IceFM on Fri Apr 15, 2011 11:46 am . The phone number ' +221765012967 ' in the email is same as listed in the Happyness Karume -
happynesskarume@yahoo.com post as posted by by IceFM on Tue Jun 28, 2011 8:30 am . The email came from IP Address - 41.208.184.140 which is same IP Address as Nancy Cares -
nancycares100@yahoo.com at this thread - viewtopic.php?f=4&t=41826 . I can post the header if you like. The person attached 40.gif 50.gif 40.gif 50.gif sx4x31886719-02.jpg 019.gif (picture already posted to the thread) The second email was a duplicate of the first email. It came from 41.208.184.128 which is not associated to any scam report at RomanceScam so I will post the header :
---
Delivered-To: ---@---
Received: by 10.52.36.78 with SMTP id o14csp34838vdj;
Tue, 20 Mar 2012 00:56:14 -0700 (PDT)
Received: by 10.180.24.4 with SMTP id q4mr26362863wif.7.1332230172960;
Tue, 20 Mar 2012 00:56:12 -0700 (PDT)
Return-Path: <estherkarume6@yahoo.com>
Received: from nm24-vm1.bullet.mail.ird.yahoo.com
(nm24-vm1.bullet.mail.ird.yahoo.com. [212.82.109.192])
by mx.google.com with SMTP id g18si749294wiv.11.2012.03.20.00.56.12;
Tue, 20 Mar 2012 00:56:12 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of
estherkarume6@yahoo.com designates 212.82.109.192 as permitted sender)
client-ip=212.82.109.192;
Authentication-Results: mx.google.com; spf=pass (google.com: best
guess record for domain of
estherkarume6@yahoo.com designates
212.82.109.192 as permitted sender)
smtp.mail=estherkarume6@yahoo.com;
dkim=pass (test mode)
header.i=@yahoo.comReceived: from [77.238.189.57] by nm24.bullet.mail.ird.yahoo.com with
NNFMP; 20 Mar 2012 07:56:11 -0000
Received: from [212.82.108.134] by tm10.bullet.mail.ird.yahoo.com with
NNFMP; 20 Mar 2012 07:56:11 -0000
Received: from [127.0.0.1] by omp1039.mail.ird.yahoo.com with NNFMP;
20 Mar 2012 07:56:11 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id:
875254.18588.bm@omp1039.mail.ird.yahoo.comReceived: (qmail 38207 invoked by uid 60001); 20 Mar 2012 07:56:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com;
s=s1024; t=1332230171;
bh=HUFjCoKcgLOIQRR+bEdZ02KKV2tqwyrijbRgFDLIaBY=;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=yvAVXUMY4d4dfTapTAN+7x3MeO5MuTnhAvZ3uDtzCFCH0HSCegX3PTVi7MGGus0WJ7UBfvpFShEBhgtU+sOglsYeBrLqsfP9YlEQdUjJyW5TAb1seCIDqGFRhWSOk9c0QWEbMEkDGqMwsocrN+pklf36E+Io5R0idgSR3HyyY+E=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=6Ihh5OoxkPg4qUq2QoGqrAAZlEJ5ekMgVMDZmjabq+/xF2KZFuGunji8O1z66jTolTiZFOCGRzD9qaC93T8Na199KQdgBwHM//hCabJqPFrC3U+xkA/sqXshxgC6rWRLh7MXYxv6m8qUj5xCGhmduflF+L9++IyS1Nwna0A0Bv8=;
X-YMail-OSG: iqmVjiQVM1lOInhgZn4RQKnzAq9yITW0FFGul8JNC4.BvYr
n2iFya_YsUY1z7P3nA0OMRLkv5Qu6qymAdIPTQmu_.ddsX_KXX.lNacLgl5Z
tRSrnot.tb79xH7aSMGrKpM_YWo9LK2NPBeWnG1OWjEfn3BHK8RafaN5VvW1
5znHCQQm4HE8J.XCfjmGSwTqgOWnGeD8BAPdY0JrQbyA46OuF0_0QieeQJvJ
FFTuhRrT1n7crxNt8fbmBhQsHkihsR8LmNs_je4WCU9fduMBIws1DBoeakOr
ZbL4wo7g9yIiTDCwNj76zbm1KOlAKaQFpqrcwkWkHZc_Firan6ntbb6EJ_YI
ySKLrNjueuoDFYUqkxr2kKR6bV1zO.HDRHpvmF.a.wqREaDwWYT56d8wjEDX
54_hpJsdIRKu.Al.8jN55rhbW78Vx5XPbYkF5gLYoDtXks.7hZWPk2_K7grX
eD3ll6s29oqGvaX8abXh__P.DvioSeqNs4fBaDZS.bBDP1oHUTyQBvJxqzPn
EHUKUYZP0mgZwMnCMzVdbNrwXyCiJIqLHJJp6fr3j5QUGRGrAMEuLIoSQTfL
wVmqS.vXiXKg5QqfuKBlZbnIsf3NM1XVkhi095zPv0jd3yLj2BH.Q66HFn1M
6AdQ86cpBQmNsgiXBcZvVAkRAzMTKnmbAlfX3x.7UqBoIZJ6q3U6nt.4E9zL
DxV9AdG4vzzDR0veWMnC_OXlmpBwiSjDY8rRoA.Widbmzk4dl2Uu34L2Yic2
6hb_0owNhh2.4aGtP59H77aKhxBlKBEJj7mfXfycLHR2S8Axoin4jw_kPL_j
5CfcEk4G_M1dyOmRN2vMW8sv0nXKD5BK5Jq9BkbgwvyNBdrcfdr9y52_VsiH
w5qwOQfImRVTe3wdvBy3Haah32Ic73IA0UurNKCfw_QR4VfqbXebwm5FVAtA
Q0zUkmy5NTf7cbg--
Received: from [41.208.184.128] by web29801.mail.ird.yahoo.com via
HTTP; Tue, 20 Mar 2012 07:56:11 GMT
X-Mailer: YahooMailClassic/15.0.5 YahooMailWebService/0.8.116.338427
Message-ID: <1332230171.34303.YahooMailClassic@web29801.mail.ird.yahoo.com>
Date: Tue, 20 Mar 2012 07:56:11 +0000 (GMT)
From: Esther Karume <estherkarume6@yahoo.com>
Subject: HONEYTHIS IS MY FULL LIFE STORY WITH LOVE AND TRUST.
To: ---@--->
In-Reply-To: <CAEASMRO460fjXCE7wMK4+6LF+ZaU3qOJ_92kVVVJKPkWmb=3MQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="908097277-1594960959-1332230171=:34303"
--908097277-1594960959-1332230171=:34303
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
---
the person attached 40.gif 50.gif 40.gif 50.gif (these are just icons appeared as inline within text of the email)
I did a header analysis for the first email at iptrackeronline dot com and here is the information it gave me :
IP Address - 41.208.184.140 - Provider - Societe Nationale Des Telecommunications Du Senega - City - n/a - Country - Senegal
I did a header analysis for the second email at iptrackeronline dot com and here is the information it gave me :
IP Address - 41.208.184.128 - Provider - Societe Nationale Des Telecommunications Du Senega - City - n/a - Country - Senegal
--------
end of information
--------
see you
mdgposter