SGT. Nicole Horn - [email protected]

Scammers email address SGT. Nicole Horn - [email protected] (BW)

I've been contacted on OkCupid by a scammer. Very little info was on their profile on there except for a picture
and a few details about themselves. They started messaging me and then asked to chat on Yahoo messenger. Their english seemed off but I was playing along and made sure there weren't any details about me in my yahoo profile. I feel bad because they've got a lot of pictures of this girl who is in the Army. She's a PFC and her last name is Horn. The scammer was saying her first name was Nicole but I'm sure that's not true. They finally gave me an e-mail address to write to to request leave for them so I did and I'm waiting for the other shoe to drop and for them to ask for money. The e-mail address they gave was [email protected]
Here's one of the pictures they sent me, just in case anyone knows the real PFC Horn.



I'll post the e-mail they send when I hear back from them.

What was the scammers yahoo email address?

[email protected]

I just just got these emails from them

Dear xxxxxxx,

We received your request for leave on behalf of SGT. Nicole Horn and the leave request has been initiated. We need a prove to show that both of you are committed and know each other. We need you to provide us with her photo.

We want you to forward it to us to confirm that you truly know each other. Also, the leave request is going to incur some charges to cover logistics, but all the charges are refundable. Let us have the above request and we shall confirm the leave request.



Lt. Col. Robert Gonzalez
Processing Officer.

Dear xxxxxxx,

Thanks for getting back to us with your prove. We have to verify and confirm relationship between you and our officer ( SGT. Nicole Horn ) and we will get back to you soon. Also, the leave request is going to incur some charges like we wrote in our last email. get back to us if you have something to say.

Note: We don't share the identity of our soldiers with third party.

Lt. Col. Robert Gonzalez

Dear xxxxxx,

We have verified and confirmed the relationship between you and our officer ( SGT. Nicole Horn ), an administrative charge of $520.00 usd, is to be paid to cover administration. The application file number of the leave request is (AJ0H5) , this must always be stated in any communication with us. We will issue you the application form and process the request as soon as we receive the administrative charge. Kindly get back to us if you need paying information. Thanks

Lt. Col. Robert Gonzalez
Processing Officer.

Thank you for the update and scammers email address.

Please stop all contact with the scammer.

So what happens now? Can their email be tracked or anything?

Can you post a couple email headers from the [email protected] sent to you. We can take a look at them and see.

To find email header look at my signature at the bottom.

Edited to add: Remove you name and email address from them.

here you go

From Leave Unit Mon Jun 8 12:47:25 2015
X-Apparently-To:xxxxxxxxxxxxxxxxxxxxxxx; Mon, 08 Jun 2015 12:47:27 +0000
Return-Path: <[email protected]>
Received-SPF: pass (domain of outlook.com designates 65.55.34.91 as permitted sender)
X-Originating-IP: [65.55.34.91]
Authentication-Results: mta1140.mail.bf1.yahoo.com from=outlook.com; domainkeys=neutral (no sig); from=outlook.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO COL004-OMC2S17.hotmail.com) (65.55.34.91)
by mta1140.mail.bf1.yahoo.com with SMTPS; Mon, 08 Jun 2015 12:47:27 +0000
Received: from COL130-W16 ([65.55.34.72]) by COL004-OMC2S17.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22751);
Mon, 8 Jun 2015 05:47:25 -0700
X-TMN: [8Up83kjZeGTu/doxvvebrN07aCGh0uGv]
X-Originating-Email: [[email protected]]
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_b57769f2-648c-4ef1-81ed-c768c50db603_"
From: Leave Unit <[email protected]>
To: xxxxxxxxxxxxxxx <xxxxxxxxxxxxxxxxxxxxxx>
Subject: RE: Nicole Horn, URGENT
Date: Mon, 8 Jun 2015 12:47:25 +0000
Importance: Normal
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 08 Jun 2015 12:47:25.0802 (UTC) FILETIME=[456DCCA0:01D0A1E9]
Content-Length: 3225




From Leave Unit Mon Jun 8 19:46:06 2015
X-Apparently-To: xxxxxxxxxxxxxxxxxxx; Mon, 08 Jun 2015 19:46:53 +0000
Return-Path: <[email protected]>
Received-SPF: pass (domain of outlook.com designates 65.55.34.76 as permitted sender)
X-Originating-IP: [65.55.34.76]
Authentication-Results: mta1309.mail.gq1.yahoo.com from=outlook.com; domainkeys=neutral (no sig); from=outlook.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO COL004-OMC2S2.hotmail.com) (65.55.34.76)
by mta1309.mail.gq1.yahoo.com with SMTPS; Mon, 08 Jun 2015 19:46:53 +0000
Received: from COL130-W84 ([65.55.34.71]) by COL004-OMC2S2.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22751);
Mon, 8 Jun 2015 12:46:07 -0700
X-TMN: [9d1lPziTkbFvcySe8jYvO6n6NsV1yfF4]
X-Originating-Email: [[email protected]]
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_c8e18539-a15d-4305-8124-9f3b57235f7f_"
From: Leave Unit <[email protected]>
To: xxxxxxxxxxxxxx <xxxxxxxxxxxxxxxxxxxxxx>
Subject: RE: Nicole Horn, URGENT
Date: Mon, 8 Jun 2015 19:46:06 +0000
Importance: Normal
In-Reply-To:
<1433785669.44659.YahooMailAndroidMobile@web122001.mail.ne1.yahoo.com>
References:
<[email protected]>,<1433785669.44659.YahooMailAndroidMobile@web122001.mail.ne1.yahoo.com>
MIME-Version: 1.0
X-OriginalArrivalTime: 08 Jun 2015 19:46:07.0384 (UTC) FILETIME=[C30F0180:01D0A223]
Content-Length: 9658

We need the email header from [email protected] . Not the outlook one. Outlook strips the IP.

Sometimes yahoo does as well. On occasions they wont. Hopefully on the yahoo one they did not.

yahoo avatar

For the bots.

We need the email header from [email protected] . Not the outlook one. Outlook strips the IP.

Sometimes yahoo does as well. On occasions they wont. Hopefully on the yahoo one they did not.

ah ok, sorry. here you go.

From nicole horn Sat Jun 6 05:47:33 2015
X-Apparently-To: [email protected]; Sat, 06 Jun 2015 05:50:26 +0000
Return-Path: <[email protected]>
Received-SPF: pass (domain of yahoo.com designates 98.136.216.223 as permitted sender)
bid0IGhhdmUgeW91ciBwaWNzIHlldC4gT24gU2F0dXJkYXksIEp1bmUgNiwg
MjAxNSA3OjQzIEFNLCBKIEJlbG1vbnQgPGpvbmFoaGV4ODZAeWFob28uY29t
PiB3cm90ZTogU2VudCBmcm9tIFlhaG9vIE1haWwgb24gQW5kcm9pZCABMAEB
AQEDdGV4dC9wbGFpbgMDMAIDdGV4dC9odG1sAwMy
X-YMailISG: Xk.l1JEWLDto5EPTvKrP8F9erZmGxsQqgs3HR7SU692oHvVU
QGV7v.DoPGnwrW3IB8.3anFrMpq5nRboOA8MJUwGeiVvvh78u9DYpEv5a_Jd
NdJtHbLwwdlAWhXBKlFbXJMvn6qQL_Wbvd2Vh75Rb4pTG52i9688mORF6xEJ
gzPxqDFojTPo4djoOtQ0.YloIhstqrOrMqTzAdLWA2NYcTMJ0IP7dt2_PQ33
iDkMGWfGlydG64RCa5p6s2RBbFaV5fqHXsMFe0SOkQ6pmmFHEXWSmSXGz0k_
JsERTqQC_TacKq0.ZApjVi7V19X49dhg3lsLW_96pbA0KKr3feUfx4JCeZue
XokvSxOKnw_qV1_xJa4toO2Y_3kEsyu23dKSlyLk6LBrsQ7swaRJoCGHOqJO
VG7Lv1T3Nhh9kptTDaOvJAl9BoPIXFQppM_SqA4p0a0ykkXnQbDd0x0ipsd8
cC1rWm.tH3cwjX10YgxoXxoEnwK0SgQBGsSRIYPNEeI9ayaIDF6nvdfadCrq
okd.qzUqvdoe4GIXjVCMgou5tr1ZIVUenFvRHGdXO8eicLBuYYSCT4bqxzVi
UoRVZPfPPk0_kC_gQ8lgFHqivKHJkgadZGV6wadfxzk2llRpEF_.poYE0pgd
Ulr5YWzqzFGHX_07AnzjL7l6vumxYhct7p0aJRwe6geI6v_jWe88gzKTewqm
VI2MgBdbAOc1GArZcD.JDZj.9cgy7ujx9wc2ZIPqfLSUMM8Z_r_Pb5Eno0GX
B05NY9k3ibWPFZE0FVkWF2ytTzlIzBT0ZtWEtvGnewqFFtIdlxs0hjkSxypb
_fJ5N5kUZUgrBWHuKgMM5LZx6DY2Ent9akv.Xv49cQWnz9Nm2EjvfIC0DqIL
m72nPnSbh4l4.43ep.3VMZpDo6I3c.y7s3RbkVpdnRHFEv05zaXpSNRh80l3
N4GIpEwEnSKcnsmEskSY7OSqODmSF.tGW8ZgeOuN51ghRWQ5pK2mhwghQcqt
vaVW6t6Omo2rmRyPYBU6t.qAU4aVmk8frbKgdYZ43l86yi0giAkB9mvuY7t5
MesOTEGeNbJS9GrIOlkgv.5WEMtgIuF4kAqRIz6324lO5oAPxoasvKHOPrZM
7CJxDw.tHDFxzbBLXinmJf.l291v1mmCwEN5OXjHnulqNQPT80YarvPSUS1s
nbWQj8xNtzI2sNjWYgXs.zujmDwT7tqoGx5aZKl4O0SxcHSKl2h5ZTrGDHcz
EhetIvabhH4yiKvKxKEsNEu_0Bq47_3OiePHwHNQPWQMEteo_mSpIqNikBIk
0kIaRvLHGOrjlcuw09.jb.1yDKssjuBIozfg874yw6eDRN.ZcsToxSwIKApC
cmGHTLTEv.62qWx4q_kYgLummQ4QQ4tvAz0DU8wx2AvRy.3mrkhlCI2J1CFF
sJZeR3CnXuYpgF7XlvnynpIIkx.1I0U9I5deot9D.2ggm0OwsxMH89wUymnb
VWwitdkgv1oCNjrXle7HR0bt9Res46qpIrDRDHYqIAlneAEyM59P19QzuQJn
3PeGcpcaNL2RSA7Xhky7OzZLe.pzoztN9fyyR4fR.ENyK41fdrQLzPo-
X-Originating-IP: [98.136.216.223]
Authentication-Results: mta1245.mail.ne1.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm36-vm8.bullet.mail.gq1.yahoo.com) (98.136.216.223)
by mta1245.mail.ne1.yahoo.com with SMTPS; Sat, 06 Jun 2015 05:50:26 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1433569823; bh=kDuB6qilEPB6wxG9OvEM6gZ4Ymm2gQ4JX5cy+AbM1P4=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From:Subject; b=IGH7mPOFGMB+vCMFwzczmimIwJ1rJLG1fiRArEdfKzINalISjjrrGsEputg7xWJ7YCYHRlexaDjPn3paaDle20vxfagLbsdxpAQ+scG9QGH1PEWtD3YcP5RFGneg+E/5RaRbRWyDkrPmZlye9LMwzfKNtr1bMbPSz6vrzydQ7PYLwRHVk6k80gt/GSkwRuMlYD3NK6AzWNqmhHwiYsVe15NV4+7+1HipuaLfW3bWc5OcQLa8x9SiLB93Cz7Qsl/3jnLevqejwaTxL83Pgo24NXbQPwyGDevhGxB/p7BY6KXczmdsio2+rA1gWHGY9QUGsgzsYIeU75etmG/nFgzJKQ==
Received: from [127.0.0.1] by nm36.bullet.mail.gq1.yahoo.com with NNFMP; 06 Jun 2015 05:50:23 -0000
Received: from [216.39.60.183] by nm36.bullet.mail.gq1.yahoo.com with NNFMP; 06 Jun 2015 05:47:35 -0000
Received: from [98.139.215.143] by tm19.bullet.mail.gq1.yahoo.com with NNFMP; 06 Jun 2015 05:47:35 -0000
Received: from [98.139.212.233] by tm14.bullet.mail.bf1.yahoo.com with NNFMP; 06 Jun 2015 05:47:35 -0000
Received: from [127.0.0.1] by omp1042.mail.bf1.yahoo.com with NNFMP; 06 Jun 2015 05:47:35 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
X-YMail-OSG: Qf9fnogVM1nVKn8pjtUAbYmM5v71qtq58gBGyY19E.Ox_wXD7U.Q8NxIAn7c6_0
zKSGJ_vHqauEikXyJ5pVMck3z26MaAifKwiER42fIlWJNoWb4CX0oDHEH24OP0PERqczU_8O2y.a
cpwz2TggEzsJJFPhIZNEd8gJCkW21AwZDuq1YMdaaQWODWjB0n4UacHtRDA32ADQTXCj0yD5xiM4
oxfXeElOj7RaaKS1yH823tZ72hiwSqjghR1P8AkNP3DEKwD0M3XjmCzgBkKpTs6fAILzgpSKzDaK
kR.8z7ARtB5S_hdR3ABBsW8YfDRavpRlR5i_86khUbXiSTS0lWdHngEBwyZPDOueys7BVXHlY9Hn
VUFhuHt7oIQrZrBpaaK_UA494QkIgNPz9Hq0KlUajFKnHXbr0CMwpENs19psJ4Ka4IAZFfdpMFmd
POUJevfxnWw20Lvkh6uJuGdb4NP_.pHz0FuFUodM81_IFV5S6plkbYXvKYQhrw.H1K3s-
Received: by 76.13.26.159; Sat, 06 Jun 2015 05:47:35 +0000
Date: Sat, 6 Jun 2015 05:47:33 +0000 (UTC)
From: nicole horn <[email protected]>
Reply-To: nicole horn <[email protected]>
To: xxxxxxxxxxxx <[email protected]>
Message-ID: <[email protected]>
In-Reply-To: <1433569411.68576.YahooMailAndroidMobile@web122003.mail.ne1.yahoo.com>
References: <1433569411.68576.YahooMailAndroidMobile@web122003.mail.ne1.yahoo.com>
Subject: Re: Pics
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_5118499_1908046856.1433569653148"
Content-Length: 1685

IP shows yahoo only (76.13.26.159)

So I guess that's it? Dead end?

For now it is a dead end.

That header is showing Yahoo's Ip.

Darn. Well, we got the picture and e-mail out there and hopefully they won't be using it anymore.