Stolen ID: Incase Finance 80 Jack Rice, Rosemere, QC J7A 4Z1

[vonpaso xlura]

Please post the entire, complete, unabridged headers, including Received, In-Reply-To, X-Original-IP, and everything else, omitting only your name and address and anything that could identify you.

[Bryon Williams]

^^ It may be easier to send the scammer a hello and get the headers.

[Novi Winfield]

Delivered-To: [email protected]
Received: by 10.237.36.195 with SMTP id u3csp2083919qtc;
Tue, 31 May 2016 15:04:24 -0700 (PDT)
X-Received: by 10.107.132.209 with SMTP id o78mr1018759ioi.37.1464732264597;
Tue, 31 May 2016 15:04:24 -0700 (PDT)
Return-Path: <bounces+3166724-d53c-xxx=[email protected]>
Received: from o50314942.outbound-mail.sendgrid.net (o50314942.outbound-mail.sendgrid.net. [50.31.49.42])
by mx.google.com with ESMTPS id j19si47563923ioo.156.2016.05.31.15.04.23
for <[email protected]>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 31 May 2016 15:04:24 -0700 (PDT)
Received-SPF: pass (google.com: domain of bounces+3166724-d53c-xxx=[email protected] designates 50.31.49.42 as permitted sender) client-ip=50.31.49.42;
Authentication-Results: mx.google.com;
dkim=pass [email protected];
spf=pass (google.com: domain of bounces+3166724-d53c-xxx=[email protected] designates 50.31.49.42 as permitted sender) smtp.mailfrom=bounces+3166724-d53c-xxx=[email protected]
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sendgrid.net;
h=from:reply-to:to:subject:in-reply-to:references:mime-version:content-type:x-feedback-id;
s=smtpapi; bh=iq3n8H77WZ69MkXxRHceyNjsAaI=; b=PWoGu7OCImAXBL8Vlr
uqrtxcPpY0CyOcqGb+k1BZ01OQ2w6W1SSQzw8An3ktDiEPfeHUhq24MBHpKVXWw0
FL0c2ps/7LLg6tRbiwIuJZELJo3zR/5f1Euq/47iM44SFYvPWMQ6K7LEYeTNzOiX
4groseqpEGiyI1C8PlsZTV4Gk=
Received: by filter0539p1mdw1.sendgrid.net with SMTP id filter0539p1mdw1.8409.574E0A6312
2016-05-31 22:04:19.241935577 +0000 UTC
Received: from [10.10.0.10] (unknown [174.89.137.124])
by ismtpd0003p1iad1.sendgrid.net (SG) with ESMTP id 1jQZYiWkRUC85PUndjHayQ
for <xxx.com>; Tue, 31 May 2016 22:04:17.022 +0000 (UTC)
Date: Tue, 31 May 2016 18:03:08 -0400
From: "Samantha G. Peters" <[email protected]>
Reply-To: Samantha Peters <[email protected]>
Organization: Incase Finance
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: xxx <[email protected]>
Subject: Hello xxx. Please provide required information
In-Reply-To: <CAK05JDpzt-kCgECNWmpLgQx0Kq-GU3L=[email protected]>
References: <C15DD545490F639271CED0ED47887794B71F62E1@IK-PC>
<CAK05JDpzt-kCgECNWmpLgQx0Kq-GU3L=[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------0F116D0DD35A27AE0"
X-SG-EID: ZZISazsW6Yq3n58DqI8wp7CTWgYFxyxOcVeRThOk8LC4vtGEQkNt6ohfPL3fdSOI6gJj4Z4JP/11ra
YUcKoxqZGePl9bTLcXOOFNHaOHhCdsZjneRDDxr47iGcoY9U950oCXxYUoRtlC9eFi/vEP+dt8xORS
yYdqDtjjVn1yoeoXu8jB3PLcudtRgeM1Fzq/2XBJzvIDaKYBj5GCLWfP0nN461SgK91VY0pznUoJe3
Q8kwbM4AtZNZvprtGQInps
X-Feedback-ID: 3166724:nYO1G3oN78pYW0/rqhqWPFVLSZBBQI8W8gaVo5oGYnk=:nYO1G3oN78pYW0/rqhqWPFVLSZBBQI8W8gaVo5oGYnk=:SG

[vonpaso xlura]

Thanks! The scammer may be in Canada on a DSL connection, or that may be an infected computer he uses to hide his real location.