by alexzt
Continuation of the "Scott Ramos / Ramos Scott" persona first reported in this forum in 2015 (thread 96197, historical email [email protected]). The network has revived the alias in 2024-2026 with an expanded three-layer script.
=== IDENTIFIERS (active as of April 2026) ===
Aliases:
- "Kicko Ramos Scott" (primary, the romance persona)
- "Traductor Kicko" (accomplice, poses as a Cypriot translator)
- "Kesikli Law Firm" (third layer, IMPERSONATES the real Istanbul law firm Kesikli Law Firm - kesikli.com - which is a legitimate, uninvolved victim of this impersonation)
- "Mariam Yusuf" (supposed wife of the translator, supposedly hospitalised)
Emails:
- [email protected] (the romance persona)
- [email protected] (the impersonated "lawyer")
Phone numbers (WhatsApp):
- +34 611 338 370 (Yoigo Spain - burner SIM, WhatsApp Business)
- +357 94 054 462 (CYTA Cyprus - "translator")
- +357 96 368 509 (Cyprus, secondary line shared by Kicko)
Bitcoin wallet (deposit address on Bybit):
- 19Efxvtc2uzirqeKsMwmMc6NQFsvr6yAKE
(active 2024-10-10 to 2025-12-01, 59 tx, 0.182 BTC cycled, full sweep to Bybit hot wallet 1DLeNApsHNNzUMNZJVoXeyEY5sdp8vzx3w)
=== SCRIPT & MODUS OPERANDI ===
Phase 1 - Contact:
- Initial contact through dating sites (at least one confirmed vector: Plenty of Fish), rapid migration to WhatsApp Business.
- Profile uses stolen photograph of a grey-bearded Caucasian male in his sixties, white linen shirt, garden background.
Phase 2 - Attachment:
- Intense daily messaging in Spanish (AI-translated from English template; same templates shared between "Kicko" and other accounts).
- Classic oil-platform consultant / expatriate back in Europe storyline.
Phase 3 - Crisis:
- "Detained at Ercan airport in Northern Cyprus" narrative.
- Passport seized, needs bond to leave.
- Fake US passport (impossible birthplace "Barcelona, Spain", AI-generated eagle, malformed MRZ, a different man's photograph than the one used in chat).
- Fake Turkish Airlines itinerary (TK963 Ercan ECN -> Istanbul IST -> Madrid MAD, locator TXVC55).
- Fake "TRNC Payment Confirmation Notice" for 48,500 EUR dated 27 Nov 2025 with TRNC government emblem.
Phase 4 - Cascade:
- Bitcoin deposits through cajero machines in Spain and Costa Rica.
- SWIFT bank transfer to an "exchanger" in Emirdag / Afyonkarahisar, Turkiye.
- iTunes/Apple gift cards and Steam gift cards under the pretext of "fixing Kicko's phone" and "buying chemical to clean a machine".
Phase 5 - Recycling:
- New personas rotate in (Tom Tom Estados, Raymond from POF) as the main persona becomes less productive.
- The "Traductor" stays constant and plays the role of "ally" warning the victim against OTHER scammers, to reinforce his own credibility.
=== GEOGRAPHIC CONTRADICTION ===
The scammers place "Mariam Yusuf" in "British Kolan Hospital, Istanbul". In reality, Kolan British Hospital is located in Gonyeli/Lefkosa (Nicosia North, TRNC, Cyprus), NOT in Istanbul. In Istanbul the group operates "Kolan International Hospital" (Sisli). This confuses sister hospitals of the same group and strongly indicates the operator is based in Northern Cyprus.
=== REAL VICTIM (Kesikli Law Firm) ===
The legitimate law firm Kesikli Law Firm (https://kesikli.com, founded 2007 by Omer Kesikli) uses @kesikli.com for all official communication. The firm has been contacted to confirm the impersonation and potentially file their own complaint in Turkiye.
=== SAMPLE TEXT FROM THE SCAM (verbatim, Spanish) ===
"Buenos dias, mi amor. He leido tus mensajes y siento todo lo que estas pasando. (...) Solo quiero salir de aqui y volver contigo para devolverte todo - el doble, con todo mi amor. Por favor, hoy es muy importante para mi. Si puedes, intenta conseguir prestado lo que sea posible hoy para que podamos terminar con todo esto antes del fin de semana. (...) Puedes usar Bitcoin porque es mas rapido, o si prefieres una transferencia bancaria, dimelo y te envio los datos. (...) Te quiero muchisimo."
=== STATUS ===
Criminal complaint being filed in Spain with the Guardia Civil Telematic Crimes Unit (GDT). Reports also filed to Chainabuse (BTC wallet), Google (both Gmail addresses), Meta (WhatsApp Business accounts), Plenty of Fish (Raymond profile), Bybit and Binance (law-enforcement preservation requests).
Posting here to warn future victims and to add a second public anchor to the original 2015 thread.
=== IDENTIFIERS (active as of April 2026) ===
Aliases:
- "Kicko Ramos Scott" (primary, the romance persona)
- "Traductor Kicko" (accomplice, poses as a Cypriot translator)
- "Kesikli Law Firm" (third layer, IMPERSONATES the real Istanbul law firm Kesikli Law Firm - kesikli.com - which is a legitimate, uninvolved victim of this impersonation)
- "Mariam Yusuf" (supposed wife of the translator, supposedly hospitalised)
Emails:
- [email protected] (the romance persona)
- [email protected] (the impersonated "lawyer")
Phone numbers (WhatsApp):
- +34 611 338 370 (Yoigo Spain - burner SIM, WhatsApp Business)
- +357 94 054 462 (CYTA Cyprus - "translator")
- +357 96 368 509 (Cyprus, secondary line shared by Kicko)
Bitcoin wallet (deposit address on Bybit):
- 19Efxvtc2uzirqeKsMwmMc6NQFsvr6yAKE
(active 2024-10-10 to 2025-12-01, 59 tx, 0.182 BTC cycled, full sweep to Bybit hot wallet 1DLeNApsHNNzUMNZJVoXeyEY5sdp8vzx3w)
=== SCRIPT & MODUS OPERANDI ===
Phase 1 - Contact:
- Initial contact through dating sites (at least one confirmed vector: Plenty of Fish), rapid migration to WhatsApp Business.
- Profile uses stolen photograph of a grey-bearded Caucasian male in his sixties, white linen shirt, garden background.
Phase 2 - Attachment:
- Intense daily messaging in Spanish (AI-translated from English template; same templates shared between "Kicko" and other accounts).
- Classic oil-platform consultant / expatriate back in Europe storyline.
Phase 3 - Crisis:
- "Detained at Ercan airport in Northern Cyprus" narrative.
- Passport seized, needs bond to leave.
- Fake US passport (impossible birthplace "Barcelona, Spain", AI-generated eagle, malformed MRZ, a different man's photograph than the one used in chat).
- Fake Turkish Airlines itinerary (TK963 Ercan ECN -> Istanbul IST -> Madrid MAD, locator TXVC55).
- Fake "TRNC Payment Confirmation Notice" for 48,500 EUR dated 27 Nov 2025 with TRNC government emblem.
Phase 4 - Cascade:
- Bitcoin deposits through cajero machines in Spain and Costa Rica.
- SWIFT bank transfer to an "exchanger" in Emirdag / Afyonkarahisar, Turkiye.
- iTunes/Apple gift cards and Steam gift cards under the pretext of "fixing Kicko's phone" and "buying chemical to clean a machine".
Phase 5 - Recycling:
- New personas rotate in (Tom Tom Estados, Raymond from POF) as the main persona becomes less productive.
- The "Traductor" stays constant and plays the role of "ally" warning the victim against OTHER scammers, to reinforce his own credibility.
=== GEOGRAPHIC CONTRADICTION ===
The scammers place "Mariam Yusuf" in "British Kolan Hospital, Istanbul". In reality, Kolan British Hospital is located in Gonyeli/Lefkosa (Nicosia North, TRNC, Cyprus), NOT in Istanbul. In Istanbul the group operates "Kolan International Hospital" (Sisli). This confuses sister hospitals of the same group and strongly indicates the operator is based in Northern Cyprus.
=== REAL VICTIM (Kesikli Law Firm) ===
The legitimate law firm Kesikli Law Firm (https://kesikli.com, founded 2007 by Omer Kesikli) uses @kesikli.com for all official communication. The firm has been contacted to confirm the impersonation and potentially file their own complaint in Turkiye.
=== SAMPLE TEXT FROM THE SCAM (verbatim, Spanish) ===
"Buenos dias, mi amor. He leido tus mensajes y siento todo lo que estas pasando. (...) Solo quiero salir de aqui y volver contigo para devolverte todo - el doble, con todo mi amor. Por favor, hoy es muy importante para mi. Si puedes, intenta conseguir prestado lo que sea posible hoy para que podamos terminar con todo esto antes del fin de semana. (...) Puedes usar Bitcoin porque es mas rapido, o si prefieres una transferencia bancaria, dimelo y te envio los datos. (...) Te quiero muchisimo."
=== STATUS ===
Criminal complaint being filed in Spain with the Guardia Civil Telematic Crimes Unit (GDT). Reports also filed to Chainabuse (BTC wallet), Google (both Gmail addresses), Meta (WhatsApp Business accounts), Plenty of Fish (Raymond profile), Bybit and Binance (law-enforcement preservation requests).
Posting here to warn future victims and to add a second public anchor to the original 2015 thread.
