Roy Calvin

Yahoo IM roycalvin78
Email [email protected][/b]

There is an actor online by the name of Calvin Roy and he uses his pictures and flipped his name around. I see that the picture that was used in the scam finally has a tradmark on it but its in the corner

He claims to be in Africa working on bridges, says he is from Texas and has property there. Also his reason for not speaking good English is because he grew up in a Military family and they moved around alot. Also says he has one son.

Hi StrawberryShortcake,

As well as the pictures, the thing that will be really useful will be a copy of this person's first email or two, complete with headers. Do make sure that you remove all your personal information first: your name and email address may appear a few times in the headers.

Oh I forgot to post the header... It was your post that helped me find the header for gmail.. let me go copy it.. Thanks for reminding me..

Let me know if you need me to add more to the header. Also it looks like 68.142.206.147 might be the IP addy ? If so then I don't think it will give us any info.

68.142.206.147 is Yahoo's own IP address. Probably the header from that email you received continues a bit further, all the way down to the Date and From etc part, like this old one:

Received: from [41.208.134.189] by web45507.mail.sp1.yahoo.com via HTTP; Thu, 18 Jun 2009 03:39:47 PDT
X-Mailer: YahooMailClassic/5.4.17 YahooMailWebService/0.7.289.15
Date: Thu, 18 Jun 2009 03:39:47 -0700 (PDT)
From: <[email protected]>
Subject: Re: COST OF THE DOCUMENTS
To: xxxxxx

It would be good to include the text of the email as well - though, once again, do delete any personal information of your own: your name, and any personal remarks.

Delivered-To:
Received: by 10.231.59.65 with SMTP id k1cs204179ibh;
Tue, 1 Jun 2010 00:26:40 -0700 (PDT)
Received: by 10.150.66.18 with SMTP id o18mr5868580yba.242.1275377200177;
Tue, 01 Jun 2010 00:26:40 -0700 (PDT)
Return-Path: <[email protected]>
Received: from n20.bullet.mail.mud.yahoo.com (n20.bullet.mail.mud.yahoo.com [68.142.206.147])
by mx.google.com with SMTP id g3si18477115ybh.33.2010.06.01.00.26.38;
Tue, 01 Jun 2010 00:26:39 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 68.142.206.147 as permitted sender) client-ip=68.142.206.147;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 68.142.206.147 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: from [68.142.200.227] by n20.bullet.mail.mud.yahoo.com with NNFMP; 01 Jun 2010 07:26:36 -0000
Received: from [67.195.9.82] by t8.bullet.mud.yahoo.com with NNFMP; 01 Jun 2010 07:26:37 -0000
Received: from [98.137.27.213] by t2.bullet.mail.gq1.yahoo.com with NNFMP; 01 Jun 2010 07:26:36 -0000
Received: from [127.0.0.1] by omp123.mail.gq1.yahoo.com with NNFMP; 01 Jun 2010 07:26:36 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 88722 invoked by uid 60001); 1 Jun 2010 07:26:36 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1275377195; bh=CGb5WfmLbVGNgaxHxMBzfhsig2AJafmuSgerQj6OGeY=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=f4MDALxD9tQb+vTAGzMZLW6E5WFx27nA5UaG5z4cbVYh8RQTC3m3qUNNuvOwfGRsHMjvsuLX7L9lFqo3tTa1grUHFKpOnDyLRxDNkL47uThGEwloRX6s3C5vaCbvJ3BLJ8V/iYvsoXfhejW7m2vmpeeRXgc1tkSMXVmgeIDZWRw=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
b=bMJzyACF+7lKezWq9aQJKwnZ5vUP7rNu4zPklWpnjKV8c6o9hBTjYV17bpQrlqEpqGiEdTT4I3JM6poKUF25crMOLoDA7eviGbamoi9TgnJqmar810bvzmPIQ4OSZ/ZQfiCKMUJkjHrM5hLM5vz7pcRMvGVAYPA8XXFInyySPqE=;
Message-ID: <[email protected]>
X-YMail-OSG: wTsNNi8VM1nlE3DUYV8Kn0DEM4Q3wxaxLdG8wyhNVIS0Uil
wRZJ4RIItYDNHXtSXfJHCup9MdG8WguMoy9MjUlc78XCwtzkKpzx4z17EBmy
OBBlim7TEvnR_3KE3K6h61tlF9qMiuixZwDdIWHntkFjM3E7gtj5AOgWDFfD
hxPvKbI4qcB6d7oyXFTi_6Y_55yxVxj96DzJ7IV9eyOn67NOlvOsi7i7elk7
PMF16PxZA_vlWCCgByMXj5iCrC8UN2NKA9HvmDAPHRF_TBe6mZdoVSMx_L4e
k6YhAOhD6vvh6oUYTVdWXm6RuZt8_umePcQE12zW6GDASd6IYl89CyK2lcbo
ESj1sTjCbgyj5ZaAzdwNWs.CO5o.fZslhTDhj2Rl8ln_zORVTdvxRKjQrLVn
zaJz5HF3jzFD1gN8ne0iS9kb3pmeEIPU7re7DYLqFwXDVwYTX9f85w5lMHMd
PBf9zQcs2Aj1H.Iu5Pjre6QXBK_o3nF9U
Received: from [41.155.93.73] by web114411.mail.gq1.yahoo.com via HTTP; Tue, 01 Jun 2010 00:26:35 PDT
X-Mailer: YahooMailClassic/11.0.8 YahooMailWebService/0.8.103.269680
Date: Tue, 1 Jun 2010 00:26:35 -0700 (PDT)
From: Roy Calvin <[email protected]>
Subject: hello from Roy
To:
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-2086656389-1275377195=:85942"
--0-2086656389-1275377195=:85942
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

hello my love i am=A0 will be happy to here from you cos i have miss you in=
my life and i can wait to here from you my love just come online so that w=
e can chat online and i wanna be happy with you my love so come online and =
let talk my love i love you babe i care Roy
=0A=0A=0A
--0-2086656389-1275377195=:85942
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<table cellspacing=3D"0" cellpadding=3D"0" border=3D"0" ><tr><td valign=3D"=
top" style=3D"font: inherit;">hello my love i am&nbsp; will be happy to her=
e from you cos i have miss you in my life and i can wait to here from you m=
y love just come online so that we can chat online and i wanna be happy wit=
h you my love so come online and let talk my love i love you babe i care Ro=
y<br></td></tr></table><br>=0A=0A
--0-2086656389-1275377195=:85942--

lol... it posted 3 times.. Its just the day I have been having..

Also at the bottom of the letter then letter section is showed twice. Is that normal?

Could a mod plzzz delete the extra 2 post ^^ there..

There you go: the duplicate postings are now deleted!

It's not unusual for the text of the email to be repeated in the header information.

This is the part which shows where the email was sent from:

Received: from [41.155.93.73]

41.155.93.73 is an IP address of the internet service provider Starcomms Ltd of Lagos, Nigeria - so Nigeria is where the scammer is located.

Thank you for posting this.

Thank you Chris!!! For cleaning up the extras post and for figuring out where the emails are coming from.., I also have his picture.. Going to try and post it at the top..