Lukas Cudney, another scammer?

I was contacted by someone yesterday by the name of Lukas Cudley. He said he was looking for a friend on skype and my profile showed up in his search and wanted to connect with me. He seems really nice and his skype photo is very sweet, him and his daughter 7 year old Lucy. He sent me three other photos but I just feel he is too good to be true. He said his wife died after she gave birth to Lucy. He said he is an engineer for British Petroleum but he is an American who works and resides in London. He sounds educated, grammar is perfect.

I became suspicious that he is a scammer when I traced his IP address. He said he is in London but his IP address says the email he sent me originated from Sunnyvale, California. His email address is [email protected]

I also read somewhere here that a UK phone # that starts with 4470 is a fake number and anyone using this # is a scammer. This is the number he registered on skype:+447024080104

His About Me says:
I'm a nice guy, good friend, loyal, serious, silly, responsible...I am physically incapable of telling a lie (I'm not smart enough), I am humble and proud at the same time. - This should have told me something, lol.

Could someone pls tell me how to post photos here so i can post the photos he sent me.

Thanks!

I also read somewhere here that a UK phone # that starts with 4470 is a fake number and anyone using this # is a scammer. This is the number he registered on skype:+447024080104

Numbers which start with 4470 are redirect phone numbers so the person using them can appear to be in a place they are not. The number appears to come from London, UK, but the person is most likely in Nigeria or Malaysia.

The reason the header says Sunnyvale is it is a Yahoo email address and the scammer is using a proxy to cover where he really is. Thank you for posting this up.

Follow the link in my signature line to learn how to post photos. Be sure to deface them so scammers cannot reuse them.

I also read somewhere here that a UK phone # that starts with 4470 is a fake number and anyone using this # is a scammer. This is the number he registered on skype:+447024080104

Numbers which start with 4470 are redirect phone numbers so the person using them can appear to be in a place they are not. The number appears to come from London, UK, but the person is most likely in Nigeria or Malaysia.

The reason the header says Sunnyvale is it is a Yahoo email address and the scammer is using a proxy to cover where he really is. Thank you for posting this up.

Hi Bubbles, thanks for your reply. May I know whether all Yahoo emails originate from Sunnyvale, California? Sorry for my ignorance, but I just want to make sure. I have another person who has been a Skype chatmate for about two months now, so far, he has not asked me any money. He said he is in Scotland, Connecticut but when I traced the origin of his email addy, it says Sunnyvale, California.

Many thanks!

We would have to see the headers to really tell you what they say. Yahoo's servers are in Sunnyvale, CA, so any email sent via Yahoo will have Sunnyvale as part of the information.

If you will post up the entire headers we can tell you more. You can use a service like www.iptrackeronline.com to give you a read on the headers.

To add to what Bubbles said:

Not all yahoo emails will show Sunnyvale as the originating IP. Most yahoo mails do actually show an originating IP. If you are getting Sunnyvale, as Bubbles said, the scammer may be using a proxy.

Most often when you get Sunnyvale as a location, you will find NNFMP in the headers. This is a little-understood email protocol that is most often linked with spammers and scammers. Yahoo has indicated that NNFMP is often a sign of forged headers--which means it should be a definite red flag.

Thank you Bubbles and Dotti, I think these men are trying to scam me. No harm done yet but am so glad I found your site. I am posting here the headers of emails from these men. I deleted my email addy as well as the content of the email.

THIS ONE IS FROM [email protected] (Lukas Cudney). This man says he is in England working as BP engineer

Delivered-To: MY EMAIL ADDY HERE
Received: by 10.112.2.105 with SMTP id 9csp51839lbt;
Fri, 20 Apr 2012 02:32:21 -0700 (PDT)
Received: by 10.50.160.225 with SMTP id xn1mr4160002igb.3.1334914340640;
Fri, 20 Apr 2012 02:32:20 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm28-vm1.bullet.mail.ne1.yahoo.com (nm28-vm1.bullet.mail.ne1.yahoo.com. [98.138.91.35])
by mx.google.com with SMTP id dl3si1800779igb.68.2012.04.20.02.32.19;
Fri, 20 Apr 2012 02:32:20 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 98.138.91.35 as permitted sender) client-ip=98.138.91.35;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 98.138.91.35 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: from [98.138.90.54] by nm28.bullet.mail.ne1.yahoo.com with NNFMP; 20 Apr 2012 09:32:19 -0000
Received: from [98.138.226.162] by tm7.bullet.mail.ne1.yahoo.com with NNFMP; 20 Apr 2012 09:32:18 -0000
Received: from [127.0.0.1] by omp1063.mail.ne1.yahoo.com with NNFMP; 20 Apr 2012 09:32:18 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 51404 invoked by uid 60001); 20 Apr 2012 09:32:18 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1334914338; bh=f0mde4KOPhLEPaybWMCkddMkclCrfJtIM5lUoYypHlM=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=BbrNdCpZ2f1gY8x+jTAr6jpw8fOsZtwT2ur7J0i9/5ltyyIuhZpmSxJ/oJyb2Lj1QSYEdLRhFYR3KY1s0dXCDMsm9lCwcyXF+7y+0ZgIcQAv/AcHF34mBRoozUzG5fBvakse+BPWrZBkz5yNcs9AVygDfL+fsdkHu0RaC7X5HYk=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=YzaI5GpB5fN8N84whFNEvhcR6WE5/jfA/+Fphth1ZThFjutM0whB+O0VkPqJ0iErT8qafFn8q0H1mxcKkd4bg1XBA+B47DeQ167w0ByBunOfxbrGLMOTYubWd9kY+fDduTijfmrc6VIHpk1YdX52U371Wq76Cp7pc/ge+eFDKTw=;
X-YMail-OSG: nF2enH8VM1meazgOjaYb5QSMjr8CPR6.m_uzsd4ZvQJCjOU
ZvlWjWNGCeTuLLvI6u3yOMgRZI01_qorjO5LSm3vc5unJqstsGFjPOqCBBXA
8gN5119iEUtIAbRGRhwcszMp2LzLqPTdRmMOIUAr8nBsRMbY3e2kNnlA6Vmi
_8kxyBHO1ci2ybaybDcC3qzCGPScllse73tDnuNStxWP_SHgG3RBHALRI2Gz
n6I.EES3jSUEGur5mFWbJfQLf6TH_U0ZYKwV4w_LiCIE18uNS4NUJvr3ca55
la68UfDTsfw6aDkMxjuLGQQxlGhUFy_.I1sWbwCCV_ZeuDdegrue32IzS1mN
f2Xk7LElJWD6WLGkMz6szJOORcHTh0ldTjZghcEEtxlX6WhrjCLasMRmupER
.QVz29puCLHnjouC3TJ6FtIMJwrgdRIHUO..p
Received: from [41.71.151.108] by web122304.mail.ne1.yahoo.com via HTTP; Fri, 20 Apr 2012 02:32:18 PDT
X-Mailer: YahooMailWebService/0.8.117.340979
References: <CAMau3_KrS8T0B6eBUZUZR=b4bR7WAObHTOdxncSrgfwLdQcsHQ@mail.gmail.com>
Message-ID: <[email protected]>
Date: Fri, 20 Apr 2012 02:32:18 -0700 (PDT)
From: Lukas Cudney <[email protected]>
Reply-To: Lukas Cudney <[email protected]>
Subject: Re: Hi
To: <>
In-Reply-To: <CAMau3_KrS8T0B6eBUZUZR=b4bR7WAObHTOdxncSrgfwLdQcsHQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="-634093744-461538770-1334914338=:47871"

---634093744-461538770-1334914338=:47871
Content-Type: multipart/alternative; boundary="-634093744-486270244-1334914338=:47871"

---634093744-486270244-1334914338=:47871
Content-Type: text/plain; charset=us-ascii


THIS ONE IS FROM [email protected] (Rodney Stewart) This man says he is in Scotland, Connecticut and emphasized to me that Connecticut is in England. He said he is into real estate. By the way, this is the phone number he uses to call me: 447938435594. He calls me a lot but hasn't asked me for anything... yet. This is the number he uses to send me txt messages: 2542166119182

Delivered-To: MY EMAIL ADDY HERE
Received: by 10.112.2.105 with SMTP id 9csp49073lbt;
Sun, 22 Apr 2012 12:45:36 -0700 (PDT)
Received: by 10.42.119.129 with SMTP id b1mr9703607icr.48.1335123935151;
Sun, 22 Apr 2012 12:45:35 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm32-vm0.bullet.mail.ne1.yahoo.com (nm32-vm0.bullet.mail.ne1.yahoo.com. [98.138.229.48])
by mx.google.com with SMTP id us2si6188757igc.47.2012.04.22.12.45.33;
Sun, 22 Apr 2012 12:45:35 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 98.138.229.48 as permitted sender) client-ip=98.138.229.48;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 98.138.229.48 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: from [98.138.90.48] by nm32.bullet.mail.ne1.yahoo.com with NNFMP; 22 Apr 2012 19:45:32 -0000
Received: from [98.138.89.165] by tm1.bullet.mail.ne1.yahoo.com with NNFMP; 22 Apr 2012 19:45:32 -0000
Received: from [127.0.0.1] by omp1021.mail.ne1.yahoo.com with NNFMP; 22 Apr 2012 19:45:32 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 86978 invoked by uid 60001); 22 Apr 2012 19:45:32 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1335123932; bh=EGX7aHh7MWIIutoIXWVZyr9gQ7brbk2pwvamaOBJktU=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=CmJsbJEqNfexHpy48PEfjTUT0UZ5PRboaISc1GFTLN3RN9vfgFGmFA1U2flxzxGqFZBoxYE2YomG8AaSsjZhF03D2SVSFBtM2829iGDiLEmrV6IP3Z4Tn2DgwTAsUXBdFWrHIrNOI21HUop4ns9/E4Tg1Pnwo0u54EKoswzAX6k=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=3GcHWCwAy0RGyWkFmPKMf0tmHpolXkw5m44tzx/meOykpr6U41SlssDaIFPtaAnl78spaT+3XEYLdKsTvcuROBoLnmonxdVikih4aU2xCFpS/WZOHlFV/gKXtoRto1Efz43YLjxH2byIMtYQDPd2lUrqXqdkx0vU6EswmXUtt6U=;
X-YMail-OSG: x4a9.foVM1nWsUZnRbl24oPPvOd9KHzqqDDh46s2iOd6wZo
P6EO_56T6iTkpJJRLXIrdUiJ7iNJl7J0qPsxnIE6Jc8jvyFWBQIFfk0fsWil
kDjV6lgAQHCe9HAxy4H8f3lE_GXpVhjZAn7ZbRarNWUR3P4WLX732Muv6xgf
X3poETD6u3r9OA.VXRa1HPg6L7ZygS8v8D.Fvx0LV41.JcW1hqr3w7akAZxz
bq6FJ7iq9GEHYCpipjEb.vRFTtBqCTbWdEwmVfCTakNxJBZlt.VCvOI6ozKQ
iEva6gzrb90GEVUUsWv7GociKnYNNK6WGfOd.M1nHdQDMAsBGz5oMim64z2F
4tcXq2i10zPf2uO2NVyotHzlfOelZC6zYCkRxeAh3HkgDhLhcjx5DVfypdAV
f_9hzt7X.G3iKVqXZU9I4jqAb
Received: from [108.62.235.6] by web120904.mail.ne1.yahoo.com via HTTP; Sun, 22 Apr 2012 12:45:31 PDT
X-Mailer: YahooMailWebService/0.8.117.340979
References: <CAMau3_KzM4BvK62g9j0JFdAd_O8_aNhP=MRyJ1NMyLC06XRbkA@mail.gmail.com> <[email protected]> <CAMau3_JMkTmFNHvmDnea4yTQVNuAg3ehsHFVyQ2mv=eRSxr+PA@mail.gmail.com>
Message-ID: <[email protected]>
Date: Sun, 22 Apr 2012 12:45:31 -0700 (PDT)
From: Stewart Rodney <[email protected]>
Reply-To: Stewart Rodney <[email protected]>
Subject: Re: Hey Princess....
To: < >
In-Reply-To: <CAMau3_JMkTmFNHvmDnea4yTQVNuAg3ehsHFVyQ2mv=eRSxr+PA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-895799069-661424497-1335123931=:61307"

---895799069-661424497-1335123931=:61307
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

[AlanJones]

An IP check of the first header gives

Header Analysis Quick Report
Originating IP: 41.71.151.108
Originating ISP: Visafone Communications Limited
City: Abuja
Country of Origin: Nigeria
* For a complete report on this email header goto ipTRACKERonline

So a definite scammer

The second one gives

Header Analysis Quick Report
Originating IP: 108.62.235.6
Originating ISP: Ubiquity Server Solutions New York
City: New York
Country of Origin: United States
* For a complete report on this email header goto ipTRACKERonline

But the header does contain NNFMP, which as Dotti said is a red flag. Another red flag is that Connecticut is not in England as he told you, it is in New England in the USA. So why would he be using a UK (+44 is the country code for the UK) mobile phone to call you.

Thank you, thank you, thank you!
I'll try my best post the photos as soon as I can.
God bless you!

HERE ARE THE PHOTOS USED BY THIS SCAMMER FROM NIGERIA, LUKAS CUDNEY. POOR PEOPLE, THEY DON'T KNOW SOMEONE'S CAPITALIZING ON THEIR PHOTOS.

THIS PERTAINS TO ANOTHER EMAIL SENT BY THE SECOND GUY. THE FIRST EMAIL HE SENT, THE IP ADDRESS SAYS IT'S FROM NEW YORK. THIS TIME, IF I AM NOT MISTAKEN, THE EMAIL CAME FROM MALAYSIA. CAN SOMEONE PLEASE TELL ME IF I AM RIGHT? AND HOW IS THIS POSSIBLE? TWO CONSECUTIVE MAILS WITH DIFFERENT IP ADDRESSES?

HERE'S THE EMAIL HEADER:

Delivered-To:
Received: by 10.112.2.105 with SMTP id 9csp106580lbt;
Mon, 23 Apr 2012 17:48:04 -0700 (PDT)
Received: by 10.50.36.225 with SMTP id t1mr8058165igj.69.1335228484131;
Mon, 23 Apr 2012 17:48:04 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm37-vm5.bullet.mail.ne1.yahoo.com (nm37-vm5.bullet.mail.ne1.yahoo.com. [98.138.229.133])
by mx.google.com with SMTP id l4si17973111icn.80.2012.04.23.17.48.03;
Mon, 23 Apr 2012 17:48:04 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 98.138.229.133 as permitted sender) client-ip=98.138.229.133;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 98.138.229.133 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: from [98.138.90.53] by nm37.bullet.mail.ne1.yahoo.com with NNFMP; 24 Apr 2012 00:48:03 -0000
Received: from [98.138.89.254] by tm6.bullet.mail.ne1.yahoo.com with NNFMP; 24 Apr 2012 00:48:03 -0000
Received: from [127.0.0.1] by omp1046.mail.ne1.yahoo.com with NNFMP; 24 Apr 2012 00:48:03 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 47420 invoked by uid 60001); 24 Apr 2012 00:48:03 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1335228483; bh=JfFbnW8S624Suk9mR8uZlJppbhx60MJdAspTbZNPJZ0=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=4XeRC8uiBIrBvXS+lBOFWnUmhSo2b7dDCa8/Ep/9pHlv3Ib1H2eNtEerdL+WEBi0QwibxkgGxCEu2UVzd17l4htSPDjD6zIxqKAs0nlH9G0XrtDbSs4pPJPCd3DTAxZj3UvgdLTa86hGEwZFTdOc+KixR4JfOtIF1KVJ4Z7gzYY=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=UHB42+cACaAIgsABYX72zPWBAB0Eljy9k8weyrfK0cEIlvkjK5i4obS4uQFh0QqRAIPUlissTfGJZB0aS4JxdhBSVp287kf3fj6LDvk57qinGp+ZqpQlbMHiAN7hPY2WiHq2IuV1XNEnGttH3wRBs+CCrp/gBACMIEG6JB/Xn0M=;
X-YMail-OSG: 5L3O_NQVM1mtH8RiSg4A.HbeZJKpxRLHh8vhxfysj8xE2X1
ERXUjzLGG8fu6ELIdIwIoeLMk4wosSyp_LPDYtiRi4GS3k9Z37RqWvj4xJrc
gl.NJOROnkr4FAFmC4iRhLm_RrGjmtuz9ZdajVJ75SUZL.OHEdaHgSNTiIOW
7qyVp1BFpno2CY.ZysXsu1ssyjXD0zFJN4y6IZ1mjDLo3J_J6LkQ45WmoeA9
CufLdKffvkMypYmTiMKMhYnDSYuNBJoHeLsgpCFnpKEL7fGuqWNUkifV4F86
EMY.rhlsgLl7K0fIjxO6HZgJ.76h95KwHJm9N8EVhyXvS4CkTTv7Koio5Kts
kelNY0XTrmn4Lf_n7CQePnedz1FogcLPbZ826BGo1tAHKQN4XrquUihdLmO.
7_UTlLIKbNGubH7THIep.bSWxX1LK
Received: from [120.139.118.147] by web120903.mail.ne1.yahoo.com via HTTP; Mon, 23 Apr 2012 17:48:02 PDT
X-Mailer: YahooMailWebService/0.8.117.340979
References: <CAMau3_KzM4BvK62g9j0JFdAd_O8_aNhP=MRyJ1NMyLC06XRbkA@mail.gmail.com> <[email protected]> <CAMau3_JMkTmFNHvmDnea4yTQVNuAg3ehsHFVyQ2mv=eRSxr+PA@mail.gmail.com> <[email protected]> <CAMau3_L_Xy-d0FbP1TXfkZvcCfJ5bwza0Hjzwk1WpBGqeiCWkQ@mail.gmail.com> <CAMau3_LA1O8P6XiSbKAfW7S5fRCUk_isrcsW9Wa4LDy5jZqhiQ@mail.gmail.com>
Message-ID: <[email protected]>
Date: Mon, 23 Apr 2012 17:48:02 -0700 (PDT)
From: Stewart Rodney <[email protected]>
Reply-To: Stewart Rodney <[email protected]>
Subject: Re: Hey Princess....
To: < >
In-Reply-To: <CAMau3_LA1O8P6XiSbKAfW7S5fRCUk_isrcsW9Wa4LDy5jZqhiQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="357496409-371054941-1335228482=:25045"

--357496409-371054941-1335228482=:25045
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

HERE'S THE CONTENT OF HIS EMAIL, I HIGHLIGHTED INFORMATION THAT I FIND REALLY CONFUSING.

Hey dear... how you doing over there and am just wondering why on earth i would wanna hide something from you over where i am at the moment? well if you would love to visit, be my guest ok. I told you i came to England right from the states and right now am in Scotland when i found out that my business would make more reasonable proceeds here in Scotland so i took a trip down to this place and that was by road from London.

Scotland only has land border is with England and the Capital city is Edinburgh, which runs for 96 kilometres (60 mi) in a northeasterly direction from the Solway Firth in the west to the North Sea on the east coast. The geography of Scotland is highly varied, from rural lowlands to barren uplands, and from large cities to uninhabited islands. Located in north-west Europe, Scotland comprises the northern one third of the island of Great Britain. Aside from the mainland, Scotland is surrounded by 790 island encompassing the major archipelagoes of the Shetland Island, Orkney Islands and the Outer Hebrides.

Now i tell you again that am Located in Route 14, few houses away from St.Margerets Church Hall Scotland CT. Hope you ok now and i look forward having you here ok. I will go to bed now Honey as it's pretty late and its time to go to bed dear... catch you online later babes.... Good nite!

[AlanJones]

The IP address does indeed resolve to Malaysia for this new message

Header Analysis Quick Report
Originating IP: 120.139.118.147
Originating ISP: Packet One Networks (m) Sdn
City: n/a
Country of Origin: Malaysia
* For a complete report on this email header goto ipTRACKERonline

These headers still have the NNFMP in them, but it is possible that in the previous email the scammer was using a Proxy server to hide his location and for some reason didn't when he sent this email.

I think it is clear that this scammer is definately not in Scotland (Conneticut or the country) and is only interested in your money.

Thank you.

You are right, he probably failed to use a proxy server when he sent the last email and it was a good thing, it confirmed my suspicion. Luckily for me, I only gave him my time and nothing else. Unluckily for him, he invested in phone calls to try to get the best of me. We had been exchanging emails and often on skype chat for almost two months now! Hah, he is not smart enough I guess. Doesn't know how to extract information or money from me . I am just puzzled why he was able to use a UK mobile phone while in Malaysia...

Anyway, I'll soon be posting the photos he used to try to romance-scam me.

PHOTOS USED BY RODNEY STEWART ([email protected]). THESE ARE THE SAME PHOTOS HE USED AT http://WWW.LAVAPLACE.COM. HE REMOVED HIS PROFILE IN LESS THAN 2 DAYS AFTER TELLING ME HE DIDN'T LIKE IT THERE BECAUSE HE WAS RECEIVING LEWD MESSAGES FROM WOMEN WHO ONLY WANT MONEY FROM HIM.

I just found out thru Google search that the photo Rodney Stewart ([email protected]) was using as Skype Avatar is that of Marc MacLeod, the actor.



This is the website where I found the photo via Google search:
http://www.starnow.com/marcmacleod