Email Spam Filter:
jwSpamSpy
Try it for free!


About spam / "419" / Blog
jwSpamSpy
Recent spam domains
Spam domain blacklist

Software
Links
joewein.de
joewein.net
Contact
Google

 

"419" Scam – Officelineworld.com

On the face of it, the following email is a sales enquiry for a notbook computer and some printer supplies:

From: "OFFICELINEWORLD INC" <officeline@officelineworld.com<
To: officeline@officelineworld.com
Date: Sun, 10 Oct 2004 04:14:44 +0000
Subject: ATTN: PURCHASE/ORDER

DEAR SALES,
I WILL LIKE TO MAKE AN ENQUIRY FOR THE QUOTES OF THE LISTED PRODUCT BELOW:
================================================
HP-C6578DN/AN OEM INKJET CARTRIDGE
HP-C4129X OEM TONER CARTRIDGE
HP LAPTOP WITH THIS SPECIFICATION :P4 2.8 512 60/80 CD/DVD-RW 15"XPP
======================================================
KINDLY GET BACK TO ME WITH THE QUOTES/PRICES OF ANY OF THE LISTED PRODUCT YOU HAVE IN STOCK,PAYMENT WILL BE MAKE BY CREDIT CARD.WAITING TO HEAR FROM YOU SOONEST.

KIND REGARDS,
OFFICE REP.

On closer inspection, it bears many marks of the 419 scam, even though the body looks different.

  • Mail appears addressed to sender. Actually, it has been sent to many recipients via Bcc (blind carbon copy), which normally produces a "Recipient list suppressed" message, unless one specific recipient is listed.
  • Domain of of the sender is recently registered domain (MSN/Hotmail) which has no website yet. It is used for email correspondence only.
  • Subject and body are in all capital text.
  • Originating IP address is in Nigeria.
  • Sender discloses no postal address or even location.
  • This mail was sent to a personal email address, not to a business.
I'd be very careful dealing with this kind of customer. There's more that's suspicious about this:
  • The big ticket item is listed last not first on the inquiry
  • No person's name listed in the inquiry
  • Ink and toner cartridges are standard consumable items available in just about any country. Shipping costs for small quantities would be prohibitive, unless the buyer intends someone else to bear the costs...
Nigeria is but one of several high risk countries for accepting mail order business from. Other countries in that category (with varying degrees of risk) are: Indonesia, Romania, Ukraine, Yugoslavia, Lithuania, Egypt, Bulgaria, Turkey and Russia. Many mail order businesses refuse to ship to these countries or take precautions to verify the identity of the buyer vs. the credit card. Please read the recommendations at the following websites:


Received: from bay23-f6.bay23.hotmail.com ([64.4.22.56] helo=hotmail.com)
by ########### with esmtp (Exim 4.41)
id 1CGV7P-0000N6-FB
for ########@######; Sun, 10 Oct 2004 06:15:35 +0200
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Sat, 9 Oct 2004 21:15:01 -0700
Received: from 213.185.106.3 by by23fd.bay23.hotmail.msn.com with HTTP;
Sun, 10 Oct 2004 04:14:44 GMT
X-Originating-IP: [213.185.106.3]
X-Originating-Email: [officeline@officelineworld.com]
X-Sender: officeline@officelineworld.com
From: "OFFICELINEWORLD INC" <officeline@officelineworld.com>
To: officeline@officelineworld.com
Date: Sun, 10 Oct 2004 04:14:44 +0000
Mime-Version: 1.0
Message-ID: <BAY23-F6VKi3s1wsXZZ0000108f@hotmail.com>
X-OriginalArrivalTime: 10 Oct 2004 04:15:01.0085 (UTC) FILETIME=[B60188D0:01C4AE7F]
Subject: ATTN: PURCHASE/ORDER
Content-Type: text/html
X-UIDL: oL%"!>=<"!B>##!~g/"!

<html><div style='background-color:'><DIV class=RTE><STRONG><FONT color=#0000ff>DEAR SALES,<BR>I WILL LIKE TO MAKE AN ENQUIRY FOR THE QUOTES OF THE LISTED PRODUCT BELOW:<BR>================================================<BR>HP-C6578DN/AN OEM INKJET CARTRIDGE</FONT></STRONG></DIV> <DIV class=RTE><STRONG><FONT color=#0000ff>HP-C4129X OEM TONER CARTRIDGE</FONT></STRONG></DIV> <DIV class=RTE> <DIV class=RTE><STRONG><FONT color=#0000ff></FONT></STRONG></DIV><FONT color=#0000ff><STRONG>HP LAPTOP WITH THIS SPECIFICATION :P4 2.8 512 60/80 CD/DVD-RW 15"XPP</STRONG></FONT></DIV> <DIV class=RTE><FONT color=#0000ff><STRONG>======================================================<BR>KINDLY GET BACK TO ME WITH THE QUOTES/PRICES OF ANY OF THE LISTED PRODUCT YOU HAVE IN STOCK,PAYMENT WILL BE MAKE BY <FONT color=#ff0066>CREDIT CARD</FONT>.WAITING TO HEAR FROM YOU
SOONEST.</STRONG></FONT></DIV>
<DIV class=RTE> </DIV>
<DIV class=RTE><STRONG><FONT color=#0000ff>KIND REGARDS,<BR>OFFICE REP.</FONT></STRONG></DIV></div></html>


     inetnum:      213.185.106.0 - 213.185.106.255
     netname:      INTELSAT-CUST-Timasy-NG
     descr:        Reassignment to Timasy customer, Nigeria
     country:      NG
     admin-c:      OO120-RIPE
     tech-c:       AO895-RIPE
     status:       ASSIGNED PA
     remarks:      *************************************************************
     remarks:      *                                                           *
     remarks:      *  For issues of abuse related to this IP address block,    *
     remarks:      *  including spam, please send email to:                    *
     remarks:      *                                                           *
     remarks:      *                    osytao@yahoo.com                       *
     remarks:      *                    techsupport@timasy.com                 *
     remarks:      *                                                           *
     remarks:      *************************************************************
     mnt-by:       AS22351-MNT
     mnt-lower:    AS22351-MNT
     mnt-routes:   AS22351-MNT
     changed:      tac.ops@Intelsat.com 20030915
     source:       RIPE
     
     person:       Osita Okeke
     address:      8b Akerele Street
                   Surulere, Lagos State, Nigeria
     phone:        +234 7736477
     e-mail:       osytao@yahoo.com
     nic-hdl:      OO120-RIPE
     mnt-by:       AS22351-MNT
     changed:      TAC.OPS@Intelsat.com 20040915
     source:       RIPE
     
     person:       Anthony Onyeka
     address:      8b Akerele Street
                   Surulere, Lagos State, Nigeria
     phone:        +234 1 891 1621
     e-mail:       tonyekas@yahoo.com
     nic-hdl:      AO895-RIPE
     mnt-by:       AS22351-MNT
     changed:      TAC.OPS@Intelsat.com 20040915
     source:       RIPE

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!